Repository navigation
[META] Feature Requests #246
Description
To avoid cluttering the issue tracker with feature requests, please comment any requests here and we'll keep a list.
When available, I've linked a related issue or comment to add context to the request.
Authentication
- Support official LDAP directory-connector. There also is a 3rd party connector.
- OAuth / SSO (Enable user SSO access using OAuth #94 and Push new docker image to support SSO #1134) (Some work is done in OIDC SSO Re: Issue #246 #1955 and OIDC SSO #2449 and Sso Support based off existing PR's #3154)
- Key-Connector support (Needs SSO) (Feature Request: key-connector for master-passwordless SSO #2583)
- Allow organizations to require 2FA for their members Organization Two-step Login #981 (Added via Two-step login organization policy enforcement - Resolves dani-garcia/bitwarden_rs#981 #1604)
- Allow authentication using a per user generated API-Key (Cannot create API Key - An unexpected error has occurred - 404 Not Found #1250) (Added via Add support for API keys #2245)
- Allow authentication using a per organization generated API-Key (Added via Implement the Organization API Key support for the new Directory Connector v2022 #3568)
- Add Emergency Access (https://bitwarden.com/help/article/emergency-access/)
- Add support for multiple account feature (Login session expired with account switching #2295) (https://bitwarden.com/help/account-switching/) (Added via Update login API code and update crates to fix CVE #2354)
- Send email on x amount invalid login attempts (https://vaultwarden.discourse.group/t/how-can-i-protect-my-vaultwarden-account-from-brute-force-attacks/3067) This could be abused as a DDoS, not sure if we want this.
- Allow login using PassKeys (Not as 2FA) (See Support log in and decrypt with passkeys #4250)
Database support
- Easy migration, from SQLite to other two options
- SQLite to MySQL - documented here: Migrating from SQLite to MySQL
- MySQL to PostgreSQL
- SQLite to PostgreSQL - Documented here: Migrating from SQLite to PostgreSQL
Admin page
- Allow disabling users so they can't log in, without deleting their data. (Added via Implement admin ability to enable/disable users #1247)
- 2FA support
- Hashed secret
- one-time-email login (a.k.a. Bitwarden style)
- Add option to remove 2FA devices from users (What happens if I lose my Yubikey? #431)
- Add option to set default cipher URL matching ([Feature Request] Allow pre-defining user settings and disabling some #432)
- Show more user info? (organizations and their user status in them, last connected date...)
- Show organizations per user
- Show the amount of attachments
- Show the amount of chipers
- Last login date (Added via Show last active it on admin users page #1245)
- Multiple other items
- Vaultwarden version info and update notification?
- Version information and updates can be found in the admin panel
/admin/diagnostics - Notifications about several items.
- Compare time of the server/host/container and the browser with NTP.
- Version information and updates can be found in the admin panel
- Keep changed settings in the form instead of reset them on input/submit error (See Unsaved Settings get discarded #4017)
Security
- Set a configurable limit for the 2FA remember token, upstream uses 30 days (Maybe use JWT?).
-
Lock accounts after X login failures, configurable.(Rate limiting is a better option, else this would give people with bad intentions the option to lock everybody out from the specific vault) - Rate limiting of API requests
Either by documentation using third party tools, firewall, reverse proxy etc.. Or maybe built in without to much hassel Add rate limiting to the API #723 - Rate limiting logins both admin and vault (Added via Basic ratelimit for user login (including 2FA) and admin login #2165)
- Do not run the container as root user (See Deployment vaultwarden (in cluster main) violates 'Process with UID 0' Policy #4358)
Docker images
- Debian based both ARM and AMD64
- SQLite
- MySQL
- PostgreSQL
- Multi Database
- Alpine based images (static/musl)
- SQLite
- MySQL (Added via Support all DB's for Alpine and Debian #2172)
- PostgreSQL (Added via Updated dependencies and Dockerfiles #1252 and Support all DB's for Alpine and Debian #2172)
Other
-
My Itemssupport as documented here https://bitwarden.com/blog/bring-complete-reporting-and-centralized-control-to-your-organization-vault/ (See: My items collection is not created when enabling Enforce organization ownership #6579 ) - Add XoAuth2 support to fetch the token from the SMTP Provider and refresh used by Google or Microsoft
- Verify database collation to prevent issues (See: Database migration to 1.17.0 fails on mariadb #1182 and Update to 1.17.0 fails - Bitwarden RS Mysql-Backend #1184)
- Batch all the bulk database operations in the same transaction (import ciphers, move selected ciphers, purge vault, etc.)
