Vaultwarden with Authenticated Admin Page

[rigid yacht]

To anyone trying to figure out how to authenticate the Admin page of Vaultwarden with Authentik but leave the Vault accessible publicly:

I have figured out which attributes to pass through the unauthenticated paths section for Vaultwarden.

To be clear, I have this setup as a Proxy Provider, not Forward Auth. I am also running Vaultwarden in Docker using the Vaultwarden/server image.

Your unauthenticated paths may differ if using the Official Bitwarden Server or a different version of Vaultwarden.

In the Vaultwarden Provider, input the following to allow public access to Vaultwarden Web but force authentication for Admin page.

^/#/.*$
^/#/login$
^/#/2fa$
^/api/.*$
^/images/.*$
^/identity/.*$
^/connectors/.*$
^/app/.*$
^/locales/.*$
^/notifications/.*$
^/icons/.*$
^/encrypt-worker.*.js
^/webauthn-connector.html
^/*.html
^/*.*.js
^/*.js
^/*.png$
^/*.jpg$
^/*.avif$
^/*.woff$

This has been updated to reflect my latest changes and finds.

[rigid yacht]

[Solved] Vaultwarden with Authenticated Admin Page

[ionic kestrel]

I'm glad you got yours to work, I'm still drilling away at mine. This is what I have and maybe I'm missing something?

I've included it my Outpost and when I try to access it on the same port as the Authentik URL (this is what I'm trying to set up so Authentik can work as a reverse proxy), I get a 502 error.

That's when I go to my public facing login page where a user would log in not the admin.

[twin minnow]

Personally, I expose the vault publicly, but I create another reverse proxy rule for /admin path with proxy provider set (with Traefik)

Works as deny list, not an allow list

[rigid yacht]

This is what works for me. Depending on the setup you have for Vaultwarden, it may differ.

What I did to figure this out was to pass through the whole app in Authentik with a / and then open an incognito window, navigate to the site I'm trying to pass through, right click the page somewhere and click Inspect, selected the Network tab, refreshed the page, and looked at where the URL was trying to go to find assets, and just passed through the ones I found. These are the paths that works for me, yours may differ, sorry I wasn't clear about that before.

@ionic kestrel I see that you have an Authentication flow attached to this, and that you don't have the Internal Host SSL Validation checked. These are the only difference I see in the screenshots from how I have mine setup. Since you blurred out the Internal IP address of the 1st screen shot, how is that setup? I assume it is pointing at your Vaultwarden Instance. For me it looks like http://192.168.1.10:8081

If you are using a self signed Cert for Vaultwarden to access it over HTTPS instead of HTTP, then I would uncheck the Internal Host SSL Validation.

This is what works for me.

[ionic kestrel]

Yeah, the reason for the blur is the internal IP was the Tailscale IP I'm using which is now considered publically accesible. I just added a new LXC to my Proxmox server and installed Vaultwarden on Port 80 so I won't be needing to run it behind Authentik now. But thanks for the info, just in case I need to do this again in the future (I plan not to in a very long time ) Don't we all!!!

[rigid yacht]

Vaultwarden with Authenticated Admin Page

So I found out that something broke with my Vaultwarden instance after an update but not sure when this exactly happened as I didn't really notice until logging into the vaultwarden web ui. But...now my instance doesn't want to show icons or load the web ui with the settings I have set above.

Does anyone else know of maybe a regex pattern that could be used. I dont know regex and have been trying some that I found or generated with AI, but no luck. Just need the /admin path protected while everything else is publicly accessible.

[edgy hornet]

i didnt know the admin path was public till now

well then..

[ionic kestrel]

You can disable the admin page via the .env file settings or the environment. All it does is modify the config.json in the /data folder (if I remember the path correctly), so you don't have to hand edit it. It's great though if you want to change a setting, but it's a set and forget type of admin page. When you need to modify something, just re-enable it and change things and disable it.

