Note in README and design that lossless restore makes revocation
IdP-authoritative: a member revoked in the vault is re-activated on the next
sync if the IdP still shows them active, and a leaked token can reinstate any
previously-confirmed member. Document token-management audit events and the
omitted-vs-empty members and externalId-uniqueness semantics. Add TODOS.md
tracking the deferred follow-ups (config-gated denial tests, live Entra
validation, coverage edges, perf backlog, upstream ip_constant lints).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Seed tokens through the real mint_scim_token path; add a minted-token round-trip
plus rotation-invalidates-old-token test; add a disabled-key case to the
uniform-401 matrix; unit-test rollback_provisioning (pre-existing user survives,
shell user cascades); and add group externalId-uniqueness and omitted-vs-empty
members regression tests.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Reference api::scim::SCIM_BODY_LIMIT when registering the rocket "scim" data
limit so it stays in sync with the fallback in the ScimJson data guard.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Log an org event under the acting admin's identity when a SCIM token is
generated, rotated, or deleted (previously unaudited). Extract the mint path
into manage::mint_scim_token so the token format and the guard's verification
share one definition. Extract rollback_provisioning and log when the rollback
delete itself fails instead of silently dropping the result. Re-send the invite
when a member is restored to Invited (an omitted or expired original invite
otherwise leaves a reactivated member with a membership they cannot join).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Enforce per-org externalId uniqueness on Group PUT and PATCH (409 uniqueness
before any write, self-reassertion allowed), matching the Users endpoints. Make
members optional on PUT so an omitted list leaves membership unchanged while an
explicit empty list clears it, preventing a sparse client from wiping a group.
Resolve members and validate externalId before writing, log GroupDeleted only
after the delete succeeds, and collapse the double group.save on PATCH.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
log_event is a no-op unless ORG_EVENTS_ENABLED is set, so SCIM provisioning
changes would leave no audit trail on a default deployment. Print a startup
warning when SCIM_ENABLED is set but ORG_EVENTS_ENABLED is not.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
MySQL/InnoDB silently ignores inline column-level REFERENCES, so the original
migration created no foreign key at all on MySQL. Use a table-level FOREIGN KEY
clause and match organizations.uuid's VARCHAR(40) type exactly so the
constraint is actually created.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Move the SCIM actor constants, page-size caps, body limit, pagination
clamp, ListResponse builder, and resource-location helper into scim/mod.rs so
users.rs, groups.rs, discovery.rs, and main.rs share one definition instead of
re-inlining literals. Export LIST_RESPONSE_URN and reference SCIM_MAX_RESULTS
from ServiceProviderConfig so the advertised filter cap and the enforced cap
cannot drift.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Add User::find_by_uuids for a single batched query, replacing the per-member
User::find_by_uuid loop in the SCIM Users list handler. Correct the
ScimApiKey::save comment to describe the actual upsert idiom and document the
enabled column as reserved for a future disable endpoint.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Phase 4 of the SCIM v2 implementation:
- The two hardcoded 'useScim: false' sites in organization.rs now report
CONFIG.scim_enabled(), so clients see the truthful capability flag.
manageScim stays false: management is via the /api endpoints, not the
web vault's enterprise UI.
- docs/scim/README.md: operator setup, token generation/rotation, the
full Entra ID enterprise-app walkthrough with attribute mappings, and
the documented deviations (DELETE=revoke, no role sync, no post-create
rename sync).
- docs/scim/design.md: architecture and security model with four mermaid
diagrams (provision/deprovision sequence, membership state machine
including the -128/-127/-126 revocation offsets, the guard decision
flow with uniform-401 sinks, and the module map), the sha256-vs-argon2
rationale, and the E2EE constraint analysis explaining why confirm
cannot be server-side.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Phase 3 of the SCIM v2 implementation:
- Groups CRUD at /scim/v2/<org>/Groups: filters on displayName/externalId,
pagination, excludedAttributes=members honored on list (Entra sends it
on every sync cycle).
- PATCH implements true add/remove diffs on groups_users, including
Entra's filter-path removal form members[value eq "id"] used by
provisioning apps created without the aadOptscim062020 flag. Duplicate
adds are idempotent; removals of absent members are no-ops (Entra
retries removals).
- PUT and PATCH-replace do full member-set replacement, the one place
ldap_import's replace semantics are actually correct.
- Member values resolve to memberships of the token's org only; unknown
or cross-org ids are rejected before any write, so a failed create
leaves nothing behind. Users must be provisioned before group
assignment (GroupUser keys on MembershipId).
- Group DELETE is a real delete: groups carry no E2EE state, unlike
memberships.
