starred/vaultwarden

Fork 0

mirror of https://github.com/dani-garcia/vaultwarden.git synced 2026-04-25 17:25:57 +03:00

[GH-ISSUE #6316] Invited Users Not Redirected to SSO Login with SSO_ONLY Mode #2402

New issue

Closed

opened 2026-03-03 02:17:59 +03:00 by kerem · 5 comments

kerem commented

2026-03-03 02:17:59 +03:00

Owner

Originally created by @kaeferpsd on GitHub (Sep 23, 2025).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/6316

Prerequisites

I have searched the existing Closed AND Open Issues AND Discussions
I have searched and read the documentation

Vaultwarden Support String

Your environment (Generated via diagnostics page)

Vaultwarden version: v1.34.3-a2ad1dc7
Web-vault version: v2025.8.0
OS/Arch: linux/x86_64
Running within a container: true (Base: Debian)
Database type: PostgreSQL
Database version: PostgreSQL 15.13 (Debian 15.13-1.pgdg120+1) on x86_64-pc-linux-gnu, compiled by gcc (Debian 12.2.0-14) 12.2.0, 64-bit
Uses config.json: false
Uses a reverse proxy: true
IP Header check: true (X-Real-IP)
Internet access: true
Internet access via a proxy: false
DNS Check: true
Browser/Server Time Check: true
Server/NTP Time Check: true
Domain Configuration Check: true
HTTPS Check: true
Websocket Check: true
HTTP Response Checks: true

Config & Details (Generated via diagnostics page)

Show Config & Details

Config:

