Replies: 10 comments
|
I think it works as expected. So, if the user you are setting this for is a manger or higher, they will always get |
|
Hello, The manager should also be allowed to create new (sub)collections. |
Why don't you setup separate Organizations for each team? That way you could have the manager be Administrators for their team without them having access to other teams and they can also control who has access to what in their Organization.
It allows managers to create new collections yes and unless you give an manager access to all collections, they should only be able to change (and see) the collections they have been given full write access to (where |
|
Ok, then we'll probably go that way. One more question: The custom role implies that you can configure something, for example, could the right to create collections be restricted? |
We currently use the Custom role as a placeholder for the deprecated (i.e. removed) Manager role. We don't yet have support for custom permissions. If they were implemented we could probably also get rid of this hack (cf. #5219). |
|
I think I found the answer on this Bitwarden help page, but in a strange way: https://bitwarden.com/de-de/help/collection-management/#collection-management-settings “Collection management settings will be available for self-hosted Bitwarden servers in a subsequent release.” Is there any hope that you can take it over? |
|
In any case, thank you very much for your answers |
|
That has nothing to do with the way how Vaultwarden works right now. The main reason Vaultwarden works as currently is the case is because we were stuck on web-vault v2024.6.x which was very old. To support the newer web-vault we needed a way to either mimic the manager role in an easy way, or change everything regarding the whole custom roles which has a great impact and needs very good testing. That kind of change will take a much longer to fix, since we check on several places now if someone is a manger, admin or owner to be allowed to handle special endpoints. Switching to the more fine grained custom role needs careful testing and changing these permission checks. So, until someone (me or someone else) is going to start on that, this hackisch way of mimicking the old manager role will stay as-is. |
|
moving this as not planned right now to discussions Ideas. |
|
Thank you, we will rethink our plans and adapt them so that they work as well as possible with the implementation. |
Uh oh!
There was an error while loading. Please reload this page.
Vaultwarden Support String
Your environment (Generated via diagnostics page)
Config & Details (Generated via diagnostics page)
Show Config & Details
Environment settings which are overridden: DOMAIN, TRASH_AUTO_DELETE_DAYS, SIGNUPS_ALLOWED, ORG_CREATION_USERS, YUBICO_CLIENT_ID, YUBICO_SECRET_KEY, SMTP_HOST, SMTP_PORT, SMTP_FROM, SMTP_FROM_NAME
Config:
{ "_duo_akey": null, "_enable_duo": true, "_enable_email_2fa": true, "_enable_smtp": false, "_enable_yubico": true, "_icon_service_csp": "", "_icon_service_url": "", "_ip_header_enabled": true, "_max_note_size": 10000, "_smtp_img_src": "***:", "admin_ratelimit_max_burst": 3, "admin_ratelimit_seconds": 300, "admin_session_lifetime": 20, "admin_token": "***", "allowed_connect_src": "", "allowed_iframe_ancestors": "", "attachments_folder": "data/attachments", "auth_request_purge_schedule": "30 * * * * *", "authenticator_disable_time_drift": false, "data_folder": "data", "database_conn_init": "", "database_max_conns": 10, "database_timeout": 30, "database_url": "*****://*******************************************************************************************", "db_connection_retries": 15, "disable_2fa_remember": false, "disable_admin_token": false, "disable_icon_download": false, "domain": "*****://**********************************", "domain_origin": "*****://**********************************", "domain_path": "", "domain_set": true, "duo_context_purge_schedule": "30 * * * * *", "duo_host": null, "duo_ikey": null, "duo_skey": null, "duo_use_iframe": false, "email_2fa_auto_fallback": false, "email_2fa_enforce_on_verified_invite": false, "email_attempts_limit": 3, "email_change_allowed": true, "email_expiration_time": 600, "email_token_size": 6, "emergency_access_allowed": true, "emergency_notification_reminder_schedule": "0 3 * * * *", "emergency_request_timeout_schedule": "0 7 * * * *", "enable_db_wal": true, "enable_websocket": true, "enforce_single_org_with_reset_pw_policy": false, "event_cleanup_schedule": "0 10 0 * * *", "events_days_retain": 30, "experimental_client_feature_flags": "fido2-vault-credentials", "extended_logging": true, "helo_name": null, "hibp_api_key": null, "http_request_block_non_global_ips": true, "http_request_block_regex": null, "icon_blacklist_non_global_ips": true, "icon_blacklist_regex": null, "icon_cache_folder": "data/icon_cache", "icon_cache_negttl": 259200, "icon_cache_ttl": 2592000, "icon_download_timeout": 10, "icon_redirect_code": 302, "icon_service": "internal", "incomplete_2fa_schedule": "30 * * * * *", "incomplete_2fa_time_limit": 3, "increase_note_size_limit": false, "invitation_expiration_hours": 720, "invitation_org_name": "Vaultwarden", "invitations_allowed": true, "ip_header": "X-Real-IP", "job_poll_interval_ms": 30000, "log_file": null, "log_level": "info", "log_timestamp_format": "%Y-%m-%d %H:%M:%S.