github-starred/vaultwarden
2
0
Fork 0
mirror of https://github.com/dani-garcia/vaultwarden.git synced 2026-05-24 17:12:43 -05:00
Code Issues 307 Packages Projects Releases 83 Wiki Activity

SSO: Not properly redirected to linux desktop client #6112

New Issue
Closed
opened 2026-03-07 20:50:35 -06:00 by GiteaMirror · 1 comment
GiteaMirror commented 2026-03-07 20:50:35 -06:00
Owner
Copy Link

Originally created by @ravxen on GitHub (Dec 24, 2025).

Prerequisites

Vaultwarden Support String

Your environment (Generated via diagnostics page)

  • Vaultwarden version: v1.34.3-0ab7784b
  • Web-vault version: v2025.12.0
  • OS/Arch: linux/x86_64
  • Running within a container: true (Base: Debian)
  • Database type: SQLite
  • Database version: 3.50.2
  • Uses config.json: false
  • Uses a reverse proxy: true
  • IP Header check: true (X-Real-IP)
  • Internet access: true
  • Internet access via a proxy: false
  • DNS Check: true
  • Browser/Server Time Check: true
  • Server/NTP Time Check: true
  • Domain Configuration Check: true
  • HTTPS Check: true
  • Websocket Check: true
  • HTTP Response Checks: true

Config & Details (Generated via diagnostics page)

Show Config & Details

Config:

{
  "_duo_akey": null,
  "_enable_duo": true,
  "_enable_email_2fa": true,
  "_enable_smtp": true,
  "_enable_yubico": true,
  "_icon_service_csp": "",
  "_icon_service_url": "",
  "_ip_header_enabled": true,
  "_max_note_size": 10000,
  "_smtp_img_src": "***:",
  "admin_ratelimit_max_burst": 3,
  "admin_ratelimit_seconds": 300,
  "admin_session_lifetime": 20,
  "admin_token": "***",
  "allowed_connect_src": "",
  "allowed_iframe_ancestors": "",
  "attachments_folder": "data/attachments",
  "auth_request_purge_schedule": "30 * * * * *",
  "authenticator_disable_time_drift": false,
  "data_folder": "data",
  "database_conn_init": "",
  "database_idle_timeout": 600,
  "database_max_conns": 10,
  "database_min_conns": 2,
  "database_timeout": 30,
  "database_url": "***************",
  "db_connection_retries": 15,
  "disable_2fa_remember": false,
  "disable_admin_token": false,
  "disable_icon_download": false,
  "dns_prefer_ipv6": false,
  "domain": "*****://********************",
  "domain_origin": "*****://********************",
  "domain_path": "",
  "domain_set": true,
  "duo_context_purge_schedule": "30 * * * * *",
  "duo_host": null,
  "duo_ikey": null,
  "duo_skey": null,
  "duo_use_iframe": false,
  "email_2fa_auto_fallback": false,
  "email_2fa_enforce_on_verified_invite": false,
  "email_attempts_limit": 3,
  "email_change_allowed": true,
  "email_expiration_time": 600,
  "email_token_size": 6,
  "emergency_access_allowed": true,
  "emergency_notification_reminder_schedule": "0 3 * * * *",
  "emergency_request_timeout_schedule": "0 7 * * * *",
  "enable_db_wal": true,
  "enable_websocket": true,
  "enforce_single_org_with_reset_pw_policy": false,
  "event_cleanup_schedule": "0 10 0 * * *",
  "events_days_retain": null,
  "experimental_client_feature_flags": "",
  "extended_logging": true,
  "helo_name": null,
  "hibp_api_key": null,
  "http_request_block_non_global_ips": true,
  "http_request_block_regex": null,
  "icon_blacklist_non_global_ips": true,
  "icon_blacklist_regex": null,
  "icon_cache_folder": "data/icon_cache",
  "icon_cache_negttl": 259200,
  "icon_cache_ttl": 2592000,
  "icon_download_timeout": 10,
  "icon_redirect_code": 302,
  "icon_service": "internal",
  "incomplete_2fa_schedule": "30 * * * * *",
  "incomplete_2fa_time_limit": 3,
  "increase_note_size_limit": false,
  "invitation_expiration_hours": 120,
  "invitation_org_name": "Vaultwarden",
  "invitations_allowed": false,
  "ip_header": "X-Real-IP",
  "job_poll_interval_ms": 30000,
  "log_file": null,
  "log_level": "info",
  "log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f",
  "login_ratelimit_max_burst": 10,
  "login_ratelimit_seconds": 60,
  "org_attachment_limit": null,
  "org_creation_users": "",
  "org_events_enabled": false,
  "org_groups_enabled": false,
  "password_hints_allowed": true,
  "password_iterations": 600000,
  "purge_incomplete_sso_auth": "0 20 0 * * *",
  "push_enabled": true,
  "push_identity_uri": "https://identity.bitwarden.eu",
  "push_installation_id": "***",
  "push_installation_key": "***",
  "push_relay_uri": "https://api.bitwarden.eu",
  "reload_templates": false,
  "require_device_email": false,
  "rsa_key_filename": "data/rsa_key",
  "send_purge_schedule": "0 5 * * * *",
  "sendmail_command": null,
  "sends_allowed": true,
  "sends_folder": "data/sends",
  "show_password_hint": false,
  "signups_allowed": false,
  "signups_domains_whitelist": "*****************",
  "signups_verify": false,
  "signups_verify_resend_limit": 6,
  "signups_verify_resend_time": 3600,
  "smtp_accept_invalid_certs": false,
  "smtp_accept_invalid_hostnames": false,
  "smtp_auth_mechanism": null,
  "smtp_debug": false,
  "smtp_embed_images": true,
  "smtp_explicit_tls": null,
  "smtp_from": "********************",
  "smtp_from_name": "***********",
  "smtp_host": "***************",
  "smtp_password": "***",
  "smtp_port": 465,
  "smtp_security": "force_tls",
  "smtp_ssl": null,
  "smtp_timeout": 15,
  "smtp_username": "******************",
  "sso_allow_unknown_email_verification": false,
  "sso_audience_trusted": null,
  "sso_auth_only_not_session": true,
  "sso_authority": "*****://******************************",
  "sso_authorize_extra_params": "",
  "sso_callback_path": "*****://*************************************************",
  "sso_client_cache_expiration": 0,
  "sso_client_id": "***********",
  "sso_client_secret": "***",
  "sso_debug_tokens": false,
  "sso_enabled": true,
  "sso_master_password_policy": null,
  "sso_only": true,
  "sso_pkce": true,
  "sso_scopes": "email profile",
  "sso_signups_match_email": true,
  "templates_folder": "data/templates",
  "tmp_folder": "data/tmp",
  "trash_auto_delete_days": null,
  "trash_purge_schedule": "0 5 0 * * *",
  "use_sendmail": false,
  "use_syslog": false,
  "user_attachment_limit": null,
  "user_send_limit": null,
  "web_vault_enabled": true,
  "web_vault_folder": "web-vault/",
  "yubico_client_id": null,
  "yubico_secret_key": null,
  "yubico_server": null
}

