Impossible to register an account if the email address is already invited in an organization

[ghost]

Subject of the issue

Context : When an email address is invited in an organization but there his no account register with this email, it is not possible to create an account with this email anymore, even if there is no account registered.

Deployment environment

• vaultwarden version: Version 2.25.1

• Install method:
  Installed manually

• Clients used: web vault

• Other relevant details:

Steps to reproduce

Step 1 : Invite an email address in an organization with an email which isn't already used in a Vaultwarden account.
Step 2 : Try to register the account with the same email.

Expected behavior

It is possible to create an account even if there are already sent invitation for him and resent the organization email invitation after the creation.

Actual behavior

It is not possible to create an account even if there are already sent invitation for him.

[BlackDex]

Works fine for me.
Just as a note, if someone is invited via the organization manage tab, they need to click on the link which they received in the mailbox. That link contains a token which is validated. Without that token you are not allowed to create an account.

[EctoBoggan]

(Sorry for my english)
You also need to be careful if your mail service run phishing protection, this can change every link an e-mail could contain and the link might loose its token after that. I had this issue and after white-listing the domain it was ok.

[ghost]

Thank you for answer!

You are right, the email address receive an email with a link to create or connect to an account.

However, the fact that without this email, the account is locked and the creation of the account is forbidden. This is not convenient for us.

For example, we have some users who haven't an email address yet but the manager would like to invite them in an organization. That's means he has to wait or this will be locked the future user account.

It is also possible to abuse this feature in adding a lot of email into an organization, those emails will never be able to create an account or at least during 5 days if there is an expiration set for invitation.

[BlackDex]

You can always sent a re-invite if needed.
Having this fully open would be worse i think, since then everybody can just create an account without having it verified via an email.
Also, that link is needed to being able to join the organization, because that link is also the link which will let the user accept the invite to the organization, because before the user accepts the invite that user can't even be verified to join the organization at all.
The only way to disable this is to disable SMTP, which then only checks a table if there is a pending invite and allows the creation of an account.

I think safety comes before ease of use, which is the case here.
This is the same as for upstream which we try to keep as close as possible to.

[ghost]

I think I wasn't clear :/

I didn't say it shouldn't have an email verification before creating an account. I said, it should be possible to create an account normally, that means with the email verification, even if the email address used has already received an invitation.

Currently, if an email address has received an organization invitation, it is not possible to create an account with this email, even with the email verification.

I agree with all the process of adding user in an organization or the process of creation of an user. However, the fact is when an user is already invited, it is not possible anymore to create an account from the Webvault interface only with this email. The only way is that person has to clicked on the link in the email received when she was invited to the organization.

[BlackDex]

I think I wasn't clear :/

I didn't say it shouldn't have an email verification before creating an account. I said, it should be possible to create an account normally, that means with the email verification, even if the email address used has already received an invitation.

You can also choose to not send-out an invite, but let people always being able create new accounts if there mail address ends on a specific @domain.tld. That way everybody within the company can create there account by just clicking on register and follow the steps. BUT, then they will not be part of the organization, they still need a working invite link.

Currently, if an email address has received an organization invitation, it is not possible to create an account with this email, even with the email verification.

Well, that is what i tested, and it works as it should. The only time it will fail is if the token is expired. If that is the case, then a manager, admin or owner needs to send a re-invite for that user and the user needs to use the new link.

I agree with all the process of adding user in an organization or the process of creation of an user. However, the fact is when an user is already invited, it is not possible anymore to create an account from the Webvault interface only with this email. The only way is that person has to clicked on the link in the email received when she was invited to the organization.

Yes, indeed, the only way would be via that link. And that is how it should be, because, again, that link also triggers the accept for the organization invite which would not happen if you would not use that link and just register an account. Then the user should still be re-invited and they still need to click a link to accept the invite to the organization.

If you would bypass that during the register, then they will have an account, but are not linked to the organization, no way for anyone verify the account. So in any case, the user still needs to click on a link to be allowed into the organization. Better to have that user being sent a new invite with a new token which works in my opinion.