Disabling the admin page requires you to remove the admin_token variable from the environment.
https://vaultwarden.discourse.group/t/solved-disable-admin-interface/234

For me, my .env file only has that in there, so simply commenting it out won't work, so I renamed the .env and admin page no longer loads.

[rigid yacht]

Thanks for the reply. I have found this information but it is not what I am wanting. I want the admin page accessible without having to disable and re-enable it everytime I need to access it. I just want authentik to only protect the /admin path. Is this possible?

[ionic kestrel]

Pretty sure I've seen the code for this in this thread or in General for this. Not sure exactly when or where it was posted.

Maybe? #1189233378571063397 message

[rigid yacht]

I've tried this too, I also have some of those above in the strikethrough text, but for some reason when I pass these through, the main page loads but no icons do, even with the path for the assets passed through. It seems like there are assets that live in the root path and I can't seem to pass the root path through without giving access to the /admin path.

[rigid yacht]

Also without the root path passed through, webauthn doesn't work.

[ionic kestrel]

I've haven't put Vaultwarden behind Authentik in my case after all of the discussion these last few months. I just turned the admin page off until I need it again, I have dabbled with the Bitwarden SSO (From Bitwarden) and found that to be a bit more redundant than anything. The Vaultwarden OIDC being worked on, I tested a few weeks ago and it's making huge steps forward, but for my home, having it directly accessible without Authentik is more than enough for us. In short, my goal with this was to replicate what Psono does, single button OIDC Login but neither Bitwarden or Vaultwarden do that.

[slow flare]

Hit f12 , load vaultwarden and login , check all endpoints that load with code 302 and whitelist them on authentik

I landed up disabling the admin page as it landed up being way to many endpoints to bypass

[rigid yacht]

Thats what I did to try to fix this

I dont want to disable the admin page as for some reason it seems to break the site settings for me. And I also have a 128 character password for it but still

[slow flare]

I had this working with . ^/encrypt.* and ^/a bunch of numbers I can’t remember off hand.*

Once you get that working, if you try export and import the vault it uses another endpoint so you will need to bypass that too

[slow flare]

You don’t need to disable the admin page, you can bypass all the endpoints , however it lands up being a lot and this doesn’t guarantee it won’t break in a future update

I wish this had functionality similar to authelia. Where you can set vaultwarden.domain/admin behind authentication and bypass vaultwarden.domain makes life so much easier

[dapper owl]

Hi All 🙂
Has anyone managed to put Authentik infront of Vaultwarden login without breaking the app and extension functionalities?

[edgy hornet]

kinda, forced it to use sso to log in. but if anything it just acts like a multi factor

[dapper owl]

I thought Vaultwarden doesn't support SSO, how were you able to do that if you don't mind me asking?

[edgy hornet]

someone did there own pr

ghcr.io/timshel/vaultwarden this is what i used @dapper owl

https://github.com/Timshel/vaultwarden

[dapper owl]

Thanks for that link @edgy hornet , I think I might stick with the original build though.
Hopefully someone has managed to make it work as I don't understand why for example the edge extension works but the android client doesn't.

[slow flare]

I got this working perfectly with traefik

if you use traefik i can help

[rigid yacht]

i ended up having to pass through a bunch of endpoints.
This still leaves the Admin page behind Authentik, at least from my experience.
This is what I ended up coming up with, but these might differ from your needs, if you only use Authentik:

^/$
^/#/.*$
^/#/login$
^/#/2fa$
^/api/.*$
^/images/.*$
^/identity/.*$
^/connectors/.*$
^/app/.*$
^/locales/.*$
^/notifications/.*$
^/icons/.*$
^/encrypt-worker.*.js
^/webauthn-connector.html
^/*.html
^/*.*.js
^/*.js
^/*.png$
^/*.jpg$
^/*.avif$
^/*.woff$

[dapper owl]

I have the admin page blocked by default via Nginx Proxy Manager, do you think that having Vaultwarden open to the internet without Authentik infront of it is secure enough?