{
  "_duo_akey": null,
  "_enable_duo": true,
  "_enable_email_2fa": true,
  "_enable_smtp": true,
  "_enable_yubico": true,
  "_icon_service_csp": "",
  "_icon_service_url": "",
  "_ip_header_enabled": true,
  "_max_note_size": 10000,
  "_smtp_img_src": "***:",
  "admin_ratelimit_max_burst": 3,
  "admin_ratelimit_seconds": 300,
  "admin_session_lifetime": 20,
  "admin_token": "***",
  "allowed_connect_src": "",
  "allowed_iframe_ancestors": "",
  "attachments_folder": "data/attachments",
  "auth_request_purge_schedule": "30 * * * * *",
  "authenticator_disable_time_drift": false,
  "data_folder": "data",
  "database_conn_init": "",
  "database_idle_timeout": 600,
  "database_max_conns": 10,
  "database_min_conns": 2,
  "database_timeout": 30,
  "database_url": "**********://************************************************************",
  "db_connection_retries": 15,
  "disable_2fa_remember": false,
  "disable_admin_token": false,
  "disable_icon_download": false,
  "domain": "*****://*****************",
  "domain_origin": "*****://*****************",
  "domain_path": "",
  "domain_set": true,
  "duo_context_purge_schedule": "30 * * * * *",
  "duo_host": null,
  "duo_ikey": null,
  "duo_skey": null,
  "duo_use_iframe": false,
  "email_2fa_auto_fallback": false,
  "email_2fa_enforce_on_verified_invite": false,
  "email_attempts_limit": 3,
  "email_change_allowed": true,
  "email_expiration_time": 600,
  "email_token_size": 6,
  "emergency_access_allowed": true,
  "emergency_notification_reminder_schedule": "0 3 * * * *",
  "emergency_request_timeout_schedule": "0 7 * * * *",
  "enable_db_wal": true,
  "enable_websocket": true,
  "enforce_single_org_with_reset_pw_policy": false,
  "event_cleanup_schedule": "0 10 0 * * *",
  "events_days_retain": null,
  "experimental_client_feature_flags": "",
  "extended_logging": true,
  "helo_name": null,
  "hibp_api_key": null,
  "http_request_block_non_global_ips": true,
  "http_request_block_regex": null,
  "icon_blacklist_non_global_ips": true,
  "icon_blacklist_regex": null,
  "icon_cache_folder": "data/icon_cache",
  "icon_cache_negttl": 259200,
  "icon_cache_ttl": 2592000,
  "icon_download_timeout": 10,
  "icon_redirect_code": 302,
  "icon_service": "internal",
  "incomplete_2fa_schedule": "30 * * * * *",
  "incomplete_2fa_time_limit": 3,
  "increase_note_size_limit": false,
  "invitation_expiration_hours": 120,
  "invitation_org_name": "Vaultwarden",
  "invitations_allowed": true,
  "ip_header": "X-Real-IP",
  "job_poll_interval_ms": 30000,
  "log_file": null,
  "log_level": "debug",
  "log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f",
  "login_ratelimit_max_burst": 10,
  "login_ratelimit_seconds": 60,
  "org_attachment_limit": null,
  "org_creation_users": "",
  "org_events_enabled": false,
  "org_groups_enabled": false,
  "password_hints_allowed": true,
  "password_iterations": 600000,
  "purge_incomplete_sso_nonce": "0 20 0 * * *",
  "push_enabled": false,
  "push_identity_uri": "https://identity.bitwarden.com",
  "push_installation_id": "***",
  "push_installation_key": "***",
  "push_relay_uri": "https://push.bitwarden.com",
  "reload_templates": false,
  "require_device_email": false,
  "rsa_key_filename": "data/rsa_key",
  "send_purge_schedule": "0 5 * * * *",
  "sendmail_command": null,
  "sends_allowed": true,
  "sends_folder": "data/sends",
  "show_password_hint": false,
  "signups_allowed": true,
  "signups_domains_whitelist": "",
  "signups_verify": false,
  "signups_verify_resend_limit": 6,
  "signups_verify_resend_time": 3600,
  "smtp_accept_invalid_certs": false,
  "smtp_accept_invalid_hostnames": false,
  "smtp_auth_mechanism": "Login",
  "smtp_debug": false,
  "smtp_embed_images": true,
  "smtp_explicit_tls": null,
  "smtp_from": "*************************",
  "smtp_from_name": "KAEFER Deutschland Pro Services GmbH",
  "smtp_host": "******************",
  "smtp_password": "***",
  "smtp_port": 587,
  "smtp_security": "starttls",
  "smtp_ssl": null,
  "smtp_timeout": 15,
  "smtp_username": "*************************",
  "sso_allow_unknown_email_verification": true,
  "sso_audience_trusted": null,
  "sso_auth_only_not_session": false,
  "sso_authority": "*****://*******************************************************************",
  "sso_authorize_extra_params": "",
  "sso_callback_path": "*****://**********************************************",
  "sso_client_cache_expiration": 0,
  "sso_client_id": "************************************",
  "sso_client_secret": "***",
  "sso_debug_tokens": false,
  "sso_enabled": true,
  "sso_master_password_policy": "{\"enforceOnLogin\":false,\"minComplexity\":3,\"minLength\":12,\"requireLower\":false,\"requireNumbers\":false,\"requireSpecial\":false,\"requireUpper\":false}",
  "sso_only": true,
  "sso_pkce": true,
  "sso_scopes": "openid profile email",
  "sso_signups_match_email": true,
  "templates_folder": "data/templates",
  "tmp_folder": "data/tmp",
  "trash_auto_delete_days": null,
  "trash_purge_schedule": "0 5 0 * * *",
  "use_sendmail": false,
  "use_syslog": false,
  "user_attachment_limit": null,
  "user_send_limit": null,
  "web_vault_enabled": true,
  "web_vault_folder": "web-vault/",
  "yubico_client_id": null,
  "yubico_secret_key": null,
  "yubico_server": null
}

Vaultwarden Build Version

1.34.3-a2ad1dc7

Deployment method

Official Container Image

Custom deployment method

No response

Reverse Proxy

https://github.com/NginxProxyManager/nginx-proxy-manager?utm_source=nginx-proxy-manager