- Make email and U2F use the same domain-guessing used by attachments
- Groups support Support for groups #245 (NOTE (2022-12-15): This feature has some known issues! - Added via Group support | applied .diff #2846)
- Manager support (Added via Org managers can't create or manage collections #1136)
- Log rotation / management Question: Is the log file periodically deleted? #305
- Run Vaultwarden at suburl Run locally at suburl #241
- Audit log Audit Log #229 (Added via: Add Organizational event logging feature #2868 )
- Push notifications add support for push notifications on changes #126 (Added via feat: Implement Push Notifications sync #3304)
- Workaround: WebSockets provide notifications in web vault and browser extensions (maybe desktop app too?)
- Implement Recover and Delete:
- calls this endpoint
/api/accounts/delete-recoverwith{"email":"provided@email.address"}param - we need to generate email that will provide a link to delete the account with some token to verify email ownership
- Workaround: Delete user from admin panel and let them create new account
- calls this endpoint
- Add Custom Role support for granular control of user permissions (https://bitwarden.com/help/article/user-types-access-control/#custom-role)
- Add Personal Ownership support (https://bitwarden.com/help/article/policies/#personal-ownership) (Added via Add support for the Personal Ownership policy #1326)
- Add Organizational Admin Password Reset support (https://bitwarden.com/help/admin-reset/) (See: Enterprise Admin password reset #1820)
- Add Bitwarden Public API endpoints (https://bitwarden.com/help/public-api/) (Needs: Org API Key support)
(Partially added to support Bitwarden Directory Connector v2022.11.0) - Run WebSockets on the same port as HTTP (
third-partydepends on Rocket support) (See: Run websocket server on same port as other HTTP serving #685 / Run websocket server on same port as other HTTP serving #2917) (Added via WebSockets via Rocket's Upgrade connection #3404)
If anyone wants to help implementing these features, we are available here or on the matrix channel to help guide you as much as we can.
Activity
quthla commentedon Dec 22, 2018
What is needed for #241? Seems somebody already posted the needed changes in the corresponding issue so that could maybe be integrated?
dani-garcia commentedon Dec 22, 2018
Yes, someone would have to check those changes, see what can be integrated into the project directly (possibly a config option for the mount point) and create the documentation on how to configure the vault, proxy, etc.
mprasil commentedon Jan 15, 2019
@dpffxhad added it to the list
Peneheals commentedon Jan 16, 2019
It would be great to see an (admin) feature which can help sysops to test mailing functionality. Maybe somewhere a button which can send a test e-mail to the actual user's address and which gives back a fail/success message after the action.
mprasil commentedon Jan 16, 2019
Good idea @Peneheals, @njfox what do you think?
p-rintz commentedon Jan 16, 2019
Would it be possible to introduce 2FA auth to the /admin panel as well?
njfox commentedon Jan 16, 2019
I also think that's a good idea, and it shouldn't be too difficult to implement. I can look at adding the necessary API endpoints once I find some time, or knowing @dani-garcia he'll probably get to it first
dani-garcia commentedon Jan 16, 2019
About 2fa:
To do this, we'll need to implement it separately from the already existing 2fa code. I'm not sure if for this case it's worth it to implement multiple 2fa systems, so I would think just totp and maybe email would be good enough.
That said, this would require some changes to the admin page to input the 2fa code: we can't just ask for it at the start because it changes every 30 seconds .
Edit: About the email, as a workaround, you can invite yourself to test if it works for now, but it would be great to add
chinenual commentedon Feb 2, 2019
I am having trouble getting an Apache reverse-proxy to work in my organization. For various reasons, I can't create a new subdomain for bitwarden - i need to run it as https://my.proxy.domain/bitwarden forwarding to localhost running http on a non-standard port. However I cannot find a way to get Apache's mod_proxy to proxy from /bitwarden context to root context. For other applications I'm able to create proxies to as long as the target application uses a non-root context.