- Gated on ORG_GROUPS_ENABLED with a loud SCIM 501, not ldap_import's
silent skip. Audit events use the 1400-range group event types.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Phase 2 of the SCIM v2 implementation:
- PUT /scim/v2/<org>/Users/<id> replaces the attributes SCIM owns
(externalId, active) and returns the true state for everything else.
userName/email and role deliberately do not sync: email is the login
identity, user.name is global to the person across orgs, and roles
cannot round-trip through Vaultwarden's membership types.
- PATCH now applies externalId changes (path and path-less forms) with
per-org uniqueness enforced, logged as OrganizationUserUpdated.
- Attributes Entra maps by default but Vaultwarden does not sync
(displayName, name.*, emails, title, roles, preferredLanguage, the
enterprise extension) are accepted and ignored instead of rejected: a
400 would surface as an Entra sync error on every directory rename.
Genuinely unknown paths still fail with invalidPath.
- Pagination edges covered: middle pages, count=0 (total only), and
startIndex past the end.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Phase 1 of the SCIM v2 implementation - the deprovisioning core:
- GET /scim/v2/<org>/Users with eq filters on userName/externalId (filter
values are matched against the lowercased stored email, avoiding the
Entra create-409-quarantine loop) plus startIndex/count pagination.
- POST creates or links the user and invites: shell account for unknown
emails, membership at Invited (Accepted when mail is off and the account
already has credentials), invite mail with rollback on failure. Honors
active:false on create by storing the membership pre-revoked.
- PATCH handles Entra's active toggle in all observed shapes: op casing,
string booleans, and the path-less value-object form.
- PATCH active:false and DELETE both map to revoke, never delete: the row
and akey survive so restore is lossless. Documented RFC deviation.
- Last-confirmed-owner protection returns a SCIM 409 mutability error.
- Restore re-runs the org policy check like restore_member_impl.
- Unknown member ids and other orgs' member ids return identical 404s.
- Audit events (invited/revoked/restored) recorded with a synthetic SCIM
actor, following the admin panel's ACTING_ADMIN_USER precedent.
- ScimJson data guard accepts application/scim+json bodies under the scim
size limit; 413 catcher added.
Tests: 24 new (unit: filter grammar, PatchOp quirks, status-offset table
with the -126/-128 revocation encoding, regression canary on from_i32;
integration: full lifecycle, duplicate 409s, last-owner 409, enumeration
shape, born-disabled create).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Groundwork for SCIM v2 provisioning (RFC 7643/7644), targeting Entra ID:
- New scim_api_key table (sqlite/mysql/postgresql migrations) storing a
sha256 digest of a per-organization static bearer secret. An active row
doubles as per-org SCIM enablement; org deletion cleans it up.
- ScimToken request guard modeled on PublicToken: pre-auth rate limiting,
scim_enabled gate, token format scim_v1.<org>.<secret>, token-org vs
path-org check before any DB work, constant-time digest compare with a
dummy compare on miss. All failure causes log server-side and surface as
one uniform SCIM-enveloped 401.
- SCIM error envelope + catchers so every response under /scim (400/401/
404/429/500) is application/scim+json.
- Discovery endpoints (ServiceProviderConfig, ResourceTypes, Schemas).
- Admin-session management endpoints under /api: generate/rotate (plaintext
shown once), delete, and status; guarded by AdminHeaders plus password or
OTP re-auth, mirroring rotate_api_key.
- Config: scim_enabled (default off) and SCIM rate limiter settings.
- Test infrastructure: hermetic pre-main env bootstrap (test-support crate,
keeps CONFIG away from the developer's .env and data), Rocket local-client
harness on temp sqlite, authz matrix asserting byte-identical 401 bodies,
rate limiter drain test.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Misc updates and fixes
- Updated Rust to v1.96.1
- Updated all the crates
- Updated GitHub Actions
- Updated the web-vault to v2026.6.2
- Updated Alpine to v3.24
- Fixed several clippy lints
- The `send` UUID wrappers didn't need the special namespace anymore since an updated crate, so removed this extra mod.
Signed-off-by: BlackDex <black.dex@gmail.com>
* Update MSRV to v1.94.1
Signed-off-by: BlackDex <black.dex@gmail.com>
---------
Signed-off-by: BlackDex <black.dex@gmail.com>
* ci: remove dead BASE_TAGS reference in release bake step
steps.determine-version doesn't exist in docker-build; the expression
resolves to empty string. The HCL default (testing) would have
applied, but it's moot - the bake uses push-by-digest=true so tags are
only set in merge-manifests. Dead code.
* ci: replace unsecured curl hadolint download with an official action
hadolint/hadolint-action uses a Docker-based runner with hadolint
pre-bundled in ghcr.io/hadolint/hadolint:v2.14.0-debian,so no binary
downloaded at runtime. Pinning the action to a commit SHA covers the
Dockerfile that specifies the image version, closing the supply-chain
gap from the previous unverified curl | sudo install.
