From 66c7fad7148dce03b480a727b58b60e0f228372f Mon Sep 17 00:00:00 2001 From: Luca Biemelt Date: Tue, 14 Jul 2026 11:05:08 +0200 Subject: [PATCH] Advertise the Key Connector to new SSO users The clients only start the enrollment flow when the login response contains KeyConnectorOption, which so far was only sent for users that were already enrolled. Send it to every user without a master password while the connector is enabled, so a freshly provisioned SSO user gets enrolled instead of being asked to create a master password. --- src/api/identity.rs | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/api/identity.rs b/src/api/identity.rs index 0f936d6c..229bbb86 100644 --- a/src/api/identity.rs +++ b/src/api/identity.rs @@ -604,7 +604,9 @@ async fn authenticated_response( result["Key"] = Value::String(user.akey.clone()); } - if uses_key_connector { + // Also advertised to users without a master password, that is how the client + // knows to enroll a new SSO user with the connector + if CONFIG.key_connector_enabled() && !has_master_password { result["UserDecryptionOptions"]["KeyConnectorOption"] = crate::api::core::key_connector::key_connector_user_decryption_option(); }