[META] Feature Requests

[dani-garcia]

To avoid cluttering the issue tracker with feature requests, please comment any requests here and we'll keep a list.

When available, I've linked a related issue or comment to add context to the request.

Authentication

• Support official LDAP directory-connector. There also is a 3rd party connector.
• OAuth / SSO (Enable user SSO access using OAuth #94 and Push new docker image to support SSO #1134) (Some work is done in OIDC SSO Re: Issue #246 #1955 and OIDC SSO #2449 and Sso Support based off existing PR's #3154)
• Key-Connector support (Needs SSO) (Feature Request: key-connector for master-passwordless SSO #2583)
• Allow organizations to require 2FA for their members Organization Two-step Login #981 (Added via Two-step login organization policy enforcement - Resolves dani-garcia/bitwarden_rs#981 #1604)
• Allow authentication using a per user generated API-Key (Cannot create API Key - An unexpected error has occurred - 404 Not Found #1250) (Added via Add support for API keys #2245)
• Allow authentication using a per organization generated API-Key (Added via Implement the Organization API Key support for the new Directory Connector v2022 #3568)
• Add Emergency Access (https://bitwarden.com/help/article/emergency-access/)
• Add support for multiple account feature (Login session expired with account switching #2295) (https://bitwarden.com/help/account-switching/) (Added via Update login API code and update crates to fix CVE #2354)
• Send email on x amount invalid login attempts (https://vaultwarden.discourse.group/t/how-can-i-protect-my-vaultwarden-account-from-brute-force-attacks/3067)

Database support

• Easy migration, from SQLite to other two options
  • SQLite to MySQL - documented here: Migrating from SQLite to MySQL
  • MySQL to PostgreSQL
  • SQLite to PostgreSQL - Documented here: Migrating from SQLite to PostgreSQL

Admin page

• Allow disabling users so they can't log in, without deleting their data. (Added via Implement admin ability to enable/disable users #1247)
• 2FA support
• Hashed secret
• one-time-email login (a.k.a. Bitwarden style)
• Add option to remove 2FA devices from users (What happens if I lose my Yubikey? #431)
• Add option to set default cipher URL matching ([Feature Request] Allow pre-defining user settings and disabling some #432)
• Show more user info? (organizations and their user status in them, last connected date...)
  • Show organizations per user
  • Show the amount of attachments
  • Show the amount of chipers
  • Last login date (Added via Show last active it on admin users page #1245)
  • Multiple other items
• Vaultwarden version info and update notification?
  • Version information and updates can be found in the admin panel /admin/diagnostics
  • Notifications about several items.
  • Compare time of the server/host/container and the browser with NTP.
• Keep changed settings in the form instead of reset them on input/submit error (See Unsaved Settings get discarded #4017)

Security

• Set a configurable limit for the 2FA remember token, upstream uses 30 days (Maybe use JWT?).
• Lock accounts after X login failures, configurable. (Rate limiting is a better option, else this would give people with bad intentions the option to lock everybody out from the specific vault)
• Rate limiting of API requests
  Either by documentation using third party tools, firewall, reverse proxy etc.. Or maybe built in without to much hassel Add rate limiting to the API #723
• Rate limiting logins both admin and vault (Added via Basic ratelimit for user login (including 2FA) and admin login #2165)
• Do not run the container as root user (See Deployment vaultwarden (in cluster main) violates 'Process with UID 0' Policy #4358)

Docker images

• Debian based both ARM and AMD64
  • SQLite
  • MySQL
  • PostgreSQL
  • Multi Database
• Alpine based images (static/musl)
  • SQLite
  • MySQL (Added via Support all DB's for Alpine and Debian #2172)
  • PostgreSQL (Added via Updated dependencies and Dockerfiles #1252 and Support all DB's for Alpine and Debian #2172)