Split {debian,alpine}: the action takes a single dockerfile argument,
so debian and alpine are linted separately.
* ci: pin ubuntu-latest to ubuntu-24.04 in merge-manifests and zizmor
ubuntu-latest is a moving target that can silently change the runner OS
on the next GitHub-side update. All other jobs in this repo already pin
to ubuntu-24.04; this makes merge-manifests and zizmor consistent.
* ci: return BASE_TAGS - it's needed for bake step
The /api/sync response serialized a Send hide_email field directly from
Option<bool>, so a NULL value in the sends table (the column is
Nullable<Bool> with no default) produced "hideEmail": null.
The Bitwarden Android client deserializes SyncResponseJson.Send.hideEmail
as a non-null Kotlin Boolean and aborts the entire sync with a
JsonDecodingException when it encounters null. Web, desktop and CLI
clients coerce null to false, so only accounts with at least one Send
are affected and only on Android.
Default None to false at the serialization boundary, matching the
official Bitwarden server where hideEmail is non-nullable. This needs no
database migration and fixes both legacy NULL rows and any future NULLs.
The hide_email field stays Option<bool> internally.
- Updated Rust to v1.96.0
- Updated all the crates, and adjusted code where needed
- Fixed some nightly reported clippy lints
- Updated all the GitHub actions
Signed-off-by: BlackDex <black.dex@gmail.com>
* Update to Rust 2024 Edition
Updated to the Rust 2024 Edition and added and fixed several lint checks.
This is a large change which, because of the extra lints, added some possible fixes for issues.
Signed-off-by: BlackDex <black.dex@gmail.com>
* Reorder and merge imports
Signed-off-by: BlackDex <black.dex@gmail.com>
* Remove "db_run!" macro calls where possible
Signed-off-by: BlackDex <black.dex@gmail.com>
---------
Signed-off-by: BlackDex <black.dex@gmail.com>
* Update crates and gha
Updated all the crates
Updated GitHub Actions
Signed-off-by: BlackDex <black.dex@gmail.com>
* Fix restoring revoked user
A new endpoint is used to restore a revoked user.
This commit fixes that.
Fixes#7224
Signed-off-by: BlackDex <black.dex@gmail.com>
* Update datatables
Signed-off-by: BlackDex <black.dex@gmail.com>
---------
Signed-off-by: BlackDex <black.dex@gmail.com>
* Panic on unrecognised DATABASE_URL instead of silent SQLite fallback
Previously, any DATABASE_URL that did not match the mysql: or postgresql:
prefix was silently treated as a SQLite file path. This caused data loss
in containerised environments when the URL was misconfigured (typos,
quoting issues), as vaultwarden would create an ephemeral SQLite database
that was wiped on restart.
Now, an explicit sqlite:// prefix is supported and used as the default.
Bare paths without a recognised scheme are still accepted for backwards
compatibility, but only if the database file already exists. If not, the
process panics with a clear error message.
Relates to #2835, #1910, #860.
* Use err!() instead of panic!() for unrecognised DATABASE_URL
Follow the established codebase convention where configuration
validation errors use err!() to propagate gracefully, rather than
panic!(). The error propagates through from_config() and is caught
by create_db_pool() which logs and calls exit(1).
* Use 'scheme' instead of 'prefix' in DATABASE_URL messages
Per review feedback, 'scheme' is the more accurate term for the
sqlite:// portion of the URL.
* deps: upgrade the reqwest stack to 0.13
The reqwest 0.13 rustls feature selects the aws-lc provider. Use
rustls-no-provider instead, add rustls 0.23 with the ring provider, and
install that provider at process startup. This keeps Vaultwarden on the
existing ring crypto provider while giving reqwest, OpenDAL and lettre a
process-wide rustls provider.
Disable openidconnect default features and provide a small
AsyncHttpClient wrapper around Vaultwarden's shared reqwest client
builder. This preserves custom DNS, request blocking, timeouts and the
no-redirect OIDC behavior without openidconnect enabling its own reqwest
stack.
Upgrade yubico_ng to 0.15.0 and OpenDAL to 0.56.0. OpenDAL 0.56 also
moves S3 signing to reqsign 3, so switch the optional S3 dependencies
from reqsign/anyhow to reqsign-core and reqsign-aws-v4 and adapt the AWS
SDK credential bridge to the new ProvideCredential API.
Adjust the local OpenDAL call sites for the 0.56 API: use the FS_SCHEME
constant for filesystem checks and replace deprecated remove_all() with
delete_with(...).recursive(true) for Send file cleanup.
* storage: add OpenDAL S3 URI options
OpenDAL S3 storage accepts bucket and root path data today, but
serverless deployments also need URI query parameters to describe provider
behavior in one DATA_FOLDER value.
