Implement Vault Timeout Policy

bokkabonga · January 18, 2022, 8:07am

Hey everyone,

would it be possible to implement the Vault-Timeout Policy? Or would we face the same potential problem as with this Feature Request here?

BlackDex · January 18, 2022, 8:52am

That is as far as i know within the same policy.

bokkabonga · January 18, 2022, 9:04am

Where can i read up on this? I would love to dive a bit deeper into this

BlackDex · January 18, 2022, 9:32am

I would start here: web/bitwarden_license at master · bitwarden/web · GitHub

Though, there could be someway around this. We can’t use the web-vault version with those policies to be able to easily editable by managers, admins or owners. It maybe is possible to still implement it within the backend-server and allow some way of editing it via the /admin interface maybe, but, i’m not sure if that is possible, not looked into it that deep my self.

ob1 · January 18, 2022, 4:12pm

It is possible to enable it via SQL but single organisation policy needs to be enabled as well.
This is the command I used in MySQL:

INSERT INTO org_policies (uuid, org_uuid, atype, enabled, data) VALUES ('random-uuid-here', 'org-uuid-here', '9', '1', '{"minutes":120}');

Urdar · November 13, 2023, 9:30am

Hi, I also needed to configure an organization policy, could you please tell me what the atype parameter in your SQL query example is responsible for?

stefan0xC · November 13, 2023, 9:46am

The atype corresponds to the OrgPolicyType:

github.com

dani-garcia/vaultwarden/blob/f863ffb89a0f2a0a682c67110af32c731b5b9fcb/src/db/models/org_policy.rs#L36


      
          pub enum OrgPolicyType {
              TwoFactorAuthentication = 0,
              MasterPassword = 1,
              PasswordGenerator = 2,
              SingleOrg = 3,
              // RequireSso = 4, // Not supported
              PersonalOwnership = 5,
              DisableSend = 6,
              SendOptions = 7,
              ResetPassword = 8,
              // MaximumVaultTimeout = 9, // Not supported (Not AGPLv3 Licensed)
              // DisablePersonalVaultExport = 10, // Not supported (Not AGPLv3 Licensed)
          }
          
          // https://github.com/bitwarden/server/blob/5cbdee137921a19b1f722920f0fa3cd45af2ef0f/src/Core/Models/Data/Organizations/Policies/SendOptionsPolicyData.cs
          #[derive(Deserialize)]
          #[allow(non_snake_case)]
          pub struct SendOptionsPolicyData {
              pub DisableHideEmail: bool,
          }

bitwarden/server/blob/627f4ffa39027be103dc74d575fd76477c22ec4f/src/Core/Enums/PolicyType.cs

namespace Bit.Core.Enums;

public enum PolicyType : byte
{
    TwoFactorAuthentication = 0,
    MasterPassword = 1,
    PasswordGenerator = 2,
    SingleOrg = 3,
    RequireSso = 4,
    PersonalOwnership = 5,
    DisableSend = 6,
    SendOptions = 7,
    ResetPassword = 8,
    MaximumVaultTimeout = 9,
    DisablePersonalVaultExport = 10,
    ActivateAutofill = 11,
}

Urdar · November 13, 2023, 9:59am

Thanks for the help, then the next question is if this functionality does not work, but a colleague above indicated that his query worked, is there no information if it will work for sure?

And is it possible to configure a storage timeout action with the exit parameter?

jan1 · March 28, 2024, 6:59pm

Hi,
what should I put in the “data” field of the MaximumVaultTimeout = 9 if I do not want a time based lockout but for example these options:

INSERT INTO org_policies (uuid, org_uuid, atype, enabled, data) VALUES ('random-uuid-here', 'org-uuid-here', '9', '1', '{"?????":?????}');

Screenshot 2024-03-28 195027

On system idle
On system sleep
On system lock
On restart

Topic		Replies	Views
Disable Personal Vault Export Policy Feature Requests	2	1474	January 18, 2022
Manage client settings Help	1	251	March 22, 2023
Disabled personal vault + ask to save Help	5	584	January 3, 2023
Emergency Access Feature Requests	3	1404	December 15, 2021
Automate Access Control	1	462	November 2, 2021

Implement Vault Timeout Policy

Related Topics