Skip to main content

Vaultwarden

This guide explains how to connect Vaultwarden, a Bitwarden-compatible password manager, to VaultysHub with its OpenID Connect SSO, free since version 1.35.

The master password remains necessary

SSO replaces the login, not the encryption. Upon first login, each user chooses a master password, which decrypts their vault. VaultysHub never sees it.

Prerequisites​

  • Vaultwarden 1.35 or newer, served over HTTPS: the web vault requires a secure context
  • Access to the configuration (environment variables) of Vaultwarden, and administrator access to VaultysHub

Configuration in VaultysHub​

  1. Applications → Add: name Vaultwarden, URL https://vault.example.com/
  2. Type OIDC, then:
    • Redirect URI: https://vault.example.com/identity/connect/oidc-signin
    • Allowed scope: openid, email, profile
    • Subject identifier (sub): Email address
    • Require PKCE: can be enabled
  3. Note the Client ID ([appid]) and the Client Secret, then assign the application to the relevant users.

Configuration in Vaultwarden​

DOMAIN=https://vault.example.com
SSO_ENABLED=true
SSO_AUTHORITY=https://your-vaultyshub.link.vaultys.org/api/oidc/[appid]
SSO_CLIENT_ID=[appid]
SSO_CLIENT_SECRET=<client secret>
SSO_SCOPES="email profile"
SSO_PKCE=true
# link an existing account with the same email address
SSO_SIGNUPS_MATCH_EMAIL=true
# optional: allow only SSO
# SSO_ONLY=true

SSO_AUTHORITY is the issuer of the application, as it appears in https://your-vaultyshub.link.vaultys.org/api/oidc/[appid]/.well-known/openid-configuration. The return URL is derived from DOMAIN.

VaultysHub indicates email_verified: true, otherwise Vaultwarden would refuse account creation.

Testing​

Open Vaultwarden, enter your email address, then Use single sign-on. Validate with your VaultysID, then choose your master password upon first login.

Troubleshooting​

  • No single sign-on option: SSO_ENABLED is not taken into account (version prior to 1.35), or DOMAIN is not in HTTPS.
  • Error calling VaultysHub while the network is good: if VaultysHub has a private address (internal network), Vaultwarden rejects it by default. Set HTTP_REQUEST_BLOCK_NON_GLOBAL_IPS=false.
  • "Signup blocked": the email is not marked as verified by the provider (as a last resort: SSO_ALLOW_UNKNOWN_EMAIL_VERIFICATION=true).

Resources​