Account recovery policy requires single organisation policy in 1.30 and newer?

[louisfgr]

Since version 1.30, the "Account Recovery Administration" policy states that the "Single organisation" policy must be activated in order to use Account Recovery.
After some testing, this does not yet seem to be the case in Vaultwarden.

I know that Vaultwarden wants to stay as close to Bitwarden as possible, so I am asking if this will be implemented for Vaultwarden in the future?

I am afraid that this could break the setup of some users, especially since it was recommended to use organisations before group support was introduced (#1623)

For example, I now have a few organisations that I can't really migrate into one, but have some users who need to access several of them.
I also don't want to compromise on the account recovery option.

[BlackDex]

I do not know if this has any impact at all on the client side.
It could very well be that you can't enroll a user in multiple org's and have the password reset feature enabled.
Not sure what happens if you have that user enrolled in multiple orgs and try to reset the account from both orgs.

It could be that it will fail on the org which the user was first enrolled into, and works on the last one.
This because of keys generated.

It could also be that once resetted via org 1, it will not work anymore via org 2.

One could say, multiple orgs could still work, as long as the user is only in one org which has the password reset feature enabled.

But this is all theory, not tested at all.

[tessus]

I don't understand. According to the documentation, if a single organization policy is set, the user can only be part of one org. This means that if a user wants to have account recovery, they can only be part of that one org.

P.S.: TBH, it is a very annoying requirement. If I am part of a few orgs, it's basically impossible to use account recovery. Not an issue for me, since I don't use account recovery, but this certainly sucks for a lot of people...

[louisfgr]

I feel the same way about this requirement.
I understand that this makes sense for Bitwarden to increase security, as BlackDex mentioned:

It might be security, because this way i could invite someone to a new org which is part of an org i'm not a member of, reset that users password and login ;).

But in case of Vaultwarden I feel like this could break a lot of setups.

[louisfgr]

thanks for the quick reply.

Here is what I tested:
If I enroll a user in one org that has password reset enabled and single org policy disabled, everything works fine.
If I enroll a user in two orgs that have password reset enabled and single org policy disabled, everything works fine.
I can successfully initiate a password reset from both organisations.

This leads me to believe that the single org requirement for password reset is not currently enforced in Vaultwarden.

This is why I asked if this might be changed in the future and wanted to point out that this requirement could break some setups (especially due to the former alternative solution for groups in #1623).

[wrbbz]

Is there any option to turn on Account recovery administration via env vars? I could not find the option in .evn.template file

UPD: Nvm. Seems, like this env var (ENFORCE_SINGLE_ORG_WITH_RESET_PW_POLICY) should control both options. However, after enabeling it, there is no indication that these features were turned on. And there is no option to reset password for a user in an organization (vaultwarden 1.33.2 alpine image)

[BlackDex]

No you can't turn it on via env vars.
You need to enable it via the policies page in the web-vault.

That feature/env option only enforces that the single org policy is also enabled when trying to enable the pw reset policy.

[wrbbz]

Ok. Got it. Thank you

Are there any plans to add such an option?

[BlackDex]

No, not really. That could cause issues also having default policies set fixed.
It's up to the org owner to configure the policies needed.

[wrbbz]

Ok. Thank you