Host/Server Operating System

Linux

Operating System Version

No response

Clients

Web Vault

Client Version

No response

Steps To Reproduce

Environment
Vaultwarden Version: vaultwarden/server:testing
SSO Provider: Microsoft Azure AD (OpenID Connect)
Configuration: SSO_ONLY mode enabled
Problem Description
When SSO_ONLY: "true" is configured and a new user is invited to an organization, the user is not properly redirected to the SSO login flow. Instead, they are prompted to enter a master password that they never created, creating an impossible authentication loop.
Steps to Reproduce
Configure Vaultwarden with SSO_ONLY mode:
Admin invites a new user via organization invite
New user receives invitation email
User clicks "Accept Invite" link from email
User is presented with login form asking for master password

Expected Result

Expected Behavior
User should be automatically redirected to Microsoft Azure AD SSO login
After successful SSO authentication, user should then be prompted to create their first master password for vault encryption
User should then gain access to the organization
Actual Behavior
User is immediately prompted for master password without SSO redirect
Since user never created a master password, they cannot proceed
No way to access SSO login from this state

Actual Result

Additional Context
Regular SSO login works correctly when users access the main domain directly
The issue appears to be specific to the invitation acceptance flow
Temporarily disabling SSO_ONLY allows users to complete registration, but defeats the purpose of SSO-only mode
This creates a broken user experience where invited users cannot join the organization
Workaround
Currently, the only workaround is to:
Temporarily set SSO_ONLY: "false"
Have user complete initial registration
Re-enable SSO_ONLY: "true"
Expected Fix
The invitation acceptance flow should properly redirect to SSO authentication when SSO_ONLY mode is enabled, rather than presenting the traditional login form.

