So what is the point of this, if the user still needs a master password?
Can you expand the question a bit?
Vaultwarden commit introduces SSO using OpenID Connect
11–20 of 100 posts
Re: Vaultwarden commit introduces SSO using OpenID Connect
#12Been using this since it was merged. No issues so far, appreciate the work.
Re: Vaultwarden commit introduces SSO using OpenID Connect
#13A password manager is the one thing I'm very skeptical to use SSO for.
It's most useful for companies, where the goal is as much SSO as possible.
Re: Vaultwarden commit introduces SSO using OpenID Connect
#14A password manager is the one thing I'm very skeptical to use SSO for.
Separate accounts for work and private. SSO for the work account is perfectly fine for me as a dev and a big advantage for the company. But yes, don't conflate the two use cases.
Re: Vaultwarden commit introduces SSO using OpenID Connect
#15A password manager is the one thing I'm very skeptical to use SSO for.
Difference between work and personal. For personal, you’re right because there is nothing to bootstrap off of.
But in corporate it’s provisioned to a user account that exists first.
My personal bootstrap is two Yubikeys (for redundancy) that contains the password and 2FA for my Proton Pass. This plays the role of what IT would in a company with a user directory.
Re: Vaultwarden commit introduces SSO using OpenID Connect
#16I selfhost vaultwarden for my use only. Can someone please explain it like I am 5 what's the use case of this new feature? Is it to log in to vaultwarden using an OpenID?
Yep, exactly. I selfhost Vaultwarden and a bunch of other apps that my family also use. So I run Authentik, which lets them only have to worry about remembering one login, and they then have a little dashboard of all our apps, and can click to login to whatever they want. It's a pretty decent little system, and I'm happy I can now add Vaultwarden to it. The bigger your users x applications number, the bigger the bene…
Yep same for me. I actually had been holding off on Vaultwarden precisely because it didn't have sso support. A single sign on is definitely better than the having the family try to remember a different password for every app.
Re: Vaultwarden commit introduces SSO using OpenID Connect
#17A password manager is the one thing I'm very skeptical to use SSO for.
From this PR:
> A master password is still required and not controlled by the SSO
From the Bitwarden documentation[1]:
> Locking your vault will maintain vault data on the device, so unlocking your vault can be done offline. You will be required to enter your master password or PIN, or use biometrics, but won't need to use any active two-step login methods.
That really ought to quell the majority of the concerns IMO. Though for personal usage I use KeepassXC, because not having any remote authentication at all is even simpler than SSO.
[1]: https://bitwarden.com/help/vault-timeout/#vault-timeout-acti...
Re: Vaultwarden commit introduces SSO using OpenID Connect
#18I love this product have used it for a long time now but more recently started getting worried about security. I hope the maintainers are doing their due diligence around securing their docker hub account (many of us run VW in docker) and are careful about libraries the project depends on. Some questionable coding practices were made that I'm not sure I agree with (calling a 3rd party sites in some scenarios). As more of us switch to self hosting VW it will become a juicer target for bad actors. Really hoping we don't wake up one day to find out that our database was uploaded by a BA
Re: Vaultwarden commit introduces SSO using OpenID Connect
#19So what is the point of this, if the user still needs a master password?
[deleted]
Re: Vaultwarden commit introduces SSO using OpenID Connect
#20I love this product have used it for a long time now but more recently started getting worried about security. I hope the maintainers are doing their due diligence around securing their docker hub account (many of us run VW in docker) and are careful about libraries the project depends on. Some questionable coding practices were made that I'm not sure I agree with (calling a 3rd party sites in some scenarios). As mor…
I've threat modeled this myself, and as I understand it the Bitwarden client side decrypts/encrypts everything locally. So even if backend was entirely compromised, it's never getting anything without the master password, and that's never sent across by the client. Then again, there's also the web interface.