Organisation invitations via BWDC lead to faulty user profiles #4114
Labels
bug
Something isn't working
Comments
|
Can confirm this is an issue. I've noticed also that users show up as joined the organization, even though in reality they are still invited. Incase it helps for tracking down the issue I've noticed the following:
|
BlackDex
added
the
troubleshooting
|
Can confirm BWDC is causing faulty issues here as well. Inside the vaultwarden Admin page it'll show they aren't part of the Organization. But on the vault itself in the Organization, they will show up as part of the Organization. |
|
Which version of BWDC are you all using? I can create accounts, login, confirm access and see the org ciphers. I also tested with SMTP/Mail disabled. So, i'm a bit confused regarding where this is coming from. Which type of Directory are you all using? |
BWDC (CLI) version: 2023.10.0
Here is a snippet from our BWDC config (some details censored):
SMTP is enabled in our scenario.
I will attempt to reproduce the bug and provide steps here in near future.
FreeIPA |
Version 2022.11.0 Windows Desktop
Snippet of my settings:
SMTP is enabled in my case. |
|
@ louisfgr i would suggest to update to the 2023 version of the Directory Connector, both Desktop and CLI, See https://github.com/bitwarden/directory-connector/releases |
|
I am able to reproduce the inconsistent user state event with the 2023.10 variant. I checked with some affected users that their org invite was still working, which it was, but the user was not able to fully join the org. Removing the user's access to the org and re-inviting him manually worked though. |
|
Invites expire after x amount of time. I would need to good step-by-step way to reproduce this, else i'm not really able to tackle this at all. |
|
At least in our deployment the problem presented itself with this string of actions:
|
Can confirm this is similar steps to what we've determined on our end as well. |
|
I looked at the log during synchronization but didn't notice anything unusual. Maybe someone else notices something. Those were my steps:
I also upgraded my BWDC to 2023.10.0 for this test. Log |
I am seeing in the database table If you do revoke using the web vault, it'll update their If you do another revoke, after the user was moved to the invited tab from the first revoke, |
|
Thx for all the extra information. Hopefully i can reproduce this in some way. All other information is still welcome. I have not yet checked running it multiple times, but from memory, those didn't caused issues before. |
Multiple times may potentially be required. I've noticed in some testing that the first round of invites all show up fine in the Web Vault. But upon another round of invites (usually after clearing BWDC cache) does it start to show issues. |
|
I have been running into the same issue here using the Bitwarden Directory Connector. One of my sync settings was "Overwrite existing organization users based on current sync settings" - with this turned off, the issue doesn't appear to present. |
Looking at the configs shared above, others also have that set to false. |
|
Confirming that setting overwrite to off, The following was performed:
I'm thinking signs are pointing to something to do with the cache clearing process. |
|
I just had some time, and, clearing the cache, and run it again indeed triggers it for me to! Ill see what is going on here. |
|
Well, that was an easy fix on a stupid bug (caused by my self). |
BlackDex
added
bug
BlackDex
added a commit
to BlackDex/vaultwarden
that referenced
this issue
Dec 6, 2023
Using the BWDC with a cleared cache caused invited users to be converted to accepted users. The problem was a wrong check for the `restore` function. Fixes dani-garcia#4114
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Subject of the issue
Users who are invited to an organisation via BWDC are in a strange state between added and invited.