Logs

Screenshots or Videos

No response

Additional Context

No response

Originally created by @kaeferpsd on GitHub (Sep 23, 2025). Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/6316 ### Prerequisites - [x] I have searched the existing **Closed _AND_ Open** [Issues](https://github.com/dani-garcia/vaultwarden/issues?q=is%3Aissue%20) **_AND_** [Discussions](https://github.com/dani-garcia/vaultwarden/discussions?discussions_q=) - [x] I have searched and read the [documentation](https://github.com/dani-garcia/vaultwarden/wiki/) ### Vaultwarden Support String ### Your environment (Generated via diagnostics page) * Vaultwarden version: v1.34.3-a2ad1dc7 * Web-vault version: v2025.8.0 * OS/Arch: linux/x86_64 * Running within a container: true (Base: Debian) * Database type: PostgreSQL * Database version: PostgreSQL 15.13 (Debian 15.13-1.pgdg120+1) on x86_64-pc-linux-gnu, compiled by gcc (Debian 12.2.0-14) 12.2.0, 64-bit * Uses config.json: false * Uses a reverse proxy: true * IP Header check: true (X-Real-IP) * Internet access: true * Internet access via a proxy: false * DNS Check: true * Browser/Server Time Check: true * Server/NTP Time Check: true * Domain Configuration Check: true * HTTPS Check: true * Websocket Check: true * HTTP Response Checks: true ### Config & Details (Generated via diagnostics page) <details><summary>Show Config & Details</summary> **Config:** ```json { "_duo_akey": null, "_enable_duo": true, "_enable_email_2fa": true, "_enable_smtp": true, "_enable_yubico": true, "_icon_service_csp": "", "_icon_service_url": "", "_ip_header_enabled": true, "_max_note_size": 10000, "_smtp_img_src": "***:", "admin_ratelimit_max_burst": 3, "admin_ratelimit_seconds": 300, "admin_session_lifetime": 20, "admin_token": "***", "allowed_connect_src": "", "allowed_iframe_ancestors": "", "attachments_folder": "data/attachments", "auth_request_purge_schedule": "30 * * * * *", "authenticator_disable_time_drift": false, "data_folder": "data", "database_conn_init": "", "database_idle_timeout": 600, "database_max_conns": 10, "database_min_conns": 2, "database_timeout": 30, "database_url": "**********://************************************************************", "db_connection_retries": 15, "disable_2fa_remember": false, "disable_admin_token": false, "disable_icon_download": false, "domain": "*****://*****************", "domain_origin": "*****://*****************", "domain_path": "", "domain_set": true, "duo_context_purge_schedule": "30 * * * * *", "duo_host": null, "duo_ikey": null, "duo_skey": null, "duo_use_iframe": false, "email_2fa_auto_fallback": false, "email_2fa_enforce_on_verified_invite": false, "email_attempts_limit": 3, "email_change_allowed": true, "email_expiration_time": 600, "email_token_size": 6, "emergency_access_allowed": true, "emergency_notification_reminder_schedule": "0 3 * * * *", "emergency_request_timeout_schedule": "0 7 * * * *", "enable_db_wal": true, "enable_websocket": true, "enforce_single_org_with_reset_pw_policy": false, "event_cleanup_schedule": "0 10 0 * * *", "events_days_retain": null, "experimental_client_feature_flags": "", "extended_logging": true, "helo_name": null, "hibp_api_key": null, "http_request_block_non_global_ips": true, "http_request_block_regex": null, "icon_blacklist_non_global_ips": true, "icon_blacklist_regex": null, "icon_cache_folder": "data/icon_cache", "icon_cache_negttl": 259200, "icon_cache_ttl": 2592000, "icon_download_timeout": 10, "icon_redirect_code": 302, "icon_service": "internal", "incomplete_2fa_schedule": "30 * * * * *", "incomplete_2fa_time_limit": 3, "increase_note_size_limit": false, "invitation_expiration_hours": 120, "invitation_org_name": "Vaultwarden", "invitations_allowed": true, "ip_header": "X-Real-IP", "job_poll_interval_ms": 30000, "log_file": null, "log_level": "debug", "log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f", "login_ratelimit_max_burst": 10, "login_ratelimit_seconds": 60, "org_attachment_limit": null, "org_creation_users": "", "org_events_enabled": false, "org_groups_enabled": false, "password_hints_allowed": true, "password_iterations": 600000, "purge_incomplete_sso_nonce": "0 20 0 * * *", "push_enabled": false, "push_identity_uri": "https://identity.bitwarden.com", "push_installation_id": "***", "push_installation_key": "***", "push_relay_uri": "https://push.bitwarden.com", "reload_templates": false, "require_device_email": false, "rsa_key_filename": "data/rsa_key", "send_purge_schedule": "0 5 * * * *", "sendmail_command": null, "sends_allowed": true, "sends_folder": "data/sends", "show_password_hint": false, "signups_allowed": true, "signups_domains_whitelist": "", "signups_verify": false, "signups_verify_resend_limit": 6, "signups_verify_resend_time": 3600, "smtp_accept_invalid_certs": false, "smtp_accept_invalid_hostnames": false, "smtp_auth_mechanism": "Login", "smtp_debug": false, "smtp_embed_images": true, "smtp_explicit_tls": null, "smtp_from": "*************************", "smtp_from_name": "KAEFER Deutschland Pro Services GmbH", "smtp_host": "******************", "smtp_password": "***", "smtp_port": 587, "smtp_security": "starttls", "smtp_ssl": null, "smtp_timeout": 15, "smtp_username": "*************************", "sso_allow_unknown_email_verification": true, "sso_audience_trusted": null, "sso_auth_only_not_session": false, "sso_authority": "*****://*******************************************************************", "sso_authorize_extra_params": "", "sso_callback_path": "*****://**********************************************", "sso_client_cache_expiration": 0, "sso_client_id": "************************************", "sso_client_secret": "***", "sso_debug_tokens": false, "sso_enabled": true, "sso_master_password_policy": "{\"enforceOnLogin\":false,\"minComplexity\":3,\"minLength\":12,\"requireLower\":false,\"requireNumbers\":false,\"requireSpecial\":false,\"requireUpper\":false}", "sso_only": true, "sso_pkce": true, "sso_scopes": "openid profile email", "sso_signups_match_email": true, "templates_folder": "data/templates", "tmp_folder": "data/tmp", "trash_auto_delete_days": null, "trash_purge_schedule": "0 5 0 * * *", "use_sendmail": false, "use_syslog": false, "user_attachment_limit": null, "user_send_limit": null, "web_vault_enabled": true, "web_vault_folder": "web-vault/", "yubico_client_id": null, "yubico_secret_key": null, "yubico_server": null } ``` </details> ### Vaultwarden Build Version 1.34.3-a2ad1dc7 ### Deployment method Official Container Image ### Custom deployment method _No response_ ### Reverse Proxy https://github.com/NginxProxyManager/nginx-proxy-manager?utm_source=nginx-proxy-manager ### Host/Server Operating System Linux ### Operating System Version _No response_ ### Clients Web Vault ### Client Version _No response_ ### Steps To Reproduce Environment Vaultwarden Version: vaultwarden/server:testing SSO Provider: Microsoft Azure AD (OpenID Connect) Configuration: SSO_ONLY mode enabled Problem Description When SSO_ONLY: "true" is configured and a new user is invited to an organization, the user is not properly redirected to the SSO login flow. Instead, they are prompted to enter a master password that they never created, creating an impossible authentication loop. Steps to Reproduce Configure Vaultwarden with SSO_ONLY mode: Admin invites a new user via organization invite New user receives invitation email User clicks "Accept Invite" link from email User is presented with login form asking for master password ### Expected Result Expected Behavior User should be automatically redirected to Microsoft Azure AD SSO login After successful SSO authentication, user should then be prompted to create their first master password for vault encryption User should then gain access to the organization Actual Behavior User is immediately prompted for master password without SSO redirect Since user never created a master password, they cannot proceed No way to access SSO login from this state ### Actual Result Additional Context Regular SSO login works correctly when users access the main domain directly The issue appears to be specific to the invitation acceptance flow Temporarily disabling SSO_ONLY allows users to complete registration, but defeats the purpose of SSO-only mode This creates a broken user experience where invited users cannot join the organization Workaround Currently, the only workaround is to: Temporarily set SSO_ONLY: "false" Have user complete initial registration Re-enable SSO_ONLY: "true" Expected Fix The invitation acceptance flow should properly redirect to SSO authentication when SSO_ONLY mode is enabled, rather than presenting the traditional login form. ### Logs ```text ``` ### Screenshots or Videos _No response_ ### Additional Context _No response_

