SSO shouldn't require using email addresses

[michaelbeaumont]

SSO support shouldn't require referring to or using email addresses at all. Vaultwarden should support configuring a claim in the identity token to use as Vaultwarden's identifier. For example, preferred_username. Then a user is identified by and able to login using this username.

In fact, ideally, it should be possible to login without inputting anything at Vaultwarden's UI. Instead, Vaultwarden can directly redirect to the identity provider which handles authzn and Vaultwarden reads the identity from the token.

Additionally it should be noted that email and any other claims, according to the OIDC spec, should not be assumed to be unique. I.e. there can be more than one user with a given email address.

[BlackDex]

It is a requirement from Bitwarden.
https://bitwarden.com/help/configure-sso-oidc/#oidc-attributes-claims

Nothing we can do about that. All the clients assume a mail address as login.

[michaelbeaumont]

Ok, seems like there's no way around forcing the user to enter an email address since we don't control the UIs at all? 🤷

[Timshel]

If you want more details on how an email and a provider identity is linked you can check: account-and-email-handling

[michaelbeaumont]

I understood how it's linked, it's just not ideal. But we're stuck with the bit warden clients we have I guess

[dom6770]

In fact, ideally, it should be possible to login without inputting anything at Vaultwarden's UI. Instead, Vaultwarden can directly redirect to the identity provider which handles authzn and Vaultwarden reads the identity from the token.

It's even more useless, when I am logged in with [email protected] at Authentik, input [email protected] at Vaultwarden, and automatically get authorized as [email protected] as soon as I click on SSO, making the email input totally useless?

[Timshel]

If you want you can patch the web-vault with something like :

• This patch https://github.com/Timshel/oidc_web_builds/blob/master/oidc_override.patch
• And this change: Timshel/bitwarden_clients@38f34a7
• And change the error redirection here vaultwarden/vw_web_builds@b836976#diff-49231c2dc6ba962c5ca34a149ecbfac6a323ee75451cd81ef6e61a8241d70be3R564

But in the end this can be done only on the web-vault, not on all the other clients.