Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vaultwarden commit introduces SSO using OpenID Connect

github.com

Post reply on HN
Print view View original

61–70 of 100 posts

Re: Vaultwarden commit introduces SSO using OpenID Connect

#61

Post by eloh »

arjvik wrote: post #57
kuschku wrote: post #42

Earlier quoted context omitted.

SSO is really important in the "few tools, many users" case, but just as important in the "many tools, few users" case. I'm self hosting dozens of tools, and without SSO I'd have to set up username, password, TOTP and WebAuthn for each and every one of them, my 2FA app would be 90% my own services. With SSO though, it's much simpler. I can just run an OIDC server and log into all my self-hosted services once, and I c…

What's your (OSS?) OIDC server of choice? Authelia? Authentik? Keycloak? (These are the three I see a lot about.) Something else?

Can recommend Kanidm

Re: Vaultwarden commit introduces SSO using OpenID Connect

#62

Post by mmcnl »

arjvik wrote: post #57
kuschku wrote: post #42

Earlier quoted context omitted.

SSO is really important in the "few tools, many users" case, but just as important in the "many tools, few users" case. I'm self hosting dozens of tools, and without SSO I'd have to set up username, password, TOTP and WebAuthn for each and every one of them, my 2FA app would be 90% my own services. With SSO though, it's much simpler. I can just run an OIDC server and log into all my self-hosted services once, and I c…

What's your (OSS?) OIDC server of choice? Authelia? Authentik? Keycloak? (These are the three I see a lot about.) Something else?

I've used Authelia for a few years and it's great. It does exactly what I need/want. Not more, not less. It's also never failed me.

Re: Vaultwarden commit introduces SSO using OpenID Connect

#63

Post by ffsm8 »

Disposal8433 wrote: post #29
DoctorOW wrote: post #26

Most of the comments seem to confirm (all but one at time of writing) that this feature is more intended for corporate/business environments. Does anyone know if Vaultwarden has commercial users? By no means am I arguing against the inclusion of this feature, I'm just curious. Everywhere I've worked that was big enough to use SSO was also wary of selfhosting FOSS tools. I should clarify I don't consider myself workin…

I'm a user, not an expert on all this but: SSO is indeed meant for a corporate environment, not for personal use. And from what I saw, companies would rather pay for a simple SSO provider than use any self-hosted solution. That means you either use Google or Microsoft, nothing else. LastPass is out of question due to the security issues in the past. I always advocate for Bitwarden but I'm not sure they can handle any…

Vaultwarden is not a fork though?

And also, in what world is SSO meant for enterprise?

It's Single Sign On, not having to login separately for each service is perfect for any context of any size - wherever these services only have 1 user or 100 thousand.

Re: Vaultwarden commit introduces SSO using OpenID Connect

#64

Post by mcpherrinm »

rat9988 wrote: post #56
toomuchtodo wrote: post #54

Earlier quoted context omitted.

SSO isn’t an enterprise feature, it is an access control and governance feature regardless of user population.

Who needs it except entreprises for the 99.99% usecase?

Everyone from the single-user homelab to the biggest companies should have SSO.

Re: Vaultwarden commit introduces SSO using OpenID Connect

#65

Post by aaronax »

preisschild wrote: post #41
warkdarrior wrote: post #35

Earlier quoted context omitted.

I've been self-hosting Bitwarden (and giving them money) for a few years now, it is really easy with Docker and a reverse proxy. What kind of challenges did you encounter with Bitwarden?

Last time i checked you needed a MS SQL db...

https://bitwarden.com/help/database-options/

"All Bitwarden self-hosted server deployments, except for unified, ship with an MSSQL Express image by default."

Re: Vaultwarden commit introduces SSO using OpenID Connect

#66

Post by gh02t »

arjvik wrote: post #57
kuschku wrote: post #42

Earlier quoted context omitted.

SSO is really important in the "few tools, many users" case, but just as important in the "many tools, few users" case. I'm self hosting dozens of tools, and without SSO I'd have to set up username, password, TOTP and WebAuthn for each and every one of them, my 2FA app would be 90% my own services. With SSO though, it's much simpler. I can just run an OIDC server and log into all my self-hosted services once, and I c…

What's your (OSS?) OIDC server of choice? Authelia? Authentik? Keycloak? (These are the three I see a lot about.) Something else?

For self hosting, PocketID is about as easy to set up and maintain as it gets.

Re: Vaultwarden commit introduces SSO using OpenID Connect

#67

Post by sp0ck »

eloh wrote: post #61
arjvik wrote: post #57

Earlier quoted context omitted.

What's your (OSS?) OIDC server of choice? Authelia? Authentik? Keycloak? (These are the three I see a lot about.) Something else?

Can recommend Kanidm

Kanidm made some weird decision that ruled it out in one of big organisation I try to deploy it. Separate Radius password. For telco that’s half its use cases, and there is separate random password. Whole Network engineering department was like WTF ? You can’t have single password which is one of important reasons to have SSOA.

Re: Vaultwarden commit introduces SSO using OpenID Connect

#68

Post by samgnesin »

arjvik wrote: post #57
kuschku wrote: post #42

Earlier quoted context omitted.

SSO is really important in the "few tools, many users" case, but just as important in the "many tools, few users" case. I'm self hosting dozens of tools, and without SSO I'd have to set up username, password, TOTP and WebAuthn for each and every one of them, my 2FA app would be 90% my own services. With SSO though, it's much simpler. I can just run an OIDC server and log into all my self-hosted services once, and I c…

What's your (OSS?) OIDC server of choice? Authelia? Authentik? Keycloak? (These are the three I see a lot about.) Something else?

Pocket ID[1] is what I use, and I cannot recommend it enough. It's an incredible project.

[1] https://pocket-id.org

Re: Vaultwarden commit introduces SSO using OpenID Connect

#69

Post by 9cb14c1ec0 »

ronnier wrote: post #23
surge wrote: post #20

Earlier quoted context omitted.

I've threat modeled this myself, and as I understand it the Bitwarden client side decrypts/encrypts everything locally. So even if backend was entirely compromised, it's never getting anything without the master password, and that's never sent across by the client. Then again, there's also the web interface.

Yeah if an attacker was able to insert javascript then it's possible.

Which is only possible if logging into the web client and not when using the bitwarden desktop app or browser extensions.

Re: Vaultwarden commit introduces SSO using OpenID Connect

#70

Post by thedanbob »

arjvik wrote: post #57
kuschku wrote: post #42

Earlier quoted context omitted.

SSO is really important in the "few tools, many users" case, but just as important in the "many tools, few users" case. I'm self hosting dozens of tools, and without SSO I'd have to set up username, password, TOTP and WebAuthn for each and every one of them, my 2FA app would be 90% my own services. With SSO though, it's much simpler. I can just run an OIDC server and log into all my self-hosted services once, and I c…

What's your (OSS?) OIDC server of choice? Authelia? Authentik? Keycloak? (These are the three I see a lot about.) Something else?

Adding another +1 to Pocket ID. I looked at a couple of the ones you mentioned but they looked too heavy and complex for what I wanted. Pocket ID does one thing and does it well.
Post reply on HN