kerem

2026-03-03 02:17:59 +03:00

closed this issue
added the
bug

SSO
labels

kerem commented

2026-03-03 02:18:00 +03:00

Author

Owner

@Timshel commented on GitHub (Oct 21, 2025):

Hey

Sorry I was not around when the PR was opened.
At the moment Org invitation is broken in testing.

I'll check again once it's merged, but it used to work.
SSO_ONLY need to be activated at the time of the invitation, but I think I will change it for the invitation to redirect to the SSO flow as soon as it's activated (SSO_ENABLED).

@Timshel commented on GitHub (Oct 21, 2025): Hey Sorry I was not around when the PR was opened. At the moment Org invitation is [broken](https://github.com/dani-garcia/vaultwarden/pull/6364) in `testing`. I'll check again once it's merged, but it used to work. `SSO_ONLY` need to be activated at the time of the invitation, but I think I will change it for the invitation to redirect to the SSO flow as soon as it's activated (`SSO_ENABLED`).

kerem commented

2026-03-03 02:18:01 +03:00

Author

Owner

@Timshel commented on GitHub (Oct 22, 2025):

Hey,
The PR was merged, do you still have the issue ?

@Timshel commented on GitHub (Oct 22, 2025): Hey, The PR was merged, do you still have the issue ?

kerem commented

2026-03-03 02:18:01 +03:00

Author

Owner

@alexanderkraemer commented on GitHub (Jan 6, 2026):

I still experience this issue.
SSO_ONLY and SSO_ENABLED is set to true, but users still are not seeing the SSO option, except when they manually go to /#/sso path.
Otherwise the standard login form just returns an error, that sso is required for this user.

