mirror of
https://github.com/dani-garcia/vaultwarden.git
synced 2026-04-26 01:35:54 +03:00
[GH-ISSUE #898] Bug: Signups_domains_whitelist does not wrk #642
Labels
No labels
SSO
Third party
better for forum
bug
bug
documentation
duplicate
enhancement
future Vault
future Vault
future Vault
good first issue
help wanted
low priority
notes
pull-request
question
troubleshooting
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/vaultwarden#642
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @Brainscrewer on GitHub (Mar 9, 2020).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/898
Subject of the issue
The 'Allow signups only from this list of comma-separated domains'-feature does not work as intended. If you only have added '@company.com' as allowed e-mailadress you can still register with @gmail.com for example.
Your environment
Steps to reproduce
Default configuration.
Expected behaviour
@company.com should only be able to register if configured.
Actual behaviour
Any e-mailaddress can be used to register.
Relevant logs
@tomuta commented on GitHub (Mar 11, 2020):
I suspect this is a configuration issue. Domain names do not contain an '@' symbol. It is not an email address whitelist. See the examples in the documentation:
github.com/dani-garcia/bitwarden_rs@70f3ab8ec3/.env.template (L113-L115)Can you share the exact value you're using for
SIGNUPS_DOMAINS_WHITELIST?@jjlin commented on GitHub (Mar 11, 2020):
@Brainscrewer Take a look at https://github.com/dani-garcia/bitwarden_rs/wiki/Disable-registration-of-new-users.
@Brainscrewer commented on GitHub (Mar 11, 2020):
@tomuta @jjlin thanks for your reply. My config looks the following:
SIGNUPS_ALLOWED | false
INVITATIONS_ALLOWED | false
SIGNUPS_DOMAINS_WHITELIST | company.nl
Even with these values set, it's still possible to register an account using a Gmail-account.
@jjlin commented on GitHub (Mar 11, 2020):
@Brainscrewer Check whether you have a
config.jsonfile in your data dir. The values in this file override the values of any corresponding env vars you have set.@Brainscrewer commented on GitHub (Mar 12, 2020):
@jjlin Oh wow, thanks for poiting that out! Only after you poiting that out I actually found out that information is posted on the admin-page as well, doh. After changing the values to the correct values on the admin panel everything seems to be working. Closing this issue.
@tbluemel commented on GitHub (Mar 12, 2020):
It feels like this should really be fixed. At a minimum I would expect either warnings or an startup error if bitwarden detects mismatches between config.json and the environment variables. Silently preferring one over the other may have severe security complications, e.g. the administrator thought they fixed a bad setup, but the change didn't actually get applied.
I feel like we either should re-open this bug or create a new one, and add code to check for configuration mismatch and reject running, or at a minimum log a big fat warning.
@mqus commented on GitHub (Mar 12, 2020):
I agree and want to add that a similar warning should be at the top of
.env.template, too.@Brainscrewer commented on GitHub (Mar 12, 2020):
Some additional checking and/or more explicit warnings would be nice, yes.