SSO with Authentik - works, but how to get rid of email input?

Help
1

Hi everyone,

I just started using vaultwarden as a docker container behind a caddy reverse proxy with Authentik for SSO. All these services run on my server in my home network and my dns server forwards to the local IP.

I used this howto Integrate with Vaultwarden | authentik and it works!

My problem: I would like to avoid typing in my email address two times.

My current flow with this setup is:

  1. Open Vaultwarden website
  2. Enter email address, click “Use Single sign on”
  3. Redirect to Authentik, log in (or pass through if session exists)
  4. Back to web vault, enter master password
  5. Vault unlocked

current_situation
current_situation1921×413 142 KB

My desired flow would be:

  1. Open Vaultwarden website
  2. Direct redirect to Authentik
  3. Back to web vault, enter master password
  4. Vault unlocked

desired_situation
desired_situation1268×412 126 KB

Vaultwarden is configured as follows with my .env file:

DOMAIN=https://vw.subdomain.mydomain.de
SSO_ENABLED=true
SSO_AUTHORITY=https://authentik.subdomain.mydomain.de/application/o/vaultwarden/
SSO_CLIENT_ID=**redacted**
SSO_CLIENT_SECRET=**redacted**
SSO_SCOPES=email profile offline_access
SSO_ALLOW_UNKNOWN_EMAIL_VERIFICATION=false
SSO_CLIENT_CACHE_EXPIRATION=0
SSO_ONLY=true
SSO_SIGNUPS_MATCH_EMAIL=true

SIGNUPS_ALLOWED=false
INVITATIONS_ALLOWED=false

ADMIN_TOKEN=**redacted**

SMTP_ENABLED=false

WEB_VAULT_ENABLED=true
LOG_LEVEL=info
EXTENDED_LOGGING=true
HTTP_REQUEST_BLOCK_NON_GLOBAL_IPS=false

Side note: You can actually put in a different email address than the one you use in the second step (authentik), which will lead to you being authenticated over authentik as userA and displayed inside vaultwarden as userB

I would appreciate any advice.

kind regards,
Johannes

2

I don’t have a solution, but I would like the exact same thing. Hopefully someone on the team responds to this.

3

As explained in issue #6191 entering the email is required for the 2FA remember token to work in case you setup a second factor. If that is not important to you, you can also bookmark your URL with a fake identifier like /#/sso?identifier=whatever to skip entering a mail address (which is also recommended by Bitwarden):

image
image935×244 27.2 KB

1 Like