%3f", "login_ratelimit_max_burst": 10, "login_ratelimit_seconds": 60, "org_attachment_limit": null, "org_creation_users": "*****************************,******************************", "org_events_enabled": true, "org_groups_enabled": true, "password_hints_allowed": true, "password_iterations": 600000, "push_enabled": false, "push_identity_uri": "https://identity.bitwarden.com", "push_installation_id": "***", "push_installation_key": "***", "push_relay_uri": "https://push.bitwarden.com", "reload_templates": false, "require_device_email": false, "rsa_key_filename": "data/rsa_key", "send_purge_schedule": "0 5 * * * *", "sendmail_command": null, "sends_allowed": true, "sends_folder": "data/sends", "show_password_hint": false, "signups_allowed": false, "signups_domains_whitelist": "", "signups_verify": false, "signups_verify_resend_limit": 6, "signups_verify_resend_time": 3600, "smtp_accept_invalid_certs": false, "smtp_accept_invalid_hostnames": false, "smtp_auth_mechanism": null, "smtp_debug": false, "smtp_embed_images": true, "smtp_explicit_tls": null, "smtp_from": "*************************", "smtp_from_name": "Vaultwarden", "smtp_host": "", "smtp_password": null, "smtp_port": 25, "smtp_security": "starttls", "smtp_ssl": null, "smtp_timeout": 15, "smtp_username": null, "templates_folder": "data/templates", "tmp_folder": "data/tmp", "trash_auto_delete_days": 30, "trash_purge_schedule": "0 5 0 * * *", "use_sendmail": false, "use_syslog": false, "user_attachment_limit": null, "user_send_limit": null, "web_vault_enabled": true, "web_vault_folder": "web-vault/", "yubico_client_id": "105067", "yubico_secret_key": "***", "yubico_server": null }Vaultwarden Build Version
1.33.0
Deployment method
Official Container Image
Custom deployment method
No response
Reverse Proxy
Apache 2.4.62-1.el9_5.2
Host/Server Operating System
Linux
Operating System Version
AlmaLinux 9.5 (Teal Serval)
Clients
Web Vault
Client Version
v2025.1.1
Steps To Reproduce
Expected Result
It is expected that the “Can edit” right is still displayed for the user/group.
Actual Result
“Can manage” is written as permission.
If you check in another session with one of the users who is in the group whether they have the “Can manage” right, you will see that the desired “Can edit” right is active (so you cannot change anything in the collection information or access)
But if you click on “Save”, the user/group really gets the right “Can manage” - which can easily be overseen if, for example, you actually want to add a new group
Logs
Screenshots or Videos
[2025-01-29 15:45:11.280][request][INFO] GET /api/organizations/d09fb8b4-29e9-4cf8-af62-f92f7fc3d4bb/groups
[2025-01-29 15:45:11.281][request][INFO] GET /api/organizations/d09fb8b4-29e9-4cf8-af62-f92f7fc3d4bb/collections/details
[2025-01-29 15:45:11.282][request][INFO] GET /api/organizations/d09fb8b4-29e9-4cf8-af62-f92f7fc3d4bb/users/mini-details
[2025-01-29 15:45:11.287][response][INFO] (get_org_user_mini_details) GET /api/organizations/<org_id>/users/mini-details => 200 OK
[2025-01-29 15:45:11.288][response][INFO] (get_groups) GET /api/organizations/<org_id>/groups => 200 OK
[2025-01-29 15:45:11.304][response][INFO] (get_org_collections_details) GET /api/organizations/<org_id>/collections/details => 200 OK
[2025-01-29 15:45:19.574][request][INFO] PUT /api/organizations/d09fb8b4-29e9-4cf8-af62-f92f7fc3d4bb/collections/1b052b32-15ba-4767-8af2-7c48c533e780
[2025-01-29 15:45:19.608][response][INFO] (put_organization_collection_update) PUT /api/organizations/<org_id>/collections/<col_id> => 200 OK
[2025-01-29 15:45:29.974][request][INFO] GET /api/organizations/d09fb8b4-29e9-4cf8-af62-f92f7fc3d4bb/groups
[2025-01-29 15:45:29.978][response][INFO] (get_groups) GET /api/organizations/<org_id>/groups => 200 OK
[2025-01-29 15:45:30.013][request][INFO] GET /api/organizations/d09fb8b4-29e9-4cf8-af62-f92f7fc3d4bb/users/mini-details
[2025-01-29 15:45:30.017][response][INFO] (get_org_user_mini_details) GET /api/organizations/<org_id>/users/mini-details => 200 OK
[2025-01-29 15:45:30.051][request][INFO] GET /api/organizations/d09fb8b4-29e9-4cf8-af62-f92f7fc3d4bb/collections/details
[2025-01-29 15:45:30.074][response][INFO] (get_org_collections_details) GET /api/organizations/<org_id>/collections/details => 200 OK
[2025-01-29 15:45:34.031][request][INFO] PUT /api/organizations/d09fb8b4-29e9-4cf8-af62-f92f7fc3d4bb/collections/1b052b32-15ba-4767-8af2-7c48c533e780
[2025-01-29 15:45:34.061][response][INFO] (put_organization_collection_update) PUT /api/organizations/<org_id>/collections/<col_id> => 200 OK
No event log was found.
Additional Context
No response
All reactions