When logging in with DUO 2FA configured, login fails if email entered is not all lowercase.
Your environment
Bitwarden_rs version:
1.14.1-843604c9
Install method: official docker image: bitwardenrs/server:latest
Clients used: Web (Chrome)
Reverse proxy and version: Traefik 1.7.21
Version of mysql/postgresql: n/a
Other relevant information:
Steps to reproduce
start up a bitwarden_rs container
create an account with the following email: Test@test.com
log in, and set up 2FA via DUO normally
log out
log in with the following email (note the capital T): Test@test.com
perform DUO 2FA
observe that login FAILED
go back to login screen, and log in with the following email (note the lowercase t): test@test.com
perform DUO 2FA
observe that login SUCCEEDS, and you are now in your vault
Expected behaviour
From what I understand, email shouldn't be required to be all lowercase. Without DUO, we are able to login using mixed uppercase and lowercase email. But with DUO enabled, we are forced to use lowercase email.
Actual behaviour
With DUO enabled, users cannot login using mixed case emails. Users are forced to enter lower case email, even though the user registered with mixed case emails initially.
Relevant logs
AJAX call received HTTP 400 error:
POST /identity/connect/token response:
{"ErrorModel":{"Message":"Error validating duo authentication","Object":"error"},"Message":"","Object":"error","ValidationErrors":{"":["Error validating duo authentication"]},"error":"","error_description":""}
docker log output:
[2020-04-07 19:48:38][request][INFO] POST /api/accounts/prelogin
[2020-04-07 19:48:38][response][INFO] POST /api/accounts/prelogin (prelogin) => 200 OK
[2020-04-07 19:48:38][request][INFO] POST /identity/connect/token
[2020-04-07 19:48:38][error][ERROR] 2FA token not provided
[2020-04-07 19:48:38][response][INFO] POST /identity/connect/token (login) => 400 Bad Request
[2020-04-07 19:48:51][request][INFO] POST /identity/connect/token
[2020-04-07 19:48:51][error][ERROR] Error validating duo authentication
[2020-04-07 19:48:51][response][INFO] POST /identity/connect/token (login) => 400 Bad Request
Originally created by @defung on GitHub (Apr 7, 2020).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/955
<!--
Please fill out the following template to make solving your problem easier and faster for us.
This is only a guideline. If you think that parts are unneccessary for your issue, feel free to remove them.
Remember to hide/obfuscate personal and confidential information,
such as names, global IP/DNS adresses and especially passwords, if neccessary.
-->
### Subject of the issue
When logging in with DUO 2FA configured, login fails if email entered is not all lowercase.
### Your environment
<!-- The version number, obtained from the logs or the admin page -->
* Bitwarden_rs version:
1.14.1-843604c9
* Install method: official docker image: bitwardenrs/server:latest
* Clients used: Web (Chrome)
* Reverse proxy and version: Traefik 1.7.21
* Version of mysql/postgresql: n/a
* Other relevant information:
### Steps to reproduce
1. start up a bitwarden_rs container
2. create an account with the following email: Test@test.com
3. log in, and set up 2FA via DUO normally
4. log out
5. log in with the following email (note the capital T): Test@test.com
6. perform DUO 2FA
7. observe that login FAILED
8. go back to login screen, and log in with the following email (note the lowercase t): test@test.com
9. perform DUO 2FA
10. observe that login SUCCEEDS, and you are now in your vault
### Expected behaviour
From what I understand, email shouldn't be required to be all lowercase. Without DUO, we are able to login using mixed uppercase and lowercase email. But with DUO enabled, we are forced to use lowercase email.
### Actual behaviour
With DUO enabled, users cannot login using mixed case emails. Users are forced to enter lower case email, even though the user registered with mixed case emails initially.
### Relevant logs
AJAX call received HTTP 400 error:
```
POST /identity/connect/token response:
{"ErrorModel":{"Message":"Error validating duo authentication","Object":"error"},"Message":"","Object":"error","ValidationErrors":{"":["Error validating duo authentication"]},"error":"","error_description":""}
```
docker log output:
```
[2020-04-07 19:48:38][request][INFO] POST /api/accounts/prelogin
[2020-04-07 19:48:38][response][INFO] POST /api/accounts/prelogin (prelogin) => 200 OK
[2020-04-07 19:48:38][request][INFO] POST /identity/connect/token
[2020-04-07 19:48:38][error][ERROR] 2FA token not provided
[2020-04-07 19:48:38][response][INFO] POST /identity/connect/token (login) => 400 Bad Request
[2020-04-07 19:48:51][request][INFO] POST /identity/connect/token
[2020-04-07 19:48:51][error][ERROR] Error validating duo authentication
[2020-04-07 19:48:51][response][INFO] POST /identity/connect/token (login) => 400 Bad Request
```
<!-- gh-comment-id:610723512 -->
@defung commented on GitHub (Apr 8, 2020):
I don't know rust too well, but I suspect this needs some `equalsIgnoreCase` type of thing here:
https://github.com/dani-garcia/bitwarden_rs/blob/master/src/api/core/two_factor/duo.rs#L286
Thanks for the quick fix, @jjlin and @dani-garcia! When can we expect the new docker image to be released?
<!-- gh-comment-id:610934286 -->
@defung commented on GitHub (Apr 8, 2020):
Thanks for the quick fix, @jjlin and @dani-garcia! When can we expect the new docker image to be released?
The :latest tag should finish building in an hour or two, and a new numbered release on the weekend probably.
<!-- gh-comment-id:610942938 -->
@dani-garcia commented on GitHub (Apr 8, 2020):
The :latest tag should finish building in an hour or two, and a new numbered release on the weekend probably.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @defung on GitHub (Apr 7, 2020).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/955
Subject of the issue
When logging in with DUO 2FA configured, login fails if email entered is not all lowercase.
Your environment
1.14.1-843604c9
Steps to reproduce
Expected behaviour
From what I understand, email shouldn't be required to be all lowercase. Without DUO, we are able to login using mixed uppercase and lowercase email. But with DUO enabled, we are forced to use lowercase email.
Actual behaviour
With DUO enabled, users cannot login using mixed case emails. Users are forced to enter lower case email, even though the user registered with mixed case emails initially.
Relevant logs
AJAX call received HTTP 400 error:
docker log output:
@defung commented on GitHub (Apr 8, 2020):
I don't know rust too well, but I suspect this needs some
equalsIgnoreCasetype of thing here:https://github.com/dani-garcia/bitwarden_rs/blob/master/src/api/core/two_factor/duo.rs#L286
@jjlin commented on GitHub (Apr 8, 2020):
Yeah, I already tested a fix.
@defung commented on GitHub (Apr 8, 2020):
Thanks for the quick fix, @jjlin and @dani-garcia! When can we expect the new docker image to be released?
@dani-garcia commented on GitHub (Apr 8, 2020):
The :latest tag should finish building in an hour or two, and a new numbered release on the weekend probably.