Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vaultwarden commit introduces SSO using OpenID Connect

github.com

Post reply on HN
Print view View original

71–80 of 100 posts

Re: Vaultwarden commit introduces SSO using OpenID Connect

#71

Post by maxwellg »

tracker1 wrote: post #39
stronglikedan wrote: post #31

Earlier quoted context omitted.

> That means you either use Google or Microsoft, nothing else. My fairly large (>20k) company uses Okta. That's just to say, be wary of issuing ultimatums.

I recall a happy/fun environment using Microsoft Entra (Azure AD) SSO, in order to sign into Okta SSO, in order to access Azure environment(s), among other apps. SSO Inception.

SSO chaining is super common in large corporate environments. Different orgs might have their own SSO IDP, acquisitions often bring their own, etc. Once a provider is in use, it is quite difficult to tear out later while keeping everyone in their proper accounts in all the apps that tie in. Many apps are really bad at SSO migrations, or deduplicating multiple SSO identities to a single user account.

Re: Vaultwarden commit introduces SSO using OpenID Connect

#72

Post by maxwellg »

currysausage wrote: post #52
crimsonnoodle58 wrote: post #22

Earlier quoted context omitted.

If you're running on kubernetes, a simple network policy and blocking the container from using DNS will stop any compromised image from performing a data exfill. I do this for most containers. If the container must have web access in some form, setup a squid proxy and only whitelist safe and trusted domains that can't be exfilled to.

The web frontend could still send secrets to third parties.

For extra security, an intermediary can set Content Security Policy (CSP) headers that instruct browsers to only connect to certain domains. CSP headers aren't a total solution, but they're a good tool in the toolkit for redundancy against exfiltration.

https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/...

Re: Vaultwarden commit introduces SSO using OpenID Connect

#73

Post by forty »

andix wrote: post #6

A password manager is the one thing I'm very skeptical to use SSO for.

Well, without SSO, we (people making password managers for business) are in a weird position where we tell people "you won't have to remember passwords" then the first thing we do is to ask to remember a new password (the master password).

SSO also has the benefit that admin can impersonate another account, which is generally a good thing in a corporate environment (think of employee turn over, bus factor, etc)

Re: Vaultwarden commit introduces SSO using OpenID Connect

#76

Post by gallexme »

arjvik wrote: post #57
kuschku wrote: post #42

Earlier quoted context omitted.

SSO is really important in the "few tools, many users" case, but just as important in the "many tools, few users" case. I'm self hosting dozens of tools, and without SSO I'd have to set up username, password, TOTP and WebAuthn for each and every one of them, my 2FA app would be 90% my own services. With SSO though, it's much simpler. I can just run an OIDC server and log into all my self-hosted services once, and I c…

What's your (OSS?) OIDC server of choice? Authelia? Authentik? Keycloak? (These are the three I see a lot about.) Something else?

Mine is zitadel

Re: Vaultwarden commit introduces SSO using OpenID Connect

#77

Post by seized »

preisschild wrote: post #41
warkdarrior wrote: post #35

Earlier quoted context omitted.

I've been self-hosting Bitwarden (and giving them money) for a few years now, it is really easy with Docker and a reverse proxy. What kind of challenges did you encounter with Bitwarden?

Last time i checked you needed a MS SQL db...

There is a new Unified one that can use SQLite and other options. I have been using that one for a year or more

Re: Vaultwarden commit introduces SSO using OpenID Connect

#79

Post by caymanjim »

crimsonnoodle58 wrote: post #22
ronnier wrote: post #18

I love this product have used it for a long time now but more recently started getting worried about security. I hope the maintainers are doing their due diligence around securing their docker hub account (many of us run VW in docker) and are careful about libraries the project depends on. Some questionable coding practices were made that I'm not sure I agree with (calling a 3rd party sites in some scenarios). As mor…

If you're running on kubernetes, a simple network policy and blocking the container from using DNS will stop any compromised image from performing a data exfill. I do this for most containers. If the container must have web access in some form, setup a squid proxy and only whitelist safe and trusted domains that can't be exfilled to.

Why do you think that DNS is required? Anything malicious could (and likely should) hard-code an IP.

Re: Vaultwarden commit introduces SSO using OpenID Connect

#80

Post by prmoustache »

DoctorOW wrote: post #26

Most of the comments seem to confirm (all but one at time of writing) that this feature is more intended for corporate/business environments. Does anyone know if Vaultwarden has commercial users? By no means am I arguing against the inclusion of this feature, I'm just curious. Everywhere I've worked that was big enough to use SSO was also wary of selfhosting FOSS tools. I should clarify I don't consider myself workin…

My company just started hosting an instance for its employees 2 months ago.
Post reply on HN