Update OpenDAL to 0.56.0 and build S3 operators with
S3Config::from_uri(). Keep Vaultwarden's AWS SDK credential chain by
installing a reqsign provider when the URI does not explicitly request
OpenDAL-native credential handling.
Move path handling and operator construction into storage.rs so S3-specific
parsing, credential setup, and URI path manipulation stay out of
configuration handling. Local filesystem behavior is unchanged, and S3
child paths are derived before query strings.
- Update crates including fixing a regression of Diesel
- Update web-vault to v2026.4.1
- Adjusted the README to address the secure context and needing HTTPS
Fixes#7132Closes#7137
Signed-off-by: BlackDex <black.dex@gmail.com>
Keeping the default behaviour of SQLite being built statically,
so as not to break anyone's workflow, but allowing for downstream
packagers to link dynamically against SQLite (where it's fine because
that's the point of package managers).
Note that SQLite is still *not* enabled by default, thanks to the `?` operator.
Co-authored-by: Daniel García <dani-garcia@users.noreply.github.com>
`Cipher::to_json()` returns `Result<Value, Error>` but its match arm for
unknown `atype` values called `panic!("Wrong type")` instead of
propagating an error. This means if a cipher with an invalid/unknown type
ends up in the database (via direct DB edits, data migration issues, or
future type additions in the upstream Bitwarden protocol), the entire
server process would crash on the next sync request.
Replace the `panic!` with `err!()` so callers receive a proper `Err` and
can handle or log it gracefully without taking down the server.
Co-authored-by: easonysliu <easonysliu@tencent.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Daniel García <dani-garcia@users.noreply.github.com>
The collection update endpoints (post_collections_update and
post_collections_admin) call .unwrap() on cipher.organization_uuid
in four places. If a user-owned cipher without an organization
somehow reaches these code paths, the server would panic.
Extract the organization UUID early with a descriptive error message
instead of relying on .unwrap(), preventing potential panics and
providing a clear API error response.
Co-authored-by: Daniel García <dani-garcia@users.noreply.github.com>
* Add archiving
* Update Diesel macros and remove unnecessary SUPPORTED_FEATURE_FLAG
* Add IF EXISTS to down.sql migratinos
* Rename migration folders, separate logic based on PR threads
* Ensure SSO token is only usable on the same client
This commit adds an extra check via cookies to ensure the same browser/client is used to request and provide the SSO token.
Previously it would be able to provide a custom link which attackers could use to steal data.
While an attacker would still need the Master Password to be able to decrypt or execute specific actions, they were able to fetch encrypted data.
Solved with some help of Claude Code.
Signed-off-by: BlackDex <black.dex@gmail.com>
* Check email-verified on SSO login/create
This commit prevents possible account takeover via SSO which doesn't check/validate or provide validated status of the email.
It was checked at other locations, but was skipped here.
Signed-off-by: BlackDex <black.dex@gmail.com>
* Prevent data disclosure via SSO endpoints
This commit prevents some data disclosure and user enumeration by only returning the fake SSO identifier.
Since we do not check the identifier anywhere useful, returning the fake one is just fine.
During an invite to an org, that link contains the correct UUID and will be used for the master password requirements.
For anything else, server admins should set the `SSO_MASTER_PASSWORD_POLICY` env variable.
Signed-off-by: BlackDex <black.dex@gmail.com>
* Adjust admin layout to fix issues when SSO is enabled
Signed-off-by: BlackDex <black.dex@gmail.com>
---------
Signed-off-by: BlackDex <black.dex@gmail.com>
IPv4 addresses can also be in decimal or hex formats.
These were not checked during the Global IP check, and could bypass it.
We now convert everything to the right format before running this check and it will catch these formats.
Also updated the `is_global()` function to match Rust's still unstable version.
And updated the Image Magic checks to be more precise and filter out any possible broken or invalid formats.
While at it, also added several checks to ensure these special formatted IPv4 addresses are still blocked and punycode domains are also correctly resolved.
Signed-off-by: BlackDex <black.dex@gmail.com>
Quote from the lint description:
"More flexibility, better memory optimization, and more idiomatic Rust code.
&Option<T> in a function signature breaks encapsulation because the caller must own T and move it into an Option to call with it. When returned, the owner must internally store it as Option<T> in order to return it. At a lower level, &Option<T> points to memory with the presence bit flag plus the T value, whereas Option<&T> is usually optimized to a single pointer, so it may be more optimal."
Quote from lint description:
"Using a smaller unit for a duration that is evenly divisible by a larger unit reduces readability. Readers have to mentally convert values, which can be error-prone and makes the code less clear."
David Croft
Mathijs van Veluw
Denis Pisarev
pilotstew
Timshel
kvdb
user71424q
Daniel
mfw78
Stefan Melmuk
Chase Douglas
Eldred Habert
eason
Johny Jiménez
Daniel García
Shocker
Matt Aaron