Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vaultwarden commit introduces SSO using OpenID Connect

github.com

Post reply on HN
Print view View original

1–10 of 100 posts

Re: Vaultwarden commit introduces SSO using OpenID Connect

#3

Post by the_gastropod »

cromka wrote: post #2

I selfhost vaultwarden for my use only. Can someone please explain it like I am 5 what's the use case of this new feature? Is it to log in to vaultwarden using an OpenID?

Yep, exactly. I selfhost Vaultwarden and a bunch of other apps that my family also use. So I run Authentik, which lets them only have to worry about remembering one login, and they then have a little dashboard of all our apps, and can click to login to whatever they want. It's a pretty decent little system, and I'm happy I can now add Vaultwarden to it.

The bigger your users x applications number, the bigger the benefit. It make user management easy (e.g., you only have to manage users in one place instead of N)

Re: Vaultwarden commit introduces SSO using OpenID Connect

#5

Post by simcop2387 »

the_gastropod wrote: post #3
cromka wrote: post #2

I selfhost vaultwarden for my use only. Can someone please explain it like I am 5 what's the use case of this new feature? Is it to log in to vaultwarden using an OpenID?

Yep, exactly. I selfhost Vaultwarden and a bunch of other apps that my family also use. So I run Authentik, which lets them only have to worry about remembering one login, and they then have a little dashboard of all our apps, and can click to login to whatever they want. It's a pretty decent little system, and I'm happy I can now add Vaultwarden to it. The bigger your users x applications number, the bigger the bene…

Same usecase for myself too. One of the biggest advantages for me is that it lets me setup a single and easily tested place for the users to reset passwords from too for when they inevitably forget or lose the post-it note. That, along with me using all the apps and not wanting to have to change 30 passwords for everything when something happens too.

I went a bit more complicated myself with Keycloak instead of Authentik, simply because I knew keycloak a little better but setting up SSO for all the stuff I run has definitely been worth it.

Re: Vaultwarden commit introduces SSO using OpenID Connect

#10

Post by vasco »

andix wrote: post #6

A password manager is the one thing I'm very skeptical to use SSO for.

So you're going to play IT and duplicate all the groups and all the roles manually that already are maintained and automated for on/off-boarding? And not have them be auto-offboarded when they are let go? That introduces compliance risks and imo more problems than having SSO on your password manager. Yes, keep some master password for a rainy day if you have to, but otherwise, the more "dangerous" the thing the more it should be hooked up to SSO.
Post reply on HN