mirror of
https://github.com/dani-garcia/vaultwarden.git
synced 2026-04-26 01:35:54 +03:00
[GH-ISSUE #2925] Emergency access fails if grantor doesnt log in during waiting time #1415
Labels
No labels
SSO
Third party
better for forum
bug
bug
documentation
duplicate
enhancement
future Vault
future Vault
future Vault
good first issue
help wanted
low priority
notes
pull-request
question
troubleshooting
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/vaultwarden#1415
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @SoleroTG on GitHub (Nov 18, 2022).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/2925
Originally assigned to: @BlackDex on GitHub.
Subject of the issue
When the grantee requests access to the grantor's vault, access isn't possible after the wait time if the grantor hasn't logged in during that time. Although the grantee received the
Emergency access request for John Doe approvedemail, theEmergency Accesstab of the grantee's account just lists the tagsEmergency AccessInitiated andViewfor the grantor user.Deployment environment
Your environment (Generated via diagnostics page)
Config (Generated via diagnostics page)
Show Running Config
Environment settings which are overridden: DOMAIN, ADMIN_TOKEN, ALLOWED_IFRAME_ANCESTORS, SMTP_HOST, SMTP_SECURITY, SMTP_PORT, SMTP_FROM, SMTP_FROM_NAME, SMTP_USERNAME, SMTP_PASSWORD, SMTP_AUTH_MECHANISM
Steps to reproduce
Viewaccess after one day of waitingEmergency Accessafter receiving theEmergency access request for grantor approvedemailRemoveExpected behaviour
Grantee is able to access grantors vault after the waiting time.
Actual behaviour
Grantee cannot access grantors vault after the waiting time.
@BlackDex commented on GitHub (Nov 18, 2022):
I have tested this just last week. And it all seems to work fine it looks like.
emergency_accesstable).If you are able to, please copy/paste/provide the following columns of the record you think is in error.
atypestatuswait_time_daysrecovery_initiated_atlast_notification_atupdated_atcreated_atAlso, please enable
LOG_LEVEL=debug, that should provide some more info regarding the jobs running for the emergency access.Also remember that the
wait-timeis checked during the scheduled job. That job is executed every hour at minute 5 of that hour.So,
11:05,12:05,13:05etc... If for example that requested timestamp is13:06the previous day, then you will have to wait for14:05for that request to be triggered.Please provide the requested info so that we can try to help.
@SoleroTG commented on GitHub (Nov 18, 2022):
Thanks for the fast reply.
I tested it twice with a wait time of one hour. I tried to access the grantors vault after I received the email
Emergency access request for grantor approved. I didn't wait much longer and reset both accounts afterwards. I run another try and post the results here, as requested.@BlackDex commented on GitHub (Nov 18, 2022):
There is no wait time of an hour. There is a minimum of 1day.
So, if you expected it to be one hour, that is mistaken.
@SoleroTG commented on GitHub (Nov 18, 2022):
Thanks for the correction. I meant one day, of course.
@SoleroTG commented on GitHub (Nov 19, 2022):
The already active run finished like the ones before.
I received the
Emergency access request for grantor approvedemail at 17:05. Accessing the vault via grantee did not work.After one and two hours later I still wasn't able to access the vault.
Now I set
LOG_LEVEL=debug.In the
emergency_accesstable in db.sqlite3 I findatype=0status=3wait_time_days=1recovery_initiated_at=2022-11-18 15:39:15.342045184last_notification_at=2022-11-18 15:39:15.342045184updated_at=2022-11-19 18:05:16.410392218created_at=2022-11-18 15:37:51.165740427This confuses me as no emergency access is neither active nor pending.
I never messed with the database and just access the db via a offsite copy I took beforehand.
Should I still retry a new emergency access test? I think, that the entry in the emergency_access table situation should be solved before doing so.
@BlackDex commented on GitHub (Nov 19, 2022):
Strange, it does mention it was updated, but the status is still at 3, which i think from the top of my mind should be 4.
Please enable debug log level, and keep it running. It should keep trying the same, since the status is not correct yet.
@SoleroTG commented on GitHub (Nov 20, 2022):
Just a small update:
The
emergency_accesstable still shows the same content, although no emergency job being neither active no pending. Should I expect a cronjob fixing the entry?The only log entries related to this are:
I'm grateful for any advice about what I can or should try next?
@SoleroTG commented on GitHub (Nov 21, 2022):
Regarding the emergency access I am just getting the above posted entries about no emergency request being active (which is true atm).
The entry in the
emergency_accesstable still exists.Can I manually delete this entry?
@stefan0xC commented on GitHub (Nov 21, 2022):
If you remove the grantee as grantor (or yourself as grantee) the entry should be deleted as well.
You could try a
PRAGMA integrity_checkon the sqlite database.@BlackDex commented on GitHub (Nov 21, 2022):
If you want to grant your self access by an already approved access, which means ot shared the keys. The you can change the status your self too 4. Else you should also be able to remove the access on either side via the web-vault.
@SoleroTG commented on GitHub (Nov 21, 2022):
Right now, no user is shown neither as grantor nor grantee in the ui. This is consistent with my actions in the ui.
I ran the command and received
integrity_check OKThe line in the
emergency_accesstable, however, is still there.I changed the
statusin theemergency_accesstable from 3 to 4. This made the entry disappear in the db. Looks good so far.Now I try again to give grantee emergency access and will post the result here.
Thanks for the help. I keep you updated.
@SoleroTG commented on GitHub (Nov 22, 2022):
It worked.
After I manipulated the db directly and set the status in the
emergency_accesstable from3to4it worked like a charm.Although, I have no idea how this corrupt entry appeared in the first place, I am happy that it is working now.
Thanks a lot for the support.
@BlackDex commented on GitHub (Nov 23, 2022):
Was it corrupted in which sense? Only the state was wrong? Or the database had issues?
As a side note. While i was checking the code, i saw some small enhancements for the code handeling this. I'll see if i can optimize the code a bit and maybe i will encounter something strange that could explain this behaviour.
@BlackDex commented on GitHub (Nov 23, 2022):
I might have found something which could cause this specific issue.
There could be some race-conditions and that could cause strange behaviors.
@SoleroTG commented on GitHub (Nov 23, 2022):
The database itself was consistent. With the term corrupted I mean that the database was in a state in which the application didn't function correctly and wasn't able to correct itself. If the term corrupted doesn't fit here I take it back and may as well call it in a funny state.
Anyhow, thanks again for the fast support.
@BlackDex commented on GitHub (Nov 23, 2022):
To make the terms a bit more clear. A corrupt database is a database which isn't functioning at all.
A record with an invalid state is what was causing the issue.
The reason it is important, a corrupt database could also cause some strange issue, including not being able to update a record.
But, if the database was valid, then there might be a coding issue.
As already mentioned, I think i have found what could cause this. One way of fixing this your self would be to change the schedules of the two emergency access jobs in such a way that they will never run at the same time.
I keep this issue open until i finished the changes to the emergency access code.