[GH-ISSUE #1435] User not removed from org after turning on 2FA #957

New issue

Closed

opened 2026-03-03 02:05:00 +03:00 by kerem · 1 comment

kerem commented

2026-03-03 02:05:00 +03:00

Owner

Originally created by @angelus2014 on GitHub (Feb 25, 2021).
Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/1435

Subject of the issue

After turning on 2FA (2 Step Login) for an organization, users that are not removed from the organization even though the option states:
"Organization members who are not Owners or Administrators and do not have two-step login enabled for their personal account will be removed from the organization and will receive an email notifying them about the change."
Not sure if this is related to issue #981

Your environment

Server version 1.9.0
Web version 2.18.1

Install method: Docker
Clients used: web ui
Reverse proxy and version: none
Version of mysql/postgresql: none
Other relevant information:

Steps to reproduce

Create an organization without 2FA, add some users and then turn on 2FA.

Expected behaviour

As the app states, the users should be removed from the organization if they haven't turned on 2FA.

Actual behaviour

Nothing happens, users stay in the organization and can login as before. No email is sent.

Relevant logs

Regards,

Angelo Machils

Originally created by @angelus2014 on GitHub (Feb 25, 2021). Original GitHub issue: https://github.com/dani-garcia/vaultwarden/issues/1435 ### Subject of the issue After turning on 2FA (2 Step Login) for an organization, users that are not removed from the organization even though the option states: "Organization members who are not Owners or Administrators and do not have two-step login enabled for their personal account will be removed from the organization and will receive an email notifying them about the change." Not sure if this is related to issue #981 ### Your environment Server version 1.9.0 Web version 2.18.1 * Install method: Docker * Clients used: web ui * Reverse proxy and version: none * Version of mysql/postgresql: none * Other relevant information: ### Steps to reproduce Create an organization without 2FA, add some users and then turn on 2FA. ### Expected behaviour As the app states, the users should be removed from the organization if they haven't turned on 2FA. ### Actual behaviour Nothing happens, users stay in the organization and can login as before. No email is sent. ### Relevant logs --- Regards, Angelo Machils

kerem

2026-03-03 02:05:00 +03:00

closed this issue
added the
enhancement

duplicate
labels

kerem commented

2026-03-03 02:05:02 +03:00

Author

Owner

@BlackDex commented on GitHub (Feb 25, 2021):

We currently do not support 2FA on organizations.
As is mentioned in https://github.com/dani-garcia/bitwarden_rs/wiki.

Marking this as a duplicate of #981

@BlackDex commented on GitHub (Feb 25, 2021): We currently do not support 2FA on organizations. As is mentioned in https://github.com/dani-garcia/bitwarden_rs/wiki. Marking this as a duplicate of #981

kerem referenced this issue

2026-03-03 08:53:17 +03:00

[PR #957] [MERGED] Domain whitelist cleanup and fixes #2834