Other

• Verify database collation to prevent issues (See: Database migration to 1.17.0 fails on mariadb #1182 and Update to 1.17.0 fails - Bitwarden RS Mysql-Backend #1184)
• Batch all the bulk database operations in the same transaction (import ciphers, move selected ciphers, purge vault, etc.)
• Make email and U2F use the same domain-guessing used by attachments
• Groups support Support for groups #245 (NOTE (2022-12-15): This feature has some known issues! - Added via Group support | applied .diff #2846)
• Manager support (Added via Org managers can't create or manage collections #1136)
• Log rotation / management Question: Is the log file periodically deleted? #305
• Run Vaultwarden at suburl Run locally at suburl #241
• Audit log Audit Log #229 (Added via: Add Organizational event logging feature #2868 )
• Push notifications add support for push notifications on changes #126 (Added via feat: Implement Push Notifications sync #3304)
  • Workaround: WebSockets provide notifications in web vault and browser extensions (maybe desktop app too?)
• Implement Recover and Delete:
  • calls this endpoint /api/accounts/delete-recover with {"email":"provided@email.address"} param
  • we need to generate email that will provide a link to delete the account with some token to verify email ownership
  • Workaround: Delete user from admin panel and let them create new account
• Add Custom Role support for granular control of user permissions (https://bitwarden.com/help/article/user-types-access-control/#custom-role)
• Add Personal Ownership support (https://bitwarden.com/help/article/policies/#personal-ownership) (Added via Add support for the Personal Ownership policy #1326)
• Add Organizational Admin Password Reset support (https://bitwarden.com/help/admin-reset/) (See: Enterprise Admin password reset #1820)
• Add Bitwarden Public API endpoints (https://bitwarden.com/help/public-api/) (Needs: Org API Key support)
  (Partially added to support Bitwarden Directory Connector v2022.11.0)
• Run WebSockets on the same port as HTTP (third-party depends on Rocket support) (See: Run websocket server on same port as other HTTP serving #685 / Run websocket server on same port as other HTTP serving #2917) (Added via WebSockets via Rocket's Upgrade connection #3404)

If anyone wants to help implementing these features, we are available here or on the matrix channel to help guide you as much as we can.

[quthla]

What is needed for #241? Seems somebody already posted the needed changes in the corresponding issue so that could maybe be integrated?

[dani-garcia]

Yes, someone would have to check those changes, see what can be integrated into the project directly (possibly a config option for the mount point) and create the documentation on how to configure the vault, proxy, etc.

[mprasil]

@dpffxhad added it to the list

[Peneheals]

It would be great to see an (admin) feature which can help sysops to test mailing functionality. Maybe somewhere a button which can send a test e-mail to the actual user's address and which gives back a fail/success message after the action.

[mprasil]

Good idea @Peneheals, @njfox what do you think?

[p-rintz]

Would it be possible to introduce 2FA auth to the /admin panel as well?

[njfox]

Good idea @Peneheals, @njfox what do you think?

I also think that's a good idea, and it shouldn't be too difficult to implement. I can look at adding the necessary API endpoints once I find some time, or knowing @dani-garcia he'll probably get to it first

[dani-garcia]

About 2fa:
To do this, we'll need to implement it separately from the already existing 2fa code. I'm not sure if for this case it's worth it to implement multiple 2fa systems, so I would think just totp and maybe email would be good enough.

That said, this would require some changes to the admin page to input the 2fa code: we can't just ask for it at the start because it changes every 30 seconds .

Edit: About the email, as a workaround, you can invite yourself to test if it works for now, but it would be great to add

[chinenual]

I am having trouble getting an Apache reverse-proxy to work in my organization. For various reasons, I can't create a new subdomain for bitwarden - i need to run it as https://my.proxy.domain/bitwarden forwarding to localhost running http on a non-standard port. However I cannot find a way to get Apache's mod_proxy to proxy from /bitwarden context to root context. For other applications I'm able to create proxies to as long as the target application uses a non-root context.

I.e. I want to do this:

https://my.proxy/bitwarden <-> http:/localhost:1234

I can get other apps to work if the internal app uses non-root context -- e.g.

https://my.proxy/acontext <-> http:/localhost:1234/anothercontext

Can bitwarden_rs be configured to listen to /bitwarden_rs or /bitwarden instead of / ? If not, can someone help in constructing apache mod_proxy / mod_rewrite rules to proxy the bitwarden_rs root context from a non-root proxy context?