I.e. I want to do this:
https://my.proxy/bitwarden <-> http:/localhost:1234
I can get other apps to work if the internal app uses non-root context -- e.g.
https://my.proxy/acontext <-> http:/localhost:1234/anothercontext
Can bitwarden_rs be configured to listen to /bitwarden_rs or /bitwarden instead of / ? If not, can someone help in constructing apache mod_proxy / mod_rewrite rules to proxy the bitwarden_rs root context from a non-root proxy context?
mprasil commentedon Feb 2, 2019
@chinenual see #71. The TL/DR is that while bitwarden_rs doesn't mind serving from a sub path, client apps don't support that. There was some effort modifying the Vault code to allow this, but I haven't seen anyone reporting that they got it working.
234 remaining items
hellfish2 commentedon Oct 20, 2021
Please consider adding granular access
p3lim commentedon Oct 21, 2021
Please considering supporting the Admin Password Reset feature, including the organization policies for automatic (forceful) enrollment.
zocimek commentedon Oct 26, 2021
fyrak1s commentedon Nov 1, 2021
Hi, I would like to request a feature to support deduplication of password entries. This is the major pain point for me with vaultwarden.
I've imported passwords from many different browsers and sources and this has created a mess, in which I have every password duplicated about 5 times.
Also it is not easy to manually bulk delete or even compare entries. It is an impossible task for hundreds of passwords to review each entry manually and delete the dupes.
Other pw managers like lastpass do this automatically.
So far there are only workarounds to this problem e.g. https://hwrrobotics.com/2020/11/02/duplicate-password-remover-for-bitwarden/ or https://gist.github.com/giabao/f4c3de705f1d7f2c1fd0cde02e7b841d
And I am not even talking about deleteting/tyding up similar entries (which would be nice), but simply removing obvious 1:1 dupes.
BlackDex commentedon Nov 1, 2021
That is something for the clients. See https://community.bitwarden.com/t/duplicate-removal-tool-report/648
Luis-Lourenco commentedon Nov 7, 2021
romu70 commentedon Nov 11, 2021
Could you please add the wait-for-it script in the Dockerfile, to poll the availability of the DB? The current container stops when the DB is not available. It would be great if it could simply wait.
BlackDex commentedon Nov 11, 2021
@romu70 If you are using docker-compose you can configure it to have vaultwarden depend on the database container.
You can also configure the
DB_CONNECTION_RETRIESvariable to be increased, every retry is a second.Or you can add a script like that your self by following this: https://github.com/dani-garcia/vaultwarden/wiki/Starting-a-Container#customizing-container-startup
lzinga commentedon Nov 11, 2021
I use vault warden by myself and don't need any organizations, it would be nice to be able to disable organizations and have it remove the prompts for it -
As the only individual that will be using my locally hosted vault I will not be needing organizations any time soon and it would be nice to remove it from the interface.
p3lim commentedon Nov 11, 2021
@lzinga the web interface is not made by vaultwarden, it's the official one, vaultwarden simply includes it.
See https://github.com/bitwarden/web and https://github.com/dani-garcia/bw_web_builds
If you yourself want to hide it, use an extension like stylus.
LecrisUT commentedon Nov 30, 2021
First of all, could this issue be converted to a discussion so that the feature request discussions can be viewed as threads. This format is so unwieldy IMO.
Otherwise I have a feature request and design I would like to post for consideration:
One/Two-way sync with keepass using asymmetric encryption
Problem being solved
Securely synchronizing a user's selected passwords with a hosted keepass database. Primarily this helps with sharing passwords with users across these different infrastructures and offer the user a trusted backup plan.
Design
.kdbxshould be uploaded to, preferably via WebDAV or S3.Why the extra encryption?
Other issues it can help with
Depending on which part is being tackled, partial integration of this would help with:
BlackDex commentedon Nov 30, 2021
@LecrisUT there is a nice https://github.com/dani-garcia/vaultwarden/discussions/categories/ideas discussion categorie where you could have posted this of course.
Maybe locking this thread and pointing people to there is a good option. It was mostly intended to serve as a single location with an overview of all requests.
Regarding the post it self.
Vaultwarden does not encrypt or decrypt it self (except for jwt tokens or ssl connections). Adding that kind of a layer upon Vaultwarden would make it more harder to maintain. Also, we try to keep as close as possible to Bitwarden as we can, so I think these kind of requests are out of scope.
BlackDex commentedon Nov 30, 2021
This issue is getting a bit large, and since there are discussions available for a while I'm going to lock this topic.
The first post will still be updated when needed.
If there are any feature's you currently miss, and are not mentioned in the first post already, please create a new post with your idea/request here: https://github.com/dani-garcia/vaultwarden/discussions/categories/ideas .
Thanks for all your ideas and support!