starred/vaultwarden

Fork 0

mirror of https://github.com/dani-garcia/vaultwarden.git synced 2026-04-26 09:46:00 +03:00

[GH-ISSUE #955] DUO 2FA - login fails if email is not lowercase #680

New issue

Closed

opened 2026-03-03 02:02:07 +03:00 by kerem · 4 comments

kerem commented

2026-03-03 02:02:07 +03:00

Owner

Originally created by @defung on GitHub (Apr 7, 2020).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/955

Subject of the issue

When logging in with DUO 2FA configured, login fails if email entered is not all lowercase.

Your environment

Bitwarden_rs version:
1.14.1-843604c9
Install method: official docker image: bitwardenrs/server:latest
Clients used: Web (Chrome)
Reverse proxy and version: Traefik 1.7.21
Version of mysql/postgresql: n/a
Other relevant information:

Steps to reproduce

start up a bitwarden_rs container
create an account with the following email: Test@test.com
log in, and set up 2FA via DUO normally
log out
log in with the following email (note the capital T): Test@test.com
perform DUO 2FA
observe that login FAILED
go back to login screen, and log in with the following email (note the lowercase t): test@test.com
perform DUO 2FA
observe that login SUCCEEDS, and you are now in your vault

Expected behaviour

From what I understand, email shouldn't be required to be all lowercase. Without DUO, we are able to login using mixed uppercase and lowercase email. But with DUO enabled, we are forced to use lowercase email.

Actual behaviour

With DUO enabled, users cannot login using mixed case emails. Users are forced to enter lower case email, even though the user registered with mixed case emails initially.

Relevant logs

AJAX call received HTTP 400 error:

POST /identity/connect/token response:
{"ErrorModel":{"Message":"Error validating duo authentication","Object":"error"},"Message":"","Object":"error","ValidationErrors":{"":["Error validating duo authentication"]},"error":"","error_description":""}

docker log output:

[2020-04-07 19:48:38][request][INFO] POST /api/accounts/prelogin
[2020-04-07 19:48:38][response][INFO] POST /api/accounts/prelogin (prelogin) => 200 OK
[2020-04-07 19:48:38][request][INFO] POST /identity/connect/token
[2020-04-07 19:48:38][error][ERROR] 2FA token not provided
[2020-04-07 19:48:38][response][INFO] POST /identity/connect/token (login) => 400 Bad Request
[2020-04-07 19:48:51][request][INFO] POST /identity/connect/token
[2020-04-07 19:48:51][error][ERROR] Error validating duo authentication
[2020-04-07 19:48:51][response][INFO] POST /identity/connect/token (login) => 400 Bad Request

Originally created by @defung on GitHub (Apr 7, 2020). Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/955  ### Subject of the issue When logging in with DUO 2FA configured, login fails if email entered is not all lowercase. ### Your environment  * Bitwarden_rs version: 1.14.1-843604c9 * Install method: official docker image: bitwardenrs/server:latest * Clients used: Web (Chrome) * Reverse proxy and version: Traefik 1.7.21 * Version of mysql/postgresql: n/a * Other relevant information: ### Steps to reproduce 1. start up a bitwarden_rs container 2. create an account with the following email: Test@test.com 3. log in, and set up 2FA via DUO normally 4. log out 5. log in with the following email (note the capital T): Test@test.com 6. perform DUO 2FA 7. observe that login FAILED 8. go back to login screen, and log in with the following email (note the lowercase t): test@test.com 9. perform DUO 2FA 10. observe that login SUCCEEDS, and you are now in your vault ### Expected behaviour From what I understand, email shouldn't be required to be all lowercase. Without DUO, we are able to login using mixed uppercase and lowercase email. But with DUO enabled, we are forced to use lowercase email. ### Actual behaviour With DUO enabled, users cannot login using mixed case emails. Users are forced to enter lower case email, even though the user registered with mixed case emails initially. ### Relevant logs AJAX call received HTTP 400 error: ``` POST /identity/connect/token response: {"ErrorModel":{"Message":"Error validating duo authentication","Object":"error"},"Message":"","Object":"error","ValidationErrors":{"":["Error validating duo authentication"]},"error":"","error_description":""} ``` docker log output: ``` [2020-04-07 19:48:38][request][INFO] POST /api/accounts/prelogin [2020-04-07 19:48:38][response][INFO] POST /api/accounts/prelogin (prelogin) => 200 OK [2020-04-07 19:48:38][request][INFO] POST /identity/connect/token [2020-04-07 19:48:38][error][ERROR] 2FA token not provided [2020-04-07 19:48:38][response][INFO] POST /identity/connect/token (login) => 400 Bad Request [2020-04-07 19:48:51][request][INFO] POST /identity/connect/token [2020-04-07 19:48:51][error][ERROR] Error validating duo authentication [2020-04-07 19:48:51][response][INFO] POST /identity/connect/token (login) => 400 Bad Request ```

kerem closed this issue

2026-03-03 02:02:07 +03:00

kerem commented

2026-03-03 02:02:08 +03:00

Author

Owner

@defung commented on GitHub (Apr 8, 2020):

I don't know rust too well, but I suspect this needs some equalsIgnoreCase type of thing here:

https://github.com/dani-garcia/bitwarden_rs/blob/master/src/api/core/two_factor/duo.rs#L286

@defung commented on GitHub (Apr 8, 2020): I don't know rust too well, but I suspect this needs some `equalsIgnoreCase` type of thing here: https://github.com/dani-garcia/bitwarden_rs/blob/master/src/api/core/two_factor/duo.rs#L286

kerem commented

2026-03-03 02:02:08 +03:00

Author

Owner

@jjlin commented on GitHub (Apr 8, 2020):

Yeah, I already tested a fix.

@jjlin commented on GitHub (Apr 8, 2020): Yeah, I already tested a fix.

kerem commented

2026-03-03 02:02:08 +03:00

Author

Owner

@defung commented on GitHub (Apr 8, 2020):

Thanks for the quick fix, @jjlin and @dani-garcia! When can we expect the new docker image to be released?

@defung commented on GitHub (Apr 8, 2020): Thanks for the quick fix, @jjlin and @dani-garcia! When can we expect the new docker image to be released?

kerem commented

2026-03-03 02:02:08 +03:00

Author

Owner

@dani-garcia commented on GitHub (Apr 8, 2020):

The :latest tag should finish building in an hour or two, and a new numbered release on the weekend probably.

@dani-garcia commented on GitHub (Apr 8, 2020): The :latest tag should finish building in an hour or two, and a new numbered release on the weekend probably.