[mprasil]

@chinenual see #71. The TL/DR is that while bitwarden_rs doesn't mind serving from a sub path, client apps don't support that. There was some effort modifying the Vault code to allow this, but I haven't seen anyone reporting that they got it working.

[chinenual]

Thanks @mprasil - I'll keep my eye on upstream client support and check back here if/when it's supportable.

[quthla]

@mprasil I think only the web vault needs some patching (which has already been done?)

#241 (comment)

I changed the path in the android app and it'll correctly call api at that path.

"POST /bw/api/accounts/prelogin HTTP/1.1"

[mprasil]

Good to know @quthla, are you sure all functionality is present in the mobile client apps - like attachments. (also this probably still rules out using the official desktop app?)

[ViViDboarder]

Ah. Indeed you did. My bad. Well, at least we've clarified for anyone else suffering from reading comprehension issues like me. 😉

[technowhizz]

@technowhizz I am willing to work on that, but would not specifically target google OIDC. It will be possible if the generic support is there though. I will still need some pointers on where to start though. I cannot allocate enough time to dig deep without any pointers.

Any one down to help with pointers? :)

@ibotty to start theres an oauth module for rust here: https://docs.rs/crate/oauth2/4.1.0

[vivithecanine]

It would be nice to have a container config that bundled a proxy so that we could have an all-in-one container that provides static content hosting + the web application + websockets.

[Miarka24]

Hi, I first have to say in my two days investigating opensource passwordmanagers for my company vaultwarden is clearly in the lead right now, I have compared it to Passbolt and PSONO, we are a small company but secure passwords and password management is getting more and more important.
I have noticed two things I would love to have, as far as I can say those are not implemented in bitwarden either.
Ultimately both try to achieve a similar thing: prevent users to delete entries but allow them to update entries/passwords.

Considering company Passwords and sharing them with users added to the company there are currently two options for normal Users: "hide passwords" and "read only".
I´d love an additional option "update", this would allow users to update passwords but prevent them from deleting entries.

The other option is similar, but eventually easier to implement, keep everything as is but prevent normal users from accessing organizations recycle bin, this way it is not possible for a user to completely remove an entry. Managers/Admins would have 30days to recover deleted entries.

Maybe I have missed something and what I am requesting is already possible in some way, if so I´d be happy for some pointers :).

MfG/Best regards
Jonas Stunkat

[alfonsrv]

Likely not to be implemented @Miarka24. Use database backups.

[Miarka24]

Well backups are the bread and butter of course, but having this option wouldn´t hurt.
I am thinking about cases where you have many MANY passwords but some of them you dont use regularly, if a password like this gets deleted from the recycle bin too, it would be hard to notice and looking through the backups could become a pain.
I have read there is a feature request for an audit log, that could help if deletions are logged.

[NoseyNick]

Seeing as you mentioned backups...

I assume it is almost by definition impossible to carefully restore individual passwords from a backup, because they are all so nicely encrypted you wouldn't even know which is which, never mind which to restore? How about restoring individual users and/or organizations one at a time? ... but even then, presumably "restore entire user to a point in time" with obvious risk of losing ones that were added after the backup as well?

[BlackDex]

@Miarka24 @NoseyNick.
I think point 1 is more something for upstream Bitwarden.
There need to be client side support for that too.

Point 2, depending on what rights you give people to the org. You can give them read only access, while they can still share passwords and use them they can't delete them for an org.

Building both options into Vaultwarden would require significant work and new special options on the server side which we try to minimize as much as possible to keep as close as possible to Bitwarden.

Regarding restoring separate entries, that is in theorie possible, as long as the security keys aren't changed of the org, or for users, if they didn't rotated there key or changed there password.

Having backups is probably the best thing to do. You can just start a separate Vaultwarden container using the backup and try to find it.

[NoseyNick]

can just start a separate Vaultwarden container using the backup and try to find it.

Aha! Hadn't occurred to me but really good point, and certainly sounds easier than meddling with individual database records and stuff. Thanks!