Vaultwarden Build Version

testing

Deployment method

Official Container Image

Custom deployment method

No response

Reverse Proxy

pangolin:latest, uses traefik:v.3.4.0 as backend

Host/Server Operating System

Linux

Operating System Version

Arch Linux

Clients

Desktop

Client Version

bitwarden 2025.10.0-1

Steps To Reproduce

  1. Deploy server with vaultwarden:testing and sso enabled
  2. Configure 'keycloak' as SSO Provider
  3. Test if the bitwarden desktop client works (browser & android successfully tested)
  4. Login with credentials

Expected Result

Webpage gets redirected to the desktop client and successfully logs in.

Actual Result

Webpage never redirects, despite having the following URIs configured as "Valid redirect URI" in keycloak.

- https://vault.domain.tld/identity/connect/oidc-signin
- bitwarden://* (Initially 'bitwarden://sso-callback', but changed just to make sure. Both didn't work.)

Logs

Vaultwarden: 


[2025-12-24 07:59:14.733][response][INFO] (get_org_domain_sso_verified) POST /api/organizations/domain/sso/verified => 200 OK
[2025-12-24 07:59:14.785][request][INFO] GET /identity/sso/prevalidate?domainHint=VW_DUMMY_IDENTIFIER
[2025-12-24 07:59:14.788][response][INFO] (prevalidate) GET /identity/sso/prevalidate => 200 OK
[2025-12-24 07:59:14.822][request][INFO] GET /identity/connect/authorize?client_id=desktop&redirect_uri
[2025-12-24 07:59:14.965][response][INFO] (authorize) GET /identity/connect/authorize?<data..> => 307 Temporary Redirect
[2025-12-24 07:59:15.057][request][INFO] GET /identity/connect/oidc-signin?state=YkhXakREZXlNNWpFY0hrWU1h
[2025-12-24 07:59:15.057][response][INFO] (oidcsignin) GET /identity/connect/oidc-signin?<code>&<state> => 307 Temporary Redirect

Keycloak (User events):

auth_method -> openid-connect
auth_type -> code
response_type -> code
redirect_uri -> https://vault.domain.tld/identity/connect/oidc-signin
consent ->  no_consent_required
code_id -> 157ad942-1tu7-3513-6434-99db72jd5y32
response_mode -> query
username -> myname

Screenshots or Videos

No response

Additional Context

redirect_uri -> https://vault.domain.tld/identity/connect/oidc-signin

Is somewhat the culprit I guess, because desktop expects bitwarden://sso-callback because the URL in the browser shows

https://vault.domain.lab/#/sso?clientId=desktop&redirectUri=bitwarden:%252F%252Fsso-callback

Im not sure if vaultwarden SSO has an issue with keycloak because keycloak is correctly configured and mobile redirects, similar to the bitwarden URI, work for e.g immich or jellyfin.

