starred/vaultwarden

Fork 0

mirror of https://github.com/dani-garcia/vaultwarden.git synced 2026-04-25 17:25:57 +03:00

[GH-ISSUE #936] Impossible to delete user if it is the only owner of an organization #662

New issue

Closed

opened 2026-03-03 02:01:55 +03:00 by kerem · 5 comments

kerem commented

2026-03-03 02:01:55 +03:00

Owner

Originally created by @spudjb on GitHub (Mar 29, 2020).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/936

Subject of the issue

If a user exists who created an organization that they are the only owner of, it is impossible to delete them.

Your environment

Bitwarden_rs version: 1.14.1-5471088e

Install method: Docker image
Clients used: admin page
Reverse proxy and version:
Version of mysql/postgresql:
Other relevant information:

Steps to reproduce

Start with admin_token set
Create a user, and create an organization with that user
Navigate to /admin/ and attempt to delete the user

Expected behaviour

It should be possible to delete this user, or at least prevent future logins somehow. Alternatively, users should be prevented from creating organizations.

Actual behaviour

The user could not be deleted with the following error message:

Error deleting user
Can't delete last owner

Relevant logs

[2020-03-28 23:08:43][request][INFO] POST /admin/users/<uuid>/delete
[2020-03-28 23:08:43][error][ERROR] Can't delete last owner
[2020-03-28 23:08:43][response][INFO] POST /admin/users/<uuid>/delete (delete_user) => 400 Bad Request

Originally created by @spudjb on GitHub (Mar 29, 2020). Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/936  ### Subject of the issue If a user exists who created an organization that they are the only owner of, it is impossible to delete them. ### Your environment  * Bitwarden_rs version: 1.14.1-5471088e  * Install method: Docker image * Clients used: admin page * Reverse proxy and version:  * Version of mysql/postgresql:  * Other relevant information: ### Steps to reproduce  1. Start with admin_token set 2. Create a user, and create an organization with that user 3. Navigate to /admin/ and attempt to delete the user ### Expected behaviour It should be possible to delete this user, or at least prevent future logins somehow. Alternatively, users should be prevented from creating organizations. ### Actual behaviour The user could not be deleted with the following error message: > Error deleting user > Can't delete last owner ### Relevant logs ``` [2020-03-28 23:08:43][request][INFO] POST /admin/users/<uuid>/delete [2020-03-28 23:08:43][error][ERROR] Can't delete last owner [2020-03-28 23:08:43][response][INFO] POST /admin/users/<uuid>/delete (delete_user) => 400 Bad Request ```

kerem

2026-03-03 02:01:55 +03:00

closed this issue
added the
enhancement

good first issue

bug
labels

kerem commented

2026-03-03 02:01:56 +03:00

Author

Owner

@dani-garcia commented on GitHub (Mar 30, 2020):

Hmm, for this we need to do two things I think:

When trying to delete a user that's the last owner from the admin page, we should detect the error and offer to also delete the organization. This could just be a dialog after the delete user confim dialog.
On the other side, we should also allow one way to promote a different user to owner, in case we want to keep the organization in place. We can't make another user join, because that would require access for the crypto keys, but we can change a users organization level, probably by clicking on the organization name from the user entry in the admin page, we could show a dialog there to switch users level.

@dani-garcia commented on GitHub (Mar 30, 2020): Hmm, for this we need to do two things I think: - When trying to delete a user that's the last owner from the admin page, we should detect the error and offer to also delete the organization. This could just be a dialog after the delete user confim dialog. - On the other side, we should also allow one way to promote a different user to owner, in case we want to keep the organization in place. We can't make another user join, because that would require access for the crypto keys, but we can change a users organization level, probably by clicking on the organization name from the user entry in the admin page, we could show a dialog there to switch users level.

kerem commented

2026-03-03 02:01:56 +03:00

Author

Owner

@spudjb commented on GitHub (Mar 30, 2020):

I think it would be best to offer both:

An admin API to delete any organization
An admin API to promote/demote/removd users in organizations (if
possible?)