[Miarka24]

@BlackDex
I don´t know about client support, wouldn´t it be the same as read-only? Even the same error message could be applied.
Regarding the code changes, that may be true I´didnt look too deep into the code.
Read-only is definitiv an option, but it has its own problems, if a user has the password, the user probably can change the password but will not be able to change it in the database. It would be similar to a deleted password or even worse.

But regardless, if this project is set up to follow bitwarden closely, I will respect that and hope bitwarden will introduce something similar in the future.

[S1M8N]

Hello,
This is very important :

Do you have any idea when the configurable option will arrive ?

Thank you for your information

[JBFUK]

Live sync for iOS devices please.

[BlackDex]

Hello, This is very important :

Do you have any idea when the configurable option will arrive ?

Thank you for your information

I am a bit against that. Because that could be used as a DoS feature. If i know your username and your host, i will just try random passwords and bam your account is locked.

I would suggest to use something like Fail2Ban, or some kind of WAF provided by the reverse proxy.

[BlackDex]

Live sync for iOS devices please.

Probably not going to happen in the near future.
This needs a API-Key from Bitwarden, and also the usage of there services.

[NoseyNick]

I am a bit against that. Because that could be used as a DoS feature. If i know your username and your host, i will just try random passwords and bam your account is locked.

I am amazed at how few people recognise this. I remember a previous employer proudly announcing that your account will be locked out after 3 login failures, and you'd need to ask IT Helldesk to unlock you. "For security reasons". My immediate question was "So how long until someone writes something that fails to log in as [CEO]@[COMPANY].com every minute? This is a SECURITY feature?"

Well so is the "locked safe dropped to the bottom of the mariannas trench" thing but come on!

However some (extremely stoopid) regulatory frameworks require this functionality, which is presumably why upstream has implemented it. Best compromise is usually "lock for N minutes and then unlock"

And in the case of [CEO]@[COMPANY].com, or anyone else @[COMPANY].com, it turns out that it doesn't need a skript kiddie to do this maliciously, just someone, almost everyone, including [CEO], to change their password but forget to update it on some email client somewhere that checks for new mail every N minutes. (Or in our case presumably the BitWarden client on their phone / laptop / other desktop)

... and THEN they learn that IP-specific fail2ban / similar is a better idea after all, so it doesn't block the devices you have updated, and almost certainly meets the same regulatory requirement. 🙈

[ninjamonkey198206]

I deleted my previous request, as I worded it I correctly.

The ability to create nested folders and move passwords between them inside organizations would be a wonderful addition.

It would also be wonderful to be able to share entire folders, not just individual entries with organizations, though that would rely on the folder capabilities.

Edit: After reading other posts and comments I realize this is likely an upstream thing. They essentially have to functionally have organizations as shared vaults rather than a separate function.

[hellfish2]

Please consider adding granular access

[p3lim]

Please considering supporting the Admin Password Reset feature, including the organization policies for automatic (forceful) enrollment.

[Nuc1eoN]

Hi, I would like to request a feature to support deduplication of password entries. This is the major pain point for me with vaultwarden.

I've imported passwords from many different browsers and sources and this has created a mess, in which I have every password duplicated about 5 times.
Also it is not easy to manually bulk delete or even compare entries. It is an impossible task for hundreds of passwords to review each entry manually and delete the dupes.

Other pw managers like lastpass do this automatically.

So far there are only workarounds to this problem e.g. https://hwrrobotics.com/2020/11/02/duplicate-password-remover-for-bitwarden/ or https://gist.github.com/giabao/f4c3de705f1d7f2c1fd0cde02e7b841d

And I am not even talking about deleteting/tyding up similar entries (which would be nice), but simply removing obvious 1:1 dupes.

[BlackDex]

Hi, I would like to request a feature to support deduplication of password entries. This is the major pain point for me with vaultwarden.

I've imported passwords from many different browsers and sources and this has created a mess, in which I have every password duplicated about 5 times. Also it is not easy to manually bulk delete or even compare entries. It is an impossible task for hundreds of passwords to review each entry manually and delete the dupes.

Other pw managers like lastpass do this automatically.