Originally created by @ravxen on GitHub (Dec 24, 2025). ### Prerequisites - [x] I have searched the existing **Closed _AND_ Open** [Issues](https://github.com/dani-garcia/vaultwarden/issues?q=is%3Aissue%20) **_AND_** [Discussions](https://github.com/dani-garcia/vaultwarden/discussions?discussions_q=) - [x] I have searched and read the [documentation](https://github.com/dani-garcia/vaultwarden/wiki/) ### Vaultwarden Support String ### Your environment (Generated via diagnostics page) * Vaultwarden version: v1.34.3-0ab7784b * Web-vault version: v2025.12.0 * OS/Arch: linux/x86_64 * Running within a container: true (Base: Debian) * Database type: SQLite * Database version: 3.50.2 * Uses config.json: false * Uses a reverse proxy: true * IP Header check: true (X-Real-IP) * Internet access: true * Internet access via a proxy: false * DNS Check: true * Browser/Server Time Check: true * Server/NTP Time Check: true * Domain Configuration Check: true * HTTPS Check: true * Websocket Check: true * HTTP Response Checks: true ### Config & Details (Generated via diagnostics page) <details><summary>Show Config & Details</summary> **Config:** ```json { "_duo_akey": null, "_enable_duo": true, "_enable_email_2fa": true, "_enable_smtp": true, "_enable_yubico": true, "_icon_service_csp": "", "_icon_service_url": "", "_ip_header_enabled": true, "_max_note_size": 10000, "_smtp_img_src": "***:", "admin_ratelimit_max_burst": 3, "admin_ratelimit_seconds": 300, "admin_session_lifetime": 20, "admin_token": "***", "allowed_connect_src": "", "allowed_iframe_ancestors": "", "attachments_folder": "data/attachments", "auth_request_purge_schedule": "30 * * * * *", "authenticator_disable_time_drift": false, "data_folder": "data", "database_conn_init": "", "database_idle_timeout": 600, "database_max_conns": 10, "database_min_conns": 2, "database_timeout": 30, "database_url": "***************", "db_connection_retries": 15, "disable_2fa_remember": false, "disable_admin_token": false, "disable_icon_download": false, "dns_prefer_ipv6": false, "domain": "*****://********************", "domain_origin": "*****://********************", "domain_path": "", "domain_set": true, "duo_context_purge_schedule": "30 * * * * *", "duo_host": null, "duo_ikey": null, "duo_skey": null, "duo_use_iframe": false, "email_2fa_auto_fallback": false, "email_2fa_enforce_on_verified_invite": false, "email_attempts_limit": 3, "email_change_allowed": true, "email_expiration_time": 600, "email_token_size": 6, "emergency_access_allowed": true, "emergency_notification_reminder_schedule": "0 3 * * * *", "emergency_request_timeout_schedule": "0 7 * * * *", "enable_db_wal": true, "enable_websocket": true, "enforce_single_org_with_reset_pw_policy": false, "event_cleanup_schedule": "0 10 0 * * *", "events_days_retain": null, "experimental_client_feature_flags": "", "extended_logging": true, "helo_name": null, "hibp_api_key": null, "http_request_block_non_global_ips": true, "http_request_block_regex": null, "icon_blacklist_non_global_ips": true, "icon_blacklist_regex": null, "icon_cache_folder": "data/icon_cache", "icon_cache_negttl": 259200, "icon_cache_ttl": 2592000, "icon_download_timeout": 10, "icon_redirect_code": 302, "icon_service": "internal", "incomplete_2fa_schedule": "30 * * * * *", "incomplete_2fa_time_limit": 3, "increase_note_size_limit": false, "invitation_expiration_hours": 120, "invitation_org_name": "Vaultwarden", "invitations_allowed": false, "ip_header": "X-Real-IP", "job_poll_interval_ms": 30000, "log_file": null, "log_level": "info", "log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f", "login_ratelimit_max_burst": 10, "login_ratelimit_seconds": 60, "org_attachment_limit": null, "org_creation_users": "", "org_events_enabled": false, "org_groups_enabled": false, "password_hints_allowed": true, "password_iterations": 600000, "purge_incomplete_sso_auth": "0 20 0 * * *", "push_enabled": true, "push_identity_uri": "https://identity.bitwarden.eu", "push_installation_id": "***", "push_installation_key": "***", "push_relay_uri": "https://api.bitwarden.eu", "reload_templates": false, "require_device_email": false, "rsa_key_filename": "data/rsa_key", "send_purge_schedule": "0 5 * * * *", "sendmail_command": null, "sends_allowed": true, "sends_folder": "data/sends", "show_password_hint": false, "signups_allowed": false, "signups_domains_whitelist": "*****************", "signups_verify": false, "signups_verify_resend_limit": 6, "signups_verify_resend_time": 3600, "smtp_accept_invalid_certs": false, "smtp_accept_invalid_hostnames": false, "smtp_auth_mechanism": null, "smtp_debug": false, "smtp_embed_images": true, "smtp_explicit_tls": null, "smtp_from": "********************", "smtp_from_name": "***********", "smtp_host": "***************", "smtp_password": "***", "smtp_port": 465, "smtp_security": "force_tls", "smtp_ssl": null, "smtp_timeout": 15, "smtp_username": "******************", "sso_allow_unknown_email_verification": false, "sso_audience_trusted": null, "sso_auth_only_not_session": true, "sso_authority": "*****://******************************", "sso_authorize_extra_params": "", "sso_callback_path": "*****://*************************************************", "sso_client_cache_expiration": 0, "sso_client_id": "***********", "sso_client_secret": "***", "sso_debug_tokens": false, "sso_enabled": true, "sso_master_password_policy": null, "sso_only": true, "sso_pkce": true, "sso_scopes": "email profile", "sso_signups_match_email": true, "templates_folder": "data/templates", "tmp_folder": "data/tmp", "trash_auto_delete_days": null, "trash_purge_schedule": "0 5 0 * * *", "use_sendmail": false, "use_syslog": false, "user_attachment_limit": null, "user_send_limit": null, "web_vault_enabled": true, "web_vault_folder": "web-vault/", "yubico_client_id": null, "yubico_secret_key": null, "yubico_server": null } ``` </details> ### Vaultwarden Build Version testing ### Deployment method Official Container Image ### Custom deployment method _No response_ ### Reverse Proxy pangolin:latest, uses traefik:v.3.4.0 as backend ### Host/Server Operating System Linux ### Operating System Version Arch Linux ### Clients Desktop ### Client Version bitwarden 2025.10.0-1 ### Steps To Reproduce 1. Deploy server with vaultwarden:testing and sso enabled 2. Configure 'keycloak' as SSO Provider 3. Test if the bitwarden desktop client works (browser & android successfully tested) 4. Login with credentials ### Expected Result Webpage gets redirected to the desktop client and successfully logs in. ### Actual Result Webpage never redirects, despite having the following URIs configured as "Valid redirect URI" in keycloak. ``` - https://vault.domain.tld/identity/connect/oidc-signin - bitwarden://* (Initially 'bitwarden://sso-callback', but changed just to make sure. Both didn't work.) ``` ### Logs ```text Vaultwarden: [2025-12-24 07:59:14.733][response][INFO] (get_org_domain_sso_verified) POST /api/organizations/domain/sso/verified => 200 OK [2025-12-24 07:59:14.785][request][INFO] GET /identity/sso/prevalidate?domainHint=VW_DUMMY_IDENTIFIER [2025-12-24 07:59:14.788][response][INFO] (prevalidate) GET /identity/sso/prevalidate => 200 OK [2025-12-24 07:59:14.822][request][INFO] GET /identity/connect/authorize?client_id=desktop&redirect_uri [2025-12-24 07:59:14.965][response][INFO] (authorize) GET /identity/connect/authorize?<data..> => 307 Temporary Redirect [2025-12-24 07:59:15.057][request][INFO] GET /identity/connect/oidc-signin?state=YkhXakREZXlNNWpFY0hrWU1h [2025-12-24 07:59:15.057][response][INFO] (oidcsignin) GET /identity/connect/oidc-signin?<code>&<state> => 307 Temporary Redirect Keycloak (User events): auth_method -> openid-connect auth_type -> code response_type -> code redirect_uri -> https://vault.domain.tld/identity/connect/oidc-signin consent -> no_consent_required code_id -> 157ad942-1tu7-3513-6434-99db72jd5y32 response_mode -> query username -> myname ``` ### Screenshots or Videos _No response_ ### Additional Context ``` redirect_uri -> https://vault.domain.tld/identity/connect/oidc-signin ``` Is somewhat the culprit I guess, because desktop expects bitwarden://sso-callback because the URL in the browser shows ``` https://vault.domain.lab/#/sso?clientId=desktop&redirectUri=bitwarden:%252F%252Fsso-callback ``` Im not sure if vaultwarden SSO has an issue with keycloak because keycloak is correctly configured and mobile redirects, similar to the bitwarden URI, work for e.g immich or jellyfin.
GiteaMirror added the SSObug labels 2026-03-07 20:50:35 -06:00
GiteaMirror commented 2026-03-07 20:50:36 -06:00
Author
Owner
Copy Link

