I’ve been spending quite a lot of time at this point trying to get a Vaultwarden setup with SSO via Authentik on NixOS.
I think I almost have it working but now the SSO login is asking for an SSO identifier (and on mobile, an “Organization ID”) which there is no mention of in the vaultwarden.env template.
There does seem to be documentation to set the SSO Identifier over on the bitwarden side of things but the vaultwarden admin interface seems to shares little in common with that documentation.
The exact screen I get on the extension sso sign in page is:
Single sign-on
To log in with your SSO provider, enter your organization's SSO identifier to begin. You may need to enter this SSO identifier when you log in from a new device.
But I’m just not sure what that means and what I should put there, my first impression was the SSO_CLIENT_ID, but that just responds with “An error has occured”
The relevant nix config is here:
{
pkgs,
lib,
config,
...
}:
let
cfg = config.modules.vaultwarden;
vaultHost = "bw.kan.sh";
authUrl = "https://auth.kan.sh/application/o/vaultwarden/";
in
{
options.modules.vaultwarden.enable = lib.mkEnableOption "Enable vaultwarden server";
config = lib.mkIf cfg.enable {
sops.secrets = {
"vaultwarden/admin_token" = {};
"vaultwarden/client_id" = {};
"vaultwarden/client_secret" = {};
};
services.vaultwarden = {
enable = true;
environmentFile = [
config.sops.secrets."vaultwarden/admin_token".path
config.sops.secrets."vaultwarden/client_id".path
config.sops.secrets."vaultwarden/client_secret".path
];
config = {
DOMAIN = "https://${vaultHost}";
SIGNUPS_ALLOWED = false;
ROCKET_ADDRESS = "127.0.0.1";
ROCKET_PORT = 8222;
# SSO
SSO_ENABLED = true;
SSO_ONLY = true;
SSO_ALLOW_UNKNOWN_EMAIL_VERIFICATION = true;
SSO_AUTHORITY = "${authUrl}";
SSO_AUTH_ONLY_NOT_SESSION = true;
};
};
environment.systemPackages = with pkgs; [ vaultwarden ];
services.nginx.virtualHosts."${vaultHost}" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://127.0.0.1:${toString config.services.vaultwarden.config.ROCKET_PORT}";
proxyWebsockets = true;
};
};
};
}
It should be noted that I haven’t done any configuration to vaultwarden outside of what’s written in the above nix file thus there is currently no working accounts on the instance. And that I’m using authentik-nix
Any help would be greatly appreciated!