Orgs, Collections, Groups: Recursive permission inheritance

Ask the Community Password Manager
, ,
1

Hello there!

Disclaimer beforehand: We, at my company, are using Vaultwarden as the self-hosted instance. So perhaps this may play into this, but also maybe not… So I wanted to get this out of the way first :slight_smile:

A while ago, an update to the Web-Vault was pushed that removed a checkbox in an org’s collection permission management that would denote that all subsequent collections would inherit those configured permissions. You can see a screenshot in the origin ticket here: Organisation Collection Permission · dani-garcia/vaultwarden · Discussion #5581 · GitHub

That checkbox was super useful, because when we later expanded our collections, subcollections and the like, the permission would be set. And… now it’s gone.

So, I want to ask what I can do here, or if you have an idea. Basically, our structure works a little something like this:

Org (representing a customer)
|- Category (Cloud, Server, Software, ...)
|  |- Sub-Category (Providers, Software-/Platform-Vendors, ...)

So while we may create a customer with a few default categories, we are likely going to extend the sub-categories over time - and now we have to do a lot of manual handywork to fix them up.

That said… I have no idea how bigger companies properly structure their BW instances. Obviously I have a hunch that it is not too far off from ours, but that the Directory Sync is used to take care of permission management - at least, to some degree.

Do you have any recommendation or ideas? We have around 30+ custojmers and lord knows how many collections… (I could check with some psql queries, but I already know its huge).

Thank you very much and kind regards!

2

There is a feature request topic here:

 

In the meantime, you can accomplish inheritance using a CLI-based script provided by Bitwarden:

 

There is also a third-party tool available (that is based on the Bitwarden script):

With any third-party tools, it is the user’s responsibility to do their due diligence to ensure that their vaults or vault data will not be put at risk by using the tool.

1 Like
3

Thank you for the pointers!

I actually tried to use the bitwarden_cli_toolkit, but unfortunately it is not compatible with 2FA, which we make heavy use of. Apparently, it also works with API keys, but I haven’t quite figured out where to generate those in the web-vault. Will look at this again though, there might be an option there.

Will keep a close eye on the FR - whilst we use collections currently, this might become useful down the line. Migration might suck, but I bet it could be scripted.

In the meantime, I’ll see if the admin scripts can help out. :slight_smile:

4

Have you tried these instructions?

1 Like