From 317883c8c26878335c9940394f37c0eee166cbcd Mon Sep 17 00:00:00 2001 From: Luca Biemelt Date: Tue, 14 Jul 2026 11:05:08 +0200 Subject: [PATCH] Advertise the Key Connector to new SSO users The clients only start the enrollment flow when the login response contains KeyConnectorOption, which so far was only sent for users that were already enrolled. Send it to every user without a master password while the connector is enabled, so a freshly provisioned SSO user gets enrolled instead of being asked to create a master password. --- src/api/identity.rs | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/api/identity.rs b/src/api/identity.rs index dc3ea6b9..d2b7a02e 100644 --- a/src/api/identity.rs +++ b/src/api/identity.rs @@ -577,7 +577,9 @@ async fn authenticated_response( result["Key"] = Value::String(user.akey.clone()); } - if uses_key_connector { + // Also advertised to users without a master password, that is how the client + // knows to enroll a new SSO user with the connector + if CONFIG.key_connector_enabled() && !has_master_password { result["UserDecryptionOptions"]["KeyConnectorOption"] = crate::api::core::key_connector::key_connector_user_decryption_option(); }