Allow SSO role mapping to add admin cookie #423

New Issue

MrUnknownDE · 2026-04-05T21:13:19+02:00

MrUnknownDE commented

2026-04-05 21:13:19 +02:00

Originally created by @Timshel on 8/9/2025

Add the ability to parse the IDToken and User Information endpoint response from an OIDC Provider to retrieve a role to grant access to Vaultwarden admin console. Support two roles: admin or user.

This feature is controlled by the following configuration:

SSO_ROLES_ENABLED: control if the mapping is done, default is false`.
SSO_ROLES_DEFAULT_TO_USER: do not block login in case of missing role, default is true.
SSO_ROLES_TOKEN_PATH=/resource_access/${SSO_CLIENT_ID}/roles: path to read roles in the ID Token or User Information response.

The role claim parsing is done using generic since the goal is to reuse it to parse Organization role claims (The idea is to have admin/user for Vaultwarden admin page access. And OrgOwner, OrgAdmin, OrgManager and OrgUser for user membership).

Replaced the FromRequest for Secure since it seemed simpler to just check if the DOMAIN start with https.

*Originally created by @Timshel on 8/9/2025* Add the ability to parse the `IDToken` and User Information endpoint response from an OIDC Provider to retrieve a `role` to grant access to Vaultwarden admin console. Support two roles: `admin` or `user`. This feature is controlled by the following configuration: - `SSO_ROLES_ENABLED: control if the mapping is done, default is `false`. - `SSO_ROLES_DEFAULT_TO_USER`: do not block login in case of missing role, default is `true`. - `SSO_ROLES_TOKEN_PATH=/resource_access/${SSO_CLIENT_ID}/roles`: path to read roles in the ID Token or User Information response. The role claim parsing is done using generic since the goal is to reuse it to parse Organization role claims (The idea is to have `admin`/`user` for Vaultwarden admin page access. And `OrgOwner`, `OrgAdmin`, `OrgManager` and `OrgUser` for user membership). Replaced the `FromRequest for Secure` since it seemed simpler to just check if the `DOMAIN` start with `https`.

Sign in to join this conversation.

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/vaultwarden#423