@alexanderkraemer commented on GitHub (Jan 6, 2026): I still experience this issue. SSO_ONLY and SSO_ENABLED is set to true, but users still are not seeing the SSO option, except when they manually go to `/#/sso` path. Otherwise the standard login form just returns an error, that sso is required for this user.

kerem commented

2026-03-03 02:18:01 +03:00

Author

Owner

@stefan0xC commented on GitHub (Jan 8, 2026):

If it's just the login page can you check if your /css/vaultwarden.css does include .vw-continue-login and does not include .vw-sso-login and .vw-email-sso?

.providers-2fa-3,app-root a[routerlink="/signup"],app-user-layout app-danger-zone button:nth-child(1),bit-nav-logo bit-nav-item .bwi-shield,bit-dialog div.tw-ml-4:has(bit-form-control input),bit-dialog div.tw-col-span-4:has(input[formcontrolname*=access],input[formcontrolname*=manage]),app-security>app-two-factor-setup>form,app-org-reports-home>app-report-list>div.tw-inline-grid>div:nth-child(6),app-org-account form.ng-untouched:nth-child(5),app-organization-plans>form>bit-section:nth-child(2),bit-nav-item[route="settings/two-factor"],a[href$="/settings/two-factor"],.vw-other-login,.vw-or-text,.vw-passkey-login,app-user-layout app-password-settings app-webauthn-login-settings,.vw-continue-login,.vw-email-continue,a[href$="/settings/sponsored-families"],bit-nav-item[route="settings/subscription"],.vw-hide,head{display:none !important}bit-nav-logo bit-nav-item a:before{content:"";background-image:url("../images/icon-white.svg");background-repeat:no-repeat;background-position:center center;height:32px;display:block}

My suspicion would be that something in your setup might have cached that file indefinitely.

@stefan0xC commented on GitHub (Jan 8, 2026): If it's just the login page can you check if your `/css/vaultwarden.css` does include `.vw-continue-login` and does not include `.vw-sso-login` and `.vw-email-sso`? ```css .providers-2fa-3,app-root a[routerlink="/signup"],app-user-layout app-danger-zone button:nth-child(1),bit-nav-logo bit-nav-item .bwi-shield,bit-dialog div.tw-ml-4:has(bit-form-control input),bit-dialog div.tw-col-span-4:has(input[formcontrolname*=access],input[formcontrolname*=manage]),app-security>app-two-factor-setup>form,app-org-reports-home>app-report-list>div.tw-inline-grid>div:nth-child(6),app-org-account form.ng-untouched:nth-child(5),app-organization-plans>form>bit-section:nth-child(2),bit-nav-item[route="settings/two-factor"],a[href$="/settings/two-factor"],.vw-other-login,.vw-or-text,.vw-passkey-login,app-user-layout app-password-settings app-webauthn-login-settings,.vw-continue-login,.vw-email-continue,a[href$="/settings/sponsored-families"],bit-nav-item[route="settings/subscription"],.vw-hide,head{display:none !important}bit-nav-logo bit-nav-item a:before{content:"";background-image:url("../images/icon-white.svg");background-repeat:no-repeat;background-position:center center;height:32px;display:block} ``` My suspicion would be that something in your setup might have cached that file indefinitely.

kerem commented

2026-03-03 02:18:01 +03:00

Author

Owner

@alexanderkraemer commented on GitHub (Jan 8, 2026):

You are right, the vaultwarden.css does include .vw-continue-login and does not contain .vw-sso-login and .vw-email-sso

well it is running on k8s, so killing the pod should clear the cache....
Not sure why it didn't clear the cache beforehand. i can see i did a deploy of that app.
nvmd, it's working now :)
thanks!

@alexanderkraemer commented on GitHub (Jan 8, 2026): You are right, the `vaultwarden.css` does include `.vw-continue-login` and does not contain `.vw-sso-login` and `.vw-email-sso` well it is running on k8s, so killing the pod should clear the cache.... Not sure why it didn't clear the cache beforehand. i can see i did a deploy of that app. nvmd, it's working now :) thanks!