Evaluate Vaultwarden OIDC SSO (upstream support landed in 1.34) #122

New issue

Open

opened 2026-08-17 17:49:55 -04:00 by mysticalsoap · 0 comments

mysticalsoap commented

2026-08-17 17:49:55 -04:00

Owner

The OIDC exclusion reasoning in Auth-and-Security.md predates Vaultwarden shipping SSO: upstream added OpenID Connect support in 1.34.0 (2025, SSO_ENABLED, marked experimental at release). Master password still does vault decryption — SSO replaces authentication only, so this is the same enforcement-point move the other OIDC clients got, not a key-escrow change.

To evaluate before committing:

Current maturity/caveats in release notes (it was experimental at launch)
Mobile app + browser-extension login flows through the SSO path
Whether the Authelia-gated /admin arrangement changes
Client policy: one_factor friend-tier like RxResume/Lychee, or two_factor given what it protects

Exclusion lists go stale — this is the periodic re-verify.

The OIDC exclusion reasoning in Auth-and-Security.md predates Vaultwarden shipping SSO: upstream added OpenID Connect support in 1.34.0 (2025, `SSO_ENABLED`, marked experimental at release). Master password still does vault decryption — SSO replaces *authentication* only, so this is the same enforcement-point move the other OIDC clients got, not a key-escrow change. To evaluate before committing: - Current maturity/caveats in release notes (it was experimental at launch) - Mobile app + browser-extension login flows through the SSO path - Whether the Authelia-gated `/admin` arrangement changes - Client policy: `one_factor` friend-tier like RxResume/Lychee, or `two_factor` given what it protects Exclusion lists go stale — this is the periodic re-verify.

mysticalsoap added the

audit-work

label

2026-08-17 17:49:55 -04:00

mysticalsoap referenced this issue

2026-08-17 17:50:17 -04:00

Stack analysis: feature gaps and divergence from other homelabs #116