Your environment (Generated via diagnostics page)
Config (Generated via diagnostics page)
Show Running Config
Environment settings which are overridden:
{ "_duo_akey": null, "_enable_duo": false, "_enable_email_2fa": true, "_enable_smtp": true, "_enable_yubico": false, "_icon_service_csp": "", "_icon_service_url": "", "_ip_header_enabled": true, "_smtp_img_src": "cid:", "admin_ratelimit_max_burst": 3, "admin_ratelimit_seconds": 300, "admin_session_lifetime": 20, "admin_token": "***", "allowed_iframe_ancestors": "", "attachments_folder": "data/attachments", "auth_request_purge_schedule": "30 * * * * *", "authenticator_disable_time_drift": false, "data_folder": "data", "database_conn_init": "", "database_max_conns": 10, "database_timeout": 30, "database_url": "***************", "db_connection_retries": 15, "disable_2fa_remember": false, "disable_admin_token": false, "disable_icon_download": false, "domain": "*****://**************************", "domain_origin": "*****://**************************", "domain_path": "", "domain_set": true, "duo_host": null, "duo_ikey": null, "duo_skey": null, "email_attempts_limit": 3, "email_change_allowed": true, "email_expiration_time": 600, "email_token_size": 6, "emergency_access_allowed": true, "emergency_notification_reminder_schedule": "0 3 * * * *", "emergency_request_timeout_schedule": "0 7 * * * *", "enable_db_wal": true, "event_cleanup_schedule": "0 10 0 * * *", "events_days_retain": 60, "extended_logging": true, "helo_name": null, "hibp_api_key": "***", "icon_blacklist_non_global_ips": false, "icon_blacklist_regex": null, "icon_cache_folder": "data/icon_cache", "icon_cache_negttl": 259200, "icon_cache_ttl": 2592000, "icon_download_timeout": 10, "icon_redirect_code": 302, "icon_service": "internal", "incomplete_2fa_schedule": "30 * * * * *", "incomplete_2fa_time_limit": 3, "invitation_expiration_hours": 336, "invitation_org_name": "BitwardenTest", "invitations_allowed": true, "ip_header": "X-Real-IP", "job_poll_interval_ms": 30000, "log_file": "./data/vaultwarden.log", "log_level": "info", "log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f", "login_ratelimit_max_burst": 10, "login_ratelimit_seconds": 60, "org_attachment_limit": null, "org_creation_users": "******************", "org_events_enabled": true, "org_groups_enabled": true, "password_hints_allowed": true, "password_iterations": 100000, "push_enabled": false, "push_installation_id": "***", "push_installation_key": "***", "push_relay_uri": "https://push.bitwarden.com", "reload_templates": false, "require_device_email": false, "rsa_key_filename": "data/rsa_key", "send_purge_schedule": "0 5 * * * *", "sendmail_command": null, "sends_allowed": true, "sends_folder": "data/sends", "show_password_hint": false, "signups_allowed": false, "signups_domains_whitelist": "************", "signups_verify": true, "signups_verify_resend_limit": 6, "signups_verify_resend_time": 3600, "smtp_accept_invalid_certs": false, "smtp_accept_invalid_hostnames": false, "smtp_auth_mechanism": null, "smtp_debug": false, "smtp_embed_images": true, "smtp_explicit_tls": null, "smtp_from": "**************************", "smtp_from_name": "BitwardenTest", "smtp_host": "**************", "smtp_password": null, "smtp_port": 25, "smtp_security": "off", "smtp_ssl": null, "smtp_timeout": 15, "smtp_username": null, "templates_folder": "data/templates", "tmp_folder": "data/tmp", "trash_auto_delete_days": 14, "trash_purge_schedule": "0 5 0 * * *", "use_sendmail": false, "use_syslog": false, "user_attachment_limit": null, "web_vault_enabled": true, "web_vault_folder": "web-vault/", "websocket_address": "0.0.0.0", "websocket_enabled": false, "websocket_port": 3012, "yubico_client_id": null, "yubico_secret_key": null, "yubico_server": null }Steps to reproduce
-> Users are now listed as Invited in the Organisation and the Admin Panel
-> Users are now listed as a full member (Invite accepted and confirmed by Admin) in the Organisation but still as invited in the Admin Panel.
If I now manually create one of those users and log in, I can not access the Organisation.
Expected behaviour
User gets an Invitation and is able to join the Organisation. The described setup works perfectly on my 1.29.2 live system.
Actual behaviour
In the Admin Panel the User is not shown as part of any Organisation.
The Organisation shows the user as a full member.
The text was updated successfully, but these errors were encountered: