Connector as a service (Windows)

[SjamonDaal]

Please add a service to the windows app to run the connector automatically without the requirement that the app needs to be opened.

[kspearrin]

You will need to do this manually using the bwdc CLI tool. You could create a scheduled task of a PowerShell script that does something like bwdc sync. See here for more info on using the CLI:

https://help.bitwarden.com/article/directory-sync/#command-line-interface

[caddac]

I'm trying to do this same thing. How do I tell the CLI to look for the data.json file in a directory that isn't my own user directory? IOW, I have a user designed to run the scheduled task without being logged in. However that user doesn't have access into my user directory. How can I set the data-file path?

[joeldeteves]

I have the same question as @caddac; I am unsure how to point bwdc.exe to a different data file path outside the default one.

UPDATE:
I was able to work around this issue as follows:

Pre-requisites

1. If you don't already have a service account created in AD e.g. 'CONTOSO\bitwarden'; you need to do this anyways for syncing the directory so go ahead and do that.

On the server that hosts the connector

2. If your environment is secure like mine, then only admins are allowed to log on to the server. In order to allow the service account to function, we must configure the server to allow the service account to log on as a batch job:

• Local Security Policy (secpol.msc) -> Local Policies -> User Rights Assignment -> Log on as a batch job
• Add the service account (CONTOSO\bitwarden) to the list
• Click OK

3. Create a Scheduled Task:

General

• Name: Bitwarden Sync
• When running the task, use the following user account: CONTOSO\bitwarden
• Run whether the user is logged on or not -> Selected (enabled)

Triggers

• Create a new trigger, set it to run Daily and recur every 1 day, every hour. Check 'Stop the task if it runs longer than' -> Set to the minimum (30 minutes)
• Ensure the task is set to 'Enabled'
• After saving the task, you will be prompted to enter the password for the Bitwarden service account you configured in step 1

Actions

• Create a new Action to Start a Program
• Program/script: C:\path\to\bwdc.exe (replace with the actual path to the executable)
• Add arguments: sync

Settings

• Allow the task to be run on demand -> Checked (enabled)
• Run task as soon as possible after a scheduled start is missed -> Checked (enabled)
• Stop the task if it runs longer than: Minimum (1 hour)
• If the running task does not end when requested, force it to stop -> Checked (enabled)
• If the task is already running, then the following rule applies: Do not start a new instance

Click OK and save the task.

Configure the Bitwarden Directory Connector to sync with AD
Now for the tricky part. I highly recommend you install the GUI version just for the purposes of setting the config file; we will use it later with the scheduled task we created.

4. Configure using the GUI version - I am assuming you know LDAP queries and how to do this properly as it's far too much to include here (GUI instructions are available in the Bitwarden docs and LDAP query syntax is available on your favourite search engine). Exit the tool.

5. The settings are stored in %appdata%\Bitwarden Directory Connector\data.json (e.g. C:\Users\evilsysadmin\AppData\Roaming). Copy the data.json file to the same location but under the bitwarden user profile e.g. C:\Users\bitwarden\AppData\Roaming\Bitwarden Directory Connector (if the user profile is not present, you may need to run the Scheduled Task once in order for it to be created - the task will hang, and you will need to manually stop it. This is normal for this stage).

6. Now we need to store the LDAP user credentials in Bitwarden:

• Temporarily add the Bitwarden service account to the local Administrators group on the server (this is to temporarily allow the account to logon locally)
• Open up a command prompt -> Run As -> launch the command prompt as the Bitwarden service user
• Run the following command: C:\path\to\bwdc.exe config ldap.password password (replace with the actual path to the executable, and replace password with the service account password)
• Run an initial sync to confirm that sync is working with the data.json settings you copied earlier

6. If everything was successful, you can exit the command prompt.
   REMEMBER TO REMOVE THE SERVICE ACCOUNT FROM LOCAL ADMINISTRATORS GROUP WHEN FINISHED!!!

7. Now we are ready to test the Scheduled Task. If all was done correctly, the task should run quickly and end after a few seconds with a 0x0 result signalling a successful run. Any other status code signals an error and likely means one of the earlier steps was missed.

PS - @kspearrin, I recommend updating the Bitwarden docs: the service account for LDAP does NOT require Admin rights on the domain, server or otherwise. This is a huge security issue and the Bitwarden docs should be updated to reflect that that only a user with read access to the directory e.g. a standard member of the built-in 'Domain Users' AD group is required

I hope this helps.

[bitwarden-bot]

Hi @SjamonDaal,
We're cleaning up our repositories in preparation for a major reorganization. Issues from last year will be marked as stale and closed after two weeks. If you still need help, simply clear the label and we'll look into it.
Thanks!

[Yggdrasil]

This is still a relevant issue for my company. It's 3 years old now. Please consider starting to work on it.

[dwbit]

Hi everyone! Since this is a change/feature request, the issue will be closed and discussion can continue on the Bitwarden Community Forums. We're also exploring the possibility of including directory connector within the Bitwarden experience instead of as a separate application.