mirror of
https://github.com/dani-garcia/vaultwarden.git
synced 2025-09-09 10:25:56 +03:00
* Add SSO functionality using OpenID Connect Co-authored-by: Pablo Ovelleiro Corral <mail@pablo.tools> Co-authored-by: Stuart Heap <sheap13@gmail.com> Co-authored-by: Alex Moore <skiepp@my-dockerfarm.cloud> Co-authored-by: Brian Munro <brian.alexander.munro@gmail.com> Co-authored-by: Jacques B. <timshel@github.com> * Improvements and error handling * Stop rolling device token * Add playwright tests * Activate PKCE by default * Ensure result order when searching for sso_user * add SSO_ALLOW_UNKNOWN_EMAIL_VERIFICATION * Toggle SSO button in scss * Base64 encode state before sending it to providers * Prevent disabled User from SSO login * Review fixes * Remove unused UserOrganization.invited_by_email * Split SsoUser::find_by_identifier_or_email * api::Accounts::verify_password add the policy even if it's ignored * Disable signups if SSO_ONLY is activated * Add verifiedDate to organizations::get_org_domain_sso_details * Review fixes * Remove OrganizationId guard from get_master_password_policy * Add wrapper type OIDCCode OIDCState OIDCIdentifier * Membership::confirm_user_invitations fix and tests * Allow set-password only if account is unitialized * Review fixes * Prevent accepting another user invitation * Log password change event on SSO account creation * Unify master password policy resolution * Upgrade openidconnect to 4.0.0 * Revert "Remove unused UserOrganization.invited_by_email" This reverts commit 548e19995e141314af98a10d170ea7371f02fab4. * Process org enrollment in accounts::post_set_password * Improve tests * Pass the claim invited_by_email in case it was not in db * Add Slack configuration hints * Fix playwright tests * Skip broken tests * Add sso identifier in admin user panel * Remove duplicate expiration check, add a log * Augment mobile refresh_token validity * Rauthy configuration hints * Fix playwright tests * Playwright upgrade and conf improvement * Playwright tests improvements * 2FA email and device creation change * Fix and improve Playwright tests * Minor improvements * Fix enforceOnLogin org policies * Run playwright sso tests against correct db * PKCE should now work with Zitadel * Playwright upgrade maildev to use MailBuffer.expect * Upgrades playwright tests deps * Check email_verified in id_token and user_info * Add sso verified endpoint for v2025.6.0 * Fix playwright tests * Create a separate sso_client * Upgrade openidconnect to 4.0.1 * Server settings for login fields toggle * Use only css for login fields * Fix playwright test * Review fix * More review fix * Perform same checks when setting kdf --------- Co-authored-by: Felix Eckhofer <felix@eckhofer.com> Co-authored-by: Pablo Ovelleiro Corral <mail@pablo.tools> Co-authored-by: Stuart Heap <sheap13@gmail.com> Co-authored-by: Alex Moore <skiepp@my-dockerfarm.cloud> Co-authored-by: Brian Munro <brian.alexander.munro@gmail.com> Co-authored-by: Jacques B. <timshel@github.com> Co-authored-by: Timshel <timshel@480s>
125 lines
3.2 KiB
YAML
125 lines
3.2 KiB
YAML
services:
|
|
VaultwardenPrebuild:
|
|
profiles: ["playwright", "vaultwarden"]
|
|
container_name: playwright_oidc_vaultwarden_prebuilt
|
|
image: playwright_oidc_vaultwarden_prebuilt
|
|
build:
|
|
context: ..