Then these could be used to clean up the situation prior to removing the
user.

On Mon, Mar 30, 2020, 22:00 Daniel García notifications@github.com wrote:

Hmm, for this we need to do two things I think:

When trying to delete a user that's the last owner from the admin
page, we should detect the error and offer to also delete the organization.
This could just be a dialog after the delete user confim dialog.

On the other side, we should also allow one way to promote a different
user to owner, in case we want to keep the organization in place. We can't
make another user join, because that would require access for the crypto
keys, but we can change a users organization level, probably by clicking on
the organization name from the user entry in the admin page, we could show
a dialog there to switch users level.

—
You are receiving this because you authored the thread.
Reply to this email directly, view it on GitHub
https://github.com/dani-garcia/bitwarden_rs/issues/936#issuecomment-606214186,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/ALVACUVRZG6KXOLKKFWGWS3RKD27VANCNFSM4LV23F3A
.

@spudjb commented on GitHub (Mar 30, 2020): I think it would be best to offer both: * An admin API to delete any organization * An admin API to promote/demote/removd users in organizations (if possible?) Then these could be used to clean up the situation prior to removing the user. On Mon, Mar 30, 2020, 22:00 Daniel García <notifications@github.com> wrote: > Hmm, for this we need to do two things I think: > > - > > When trying to delete a user that's the last owner from the admin > page, we should detect the error and offer to also delete the organization. > This could just be a dialog after the delete user confim dialog. > - > > On the other side, we should also allow one way to promote a different > user to owner, in case we want to keep the organization in place. We can't > make another user join, because that would require access for the crypto > keys, but we can change a users organization level, probably by clicking on > the organization name from the user entry in the admin page, we could show > a dialog there to switch users level. > > — > You are receiving this because you authored the thread. > Reply to this email directly, view it on GitHub > <https://github.com/dani-garcia/bitwarden_rs/issues/936#issuecomment-606214186>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/ALVACUVRZG6KXOLKKFWGWS3RKD27VANCNFSM4LV23F3A> > . >

kerem commented

2026-03-03 02:01:56 +03:00

Author

Owner

@jjlin commented on GitHub (Mar 31, 2020):

It might make sense to do this by implementing the relevant pieces of the Bitwarden public API (https://docs.bitwarden.com/), which could be the foundation of a full implementation later on.

@jjlin commented on GitHub (Mar 31, 2020): It might make sense to do this by implementing the relevant pieces of the Bitwarden public API (https://docs.bitwarden.com/), which could be the foundation of a full implementation later on.

kerem commented

2026-03-03 02:01:57 +03:00

Author

Owner

@speedygonzales391 commented on GitHub (Oct 16, 2020):

Any progress about this?

@speedygonzales391 commented on GitHub (Oct 16, 2020): Any progress about this?

kerem commented

2026-03-03 02:01:57 +03:00

Author

Owner

@BlackDex commented on GitHub (Feb 3, 2021):

I'm currently working on a way to change a user-type from the users/overview page.
That way you can at least promote an other user to admin if that user is already a member of that same organization.

And i'm adding a delete org on the organization overview page.

I find it tricky to offer a new dialog asking to delete the org also if that users is the last owner.
I'm afraid that people will quickly press yes, yes, yes even if we add extra are you sure too dialog boxes.
People just do not read. Therefore i will add it to the org overview where it will be clear to delete an org and not a user.

@BlackDex commented on GitHub (Feb 3, 2021): I'm currently working on a way to change a user-type from the users/overview page. That way you can at least promote an other user to admin if that user is already a member of that same organization. And i'm adding a delete org on the organization overview page. I find it tricky to offer a new dialog asking to delete the org also if that users is the last owner. I'm afraid that people will quickly press yes, yes, yes even if we add extra `are you sure too` dialog boxes. People just do not read. Therefore i will add it to the org overview where it will be clear to delete an org and not a user.