So far there are only workarounds to this problem e.g. https://hwrrobotics.com/2020/11/02/duplicate-password-remover-for-bitwarden/ or https://gist.github.com/giabao/f4c3de705f1d7f2c1fd0cde02e7b841d

And I am not even talking about deleteting/tyding up similar entries (which would be nice), but simply removing obvious 1:1 dupes.

That is something for the clients. See https://community.bitwarden.com/t/duplicate-removal-tool-report/648

[romu70]

Could you please add the wait-for-it script in the Dockerfile, to poll the availability of the DB? The current container stops when the DB is not available. It would be great if it could simply wait.

[BlackDex]

@romu70 If you are using docker-compose you can configure it to have vaultwarden depend on the database container.
You can also configure the DB_CONNECTION_RETRIES variable to be increased, every retry is a second.
Or you can add a script like that your self by following this: https://github.com/dani-garcia/vaultwarden/wiki/Starting-a-Container#customizing-container-startup

[lzinga]

I use vault warden by myself and don't need any organizations, it would be nice to be able to disable organizations and have it remove the prompts for it -

As the only individual that will be using my locally hosted vault I will not be needing organizations any time soon and it would be nice to remove it from the interface.

[p3lim]

@lzinga the web interface is not made by vaultwarden, it's the official one, vaultwarden simply includes it.

See https://github.com/bitwarden/web and https://github.com/dani-garcia/bw_web_builds

If you yourself want to hide it, use an extension like stylus.

[LecrisUT]

First of all, could this issue be converted to a discussion so that the feature request discussions can be viewed as threads. This format is so unwieldy IMO.

Otherwise I have a feature request and design I would like to post for consideration:

One/Two-way sync with keepass using asymmetric encryption

Problem being solved

Securely synchronizing a user's selected passwords with a hosted keepass database. Primarily this helps with sharing passwords with users across these different infrastructures and offer the user a trusted backup plan.

Design

1. The user submits their S/MIME or PGP public key to vaultwarden database to be kept track of. Alternatively, use OpenPGP's WKD standard and/or any upcoming S/MIME equivalent, to get the latest valid public key.
2. The user submits a hosted link where the .kdbx should be uploaded to, preferably via WebDAV or S3.
3. On change, public key expiration, etc. update a local keepass database copy, encrypt it via the public key, and upload it.
4. For the other way, the server maintains their own private key so that the user encrypts a different keepass database (could be same database but different encryption). Vaultwarden periodically pulls for changes to that file, decrypts it and synchronizes the local data.

Why the extra encryption?

• The database could be a keeshare database that the user wants to share with other internal keepass users, e.g. shared on non-public nextcloud server. The keepass file could be shared on a public hosting provider, e.g. if vaultwarden is someone's self-hosted instance not having access to the other internal network. If the password is not known to be secure, the extra layer will deter attackers accessing the public file. The reverse also holds.
• Assuming the public keys are hosted, it offers a centralized way of advertising one's credentials are compromised.
• Database can be re-encrypted with rolling short-term public keys for increased security.
• User/admin doesn't need to maintain a separate database for internal and external sharing. The database is branched out encrypted for each external link.

Other issues it can help with

Depending on which part is being tackled, partial integration of this would help with:

• Non-asynchronous keepass database sync.
• Additional user authentication. Same centralized advertisement of compromised credentials.

[BlackDex]

@LecrisUT there is a nice https://github.com/dani-garcia/vaultwarden/discussions/categories/ideas discussion categorie where you could have posted this of course.

Maybe locking this thread and pointing people to there is a good option. It was mostly intended to serve as a single location with an overview of all requests.
Regarding the post it self.
Vaultwarden does not encrypt or decrypt it self (except for jwt tokens or ssl connections). Adding that kind of a layer upon Vaultwarden would make it more harder to maintain. Also, we try to keep as close as possible to Bitwarden as we can, so I think these kind of requests are out of scope.

[BlackDex]

This issue is getting a bit large, and since there are discussions available for a while I'm going to lock this topic.
The first post will still be updated when needed.

If there are any feature's you currently miss, and are not mentioned in the first post already, please create a new post with your idea/request here: https://github.com/dani-garcia/vaultwarden/discussions/categories/ideas .

Thanks for all your ideas and support!