Should this code be in the code behind or separate class?
Since you actually have a business layer, that's where I'd put it.  You should let the business layer handle the finding/creating of an organization, so all the WebForms code needs to do is ask for an IpasLogOnManagement.IpasOrganization object based on the name the user selected (lstOrganizations) or entered (txtOrganizationName).