@stefan0xC commented on GitHub (Jan 6, 2026):

How did you install the Bitwarden Desktop client?

As far as I've tested this with the official AppImage from Bitwarden getting this to work can be a bit involved and depending on your desktop environment you might have to manually create a desktop file like this:

# ~/.local/share/applications/bitwarden.desktop
[Desktop Entry]
Name=Bitwarden
Exec=/usr/local/bin/Bitwarden-2025.12.0-x86_64.AppImage %U
Terminal=false
Type=Application
Icon=bitwarden
StartupWMClass=Bitwarden
X-AppImage-Version=2025.12.0
GenericName=Password Manager
Comment=A secure and free password manager for all of your devices.
MimeType=x-scheme-handler/bitwarden;
Categories=Utility;

So that your browser can ask if it opens a Bitwarden link:

Image

I have not tried the method for firefox that is described in the wiki which might be easier.

Cf. https://bitwarden.com/download/#:~:text=The%20AppImage%20package%20will%20not%20support%20desktop%20integration

@stefan0xC commented on GitHub (Jan 6, 2026): How did you install the Bitwarden Desktop client? As far as I've tested this with the official AppImage from Bitwarden getting this to work can be a bit involved and depending on your desktop environment you might have to manually create a desktop file like this: ```ini # ~/.local/share/applications/bitwarden.desktop [Desktop Entry] Name=Bitwarden Exec=/usr/local/bin/Bitwarden-2025.12.0-x86_64.AppImage %U Terminal=false Type=Application Icon=bitwarden StartupWMClass=Bitwarden X-AppImage-Version=2025.12.0 GenericName=Password Manager Comment=A secure and free password manager for all of your devices. MimeType=x-scheme-handler/bitwarden; Categories=Utility; ``` So that your browser can ask if it opens a Bitwarden link: <img width="795" height="348" alt="Image" src="https://github.com/user-attachments/assets/b0536ebf-9a79-441b-bb65-75bba93e5bea" /> I have not tried [the method for firefox that is described in the wiki](https://github.com/dani-garcia/vaultwarden/wiki/Enabling-SSO-support-using-OpenId-Connect#desktop-client) which might be easier. Cf. https://bitwarden.com/download/#:~:text=The%20AppImage%20package%20will%20not%20support%20desktop%20integration
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
better for forum
bug
documentation
duplicate
enhancement
future Vault
good first issue
help wanted
low priority
notes
pull-request
Mirrored from GitHub Pull Request
 question
SSO
Third party
troubleshooting
wontfix
No Label bug SSO
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/vaultwarden#6112
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?