mirror of
https://github.com/dani-garcia/vaultwarden.git
synced 2026-04-26 09:46:00 +03:00
[GH-ISSUE #6642] VW ignores disabling email verification requirement #2494
Labels
No labels
SSO
Third party
better for forum
bug
bug
documentation
duplicate
enhancement
future Vault
future Vault
future Vault
good first issue
help wanted
low priority
notes
pull-request
question
troubleshooting
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/vaultwarden#2494
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @williamkray on GitHub (Dec 31, 2025).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/6642
Prerequisites
Vaultwarden Support String
Your environment (Generated via diagnostics page)
Config & Details (Generated via diagnostics page)
Show Config & Details
Config:
Vaultwarden Build Version
v1.35.1
Deployment method
Official Container Image
Custom deployment method
No response
Reverse Proxy
traefik 3.5.4
Host/Server Operating System
Linux
Operating System Version
Arch Linux
Clients
Web Vault
Client Version
v2025.12.1
Steps To Reproduce
As of this moment, the environment variables I am setting are:
Expected Result
I am able to log into Vaultwarden through SSO, even with an unregistered account.
Actual Result
When attempting to log in with an un-registered account using an email address associated with my SSO user, I get a 400 response in Vaultwarden with the error "You must verify your email address with your identity provider"
I have attempted to change the email verification requirements, but no matter what I set it to it seems to fail to log me in as a new user.
In Authentik, I see successful authorization events for my Vaultwarden application.
Logs
Screenshots or Videos
No response
Additional Context
I assume this has something to do with it: https://docs.goauthentik.io/releases/2025.10/#default-oauth-scope-mappings
And so I have worked around the configuration in Authentik by creating a new email scope mapping, based off of the default scope mapping, that returns
"email_verified": Truespecifically for this use-case, but it still seems like the Vaultwarden handling of this should be corrected.@stefan0xC commented on GitHub (Jan 1, 2026):
So if I understand the logic correctly your provider has send
"email_verified": falsewhich is not the same as an unknown email verification status or disabling this requirement.github.com/dani-garcia/vaultwarden@3e2cef7e8b/src/api/identity.rs (L241-L256)So at the moment this works as intended and described in the documentation.
@williamkray commented on GitHub (Jan 1, 2026):
I understand, and that makes sense. this additional configuration step should be added permanently to the authentik documentation then, I'll need to look into submitting that to the proper repository.