Add six new opt-in configuration flags that enhance the SSO experience:
SSO_AUTO_REDIRECT (requires SSO_ONLY=true):
Automatically redirect users to the SSO provider login page instead of
showing the Vaultwarden login form. Uses PKCE with S256 challenge.
SSO_IDENTIFIER:
Custom organization identifier for SSO flows.
SSO_LOGOUT_REDIRECT (requires SSO_AUTO_REDIRECT=true):
On logout, redirect to the SSO provider's OIDC end_session endpoint.
Uses localStorage to detect logout vs fresh visit.
SSO_KEY_CONNECTOR (requires SSO_ONLY=true, SSO_KEY_CONNECTOR_SECRET):
Built-in Key Connector — SSO users never need a master password.
All stored keys are encrypted at rest with AES-256-GCM using a key
derived from SSO_KEY_CONNECTOR_SECRET via HKDF-SHA256 with per-key
salts. File format: salt(32) || nonce(12) || ciphertext || tag(16).
The secret only exists as an env var, never on disk.
SSO_KEY_CONNECTOR_SECRET:
Required 256-bit hex secret for encrypting Key Connector keys at rest.
Can be sourced from external KMS (AWS KMS, HashiCorp Vault) via
deployment tooling for stronger security guarantees.
SSO_AUTO_ENROLL:
Auto-create organization and enroll SSO users on first login.
Startup validation ensures SSO_KEY_CONNECTOR_SECRET is set and valid
(64 hex chars) when SSO_KEY_CONNECTOR is enabled.
Addresses: #2583 (Key Connector), #6191 (auto-redirect), #6316 (SSO_ONLY flows)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Update Rust to v1.93.1
- Updated all the crates
Adjust changes needed for the newer `rand` crate
- Updated GitHub Actions
Signed-off-by: BlackDex <black.dex@gmail.com>
Fix an issue where it was possible for users who were not eligible to access all org ciphers to be able to download and extract the encrypted contents.
Only Managers with full access and Admins and Owners should be able to access this endpoint.
This change will block and prevent access for other users.
Signed-off-by: BlackDex <black.dex@gmail.com>
The term "seems to" is used too loosely in many of the tooltips, but in
these 2 instances it is wrong wording.
An update is either available or not. If there is no update, one could
argue that "seems to" is valid, since the Internet could be down to
check for a new version. But in this situation the update is availble.
It is impossible that an update seems to be available.
- Updated all crates
- Updated web-vault to v2025.12.2
- Updated all JavaScript files
- Updated all GitHub Action Workflows
Also added the `concurrency` option to all workflows.
Signed-off-by: BlackDex <black.dex@gmail.com>
When using the latest Bitwarden CLI and logging in using the API Key, it expects some extra fields, same as for normal login.
This PR adds those fields and login is possible again via API Key.
Fixes#6709
Signed-off-by: BlackDex <black.dex@gmail.com>
* Fix posting cipher with readonly collections
This fix will check if a collection is writeable for the user, and if not error out early instead of creating the cipher first and leaving it.
It will also save some database transactions.
Fixes#6562
Signed-off-by: BlackDex <black.dex@gmail.com>
* Adjust code to delete on error
Signed-off-by: BlackDex <black.dex@gmail.com>
---------
Signed-off-by: BlackDex <black.dex@gmail.com>
- zstd support has been added in Docker v23
- Debian Bookworm/Bullseye ships with Docker v20.10
- Revert for now to maintain compatibility with older releases
Brendan Kite
Mathijs van Veluw
Daniel
Daniel García
phoeagon
Timshel
pasarenicu
Chris Kruger
DerPlayer2001
Ken Watanabe
Stefan Melmuk
proofofcopilot
Helmut K. C. Tessarek