|
|
dockerfile: Dockerfile
|
|
entrypoint: /bin/bash
|
|
restart: "no"
|
|
|
|
Vaultwarden:
|
|
profiles: ["playwright", "vaultwarden"]
|
|
container_name: playwright_oidc_vaultwarden-${ENV:-dev}
|
|
image: playwright_oidc_vaultwarden-${ENV:-dev}
|
|
network_mode: "host"
|
|
build:
|
|
context: compose/warden
|
|
dockerfile: Dockerfile
|
|
args:
|
|
REPO_URL: ${PW_WV_REPO_URL:-}
|
|
COMMIT_HASH: ${PW_WV_COMMIT_HASH:-}
|
|
env_file: ${DC_ENV_FILE:-.env}
|
|
environment:
|
|
- DATABASE_URL
|
|
- I_REALLY_WANT_VOLATILE_STORAGE
|
|
- LOG_LEVEL
|
|
- LOGIN_RATELIMIT_MAX_BURST
|
|
- SMTP_HOST
|
|
- SMTP_FROM
|
|
- SMTP_DEBUG
|
|
- SSO_DEBUG_TOKENS
|
|
- SSO_FRONTEND
|
|
- SSO_ENABLED
|
|
- SSO_ONLY
|
|
restart: "no"
|
|
depends_on:
|
|
- VaultwardenPrebuild
|
|
|
|
Playwright:
|
|
profiles: ["playwright"]
|
|
container_name: playwright_oidc_playwright
|
|
image: playwright_oidc_playwright
|
|
network_mode: "host"
|
|
build:
|
|
context: .
|
|
dockerfile: compose/playwright/Dockerfile
|
|
environment:
|
|
- PW_WV_REPO_URL
|
|
- PW_WV_COMMIT_HASH
|
|
restart: "no"
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
- ..:/project
|
|
|
|
Mariadb:
|
|
profiles: ["playwright"]
|
|
container_name: playwright_mariadb
|
|
image: mariadb:11.2.4
|
|
env_file: test.env
|
|
healthcheck:
|
|
test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
|
|
start_period: 10s
|
|
interval: 10s
|
|
ports:
|
|
- ${MARIADB_PORT}:3306
|
|
|
|
Mysql:
|
|
profiles: ["playwright"]
|
|
container_name: playwright_mysql
|
|
image: mysql:8.4.1
|
|
env_file: test.env
|
|
healthcheck:
|
|
test: ["CMD", "mysqladmin" ,"ping", "-h", "localhost"]
|
|
start_period: 10s
|
|
interval: 10s
|
|
ports:
|
|
- ${MYSQL_PORT}:3306
|
|
|
|
Postgres:
|
|
profiles: ["playwright"]
|
|
container_name: playwright_postgres
|
|
image: postgres:16.3
|
|
env_file: test.env
|
|
healthcheck:
|
|
test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
|
|
start_period: 20s
|
|
interval: 30s
|
|
ports:
|
|
- ${POSTGRES_PORT}:5432
|
|
|
|
Maildev:
|
|
profiles: ["vaultwarden", "maildev"]
|
|
container_name: maildev
|
|
image: timshel/maildev:3.0.4
|
|
ports:
|
|
- ${SMTP_PORT}:1025
|
|
- 1080:1080
|
|
|
|
Keycloak:
|
|
profiles: ["keycloak", "vaultwarden"]
|
|
container_name: keycloak-${ENV:-dev}
|
|
image: quay.io/keycloak/keycloak:25.0.4
|
|
network_mode: "host"
|
|
command:
|
|
- start-dev
|
|
env_file: ${DC_ENV_FILE:-.env}
|
|
|
|
KeycloakSetup:
|
|
profiles: ["keycloak", "vaultwarden"]
|
|
container_name: keycloakSetup-${ENV:-dev}
|
|
image: keycloak_setup-${ENV:-dev}
|
|
build:
|
|
context: compose/keycloak
|
|
dockerfile: Dockerfile
|
|
args:
|
|
KEYCLOAK_VERSION: 25.0.4
|
|
JAVA_URL: https://download.java.net/java/GA/jdk21.0.2/f2283984656d49d69e91c558476027ac/13/GPL/openjdk-21.0.2_linux-x64_bin.tar.gz
|
|
JAVA_VERSION: 21.0.2
|
|
network_mode: "host"
|
|
depends_on:
|
|
- Keycloak
|
|
restart: "no"
|
|
env_file: ${DC_ENV_FILE:-.env}
|