mirror of
https://github.com/dani-garcia/vaultwarden.git
synced 2026-03-02 22:57:18 -05:00
SSO: Authentik Refresh token not valid #2399
Labels
No labels
SSO
Third party
better for forum
bug
bug
documentation
duplicate
enhancement
future Vault
future Vault
future Vault
good first issue
help wanted
low priority
notes
question
troubleshooting
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/vaultwarden#2399
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @samclark2015 on GitHub (Sep 22, 2025).
Prerequisites
Vaultwarden Support String
Your environment (Generated via diagnostics page)
Config & Details (Generated via diagnostics page)
Show Config & Details
Environment settings which are overridden: DOMAIN, SIGNUPS_ALLOWED
Config:
Vaultwarden Build Version
1.34.3-a2ad1dc7
Deployment method
Official Container Image
Custom deployment method
No response
Reverse Proxy
traefik v3.1.2
Host/Server Operating System
Linux
Operating System Version
Ubuntu 25.04
Clients
Desktop, Browser Extension, Android
Client Version
Desktop - 2025.7.0, Firefox - 2025.8.2, Android - 2025.8.1
Steps To Reproduce
minutes=1minutes=15days=90Expected Result
Vaultwarden utilizes the refresh token provided by Authentik to keep session alive, exchanging after Access Token validity period for a new access token. User prompted for login after Refresh Token validity period.
Actual Result
User is prompted for SSO login anywhere from hours to a week after initial login.
Logs
Screenshots or Videos
No response
Additional Context
Using Authentik v2025.8.1, though appeared on earlier releases.
@Timshel commented on GitHub (Oct 21, 2025):
Hey,
Sorry missed your issue.
This usually happened when two
refresh_tokencalls are made at the same time.If you can still reproduce can you check if it's the case ?
@samclark2015 commented on GitHub (Oct 22, 2025):
Thanks! I enabled
SSO_AUTH_ONLY_NOT_SESSIONwhich resolved things. I'd behappy to disable and give some info, though.
What would be useful here? Authentik logs?
On Tue, Oct 21, 2025, 11:50 AM Timshel @.***> wrote:
@Timshel commented on GitHub (Oct 22, 2025):
More Vaultwarden server log before the issue is triggered might help :)
@samclark2015 commented on GitHub (Oct 22, 2025):
Just toggled that setting & will report back with logs when it happens.
@samclark2015 commented on GitHub (Oct 23, 2025):
Here is a longer log. Multiple clients authenticated in this span, so not sure how helpful this is to trace duplicate calls... Happy to provide any other info that would be useful!
@Timshel commented on GitHub (Oct 27, 2025):
Hey,
So it does not look like the use case I was speaking of, since it used to manifest with two almost simultaneous
POST /identity/connect/tokenwith only one of the two working.With a 90days refresh token validity I'm not sure what could be the source of the error :(.
Would you have a way to track in Authentik when the token was revoked ?
@controlaltnerd commented on GitHub (Nov 11, 2025):
I seem to be having a similar issue. In my case, I'm getting the error
[ERROR] Unable to refresh login credentials: Access token is close to expiration but we have no refresh token. I have access token expiration set to 10 minutes, and after I've logged in to Vaultwarden on either the web or through the Chrome extension, about 10 minutes later both will sign me out and the error will be logged.Refresh token lifespan is set to 30 days, and I am able to verify that the refresh token is actually being passed from Authentik to the web frontend so my best guess at the moment is that somehow the access token is being used in place of the refresh token, which would suggest Vaultwarden is attempting to authenticate again rather than refresh. I could eliminate session handling and restrict it to authentication only, but I'm unsure of what the result would be. Would the session just persist for the duration of the Authentik login session?
@0xmillennium commented on GitHub (Jan 20, 2026):
@Timshel You mentioned earlier that this
invalid_grantloop might be caused by two refresh_token calls happening at the same time. I am experiencing a specific issue with OIDC (Authelia) where the session is killed exactly at the 1-hour mark (access token expiration) due to a race condition in the refresh flow.Environment:
Server: Vaultwarden (Docker)
OIDC Provider: Authelia
Client: Bitwarden Browser Extension (Desktop/Mobile apps work fine)
Auth Method:
client_secret_basic(since Vaultwarden does not seem to supportclient_secret_postyet)The Issue:
I am encountering a session termination issue with the Bitwarden Browser Extension when using OIDC (Authelia). The logs confirm that the client is firing two identical refresh requests at the exact same millisecond.
\rightarrowToken B).invalid_grant).Logs:
Notice the timestamp 04:25:20.652. Two POST requests are initiated simultaneously.
Consistency & Impact: This issue happens every single time the token expiration is reached (100% reproducible). It is not an intermittent glitch.
Important Note: I do not want to use the workaround of setting extremely long Access Token lifespans (e.g. 30 days) to simply bypass the refresh loop. I aim to maintain secure, short-lived tokens with proper SSO management. Therefore, fixing this race condition/debounce issue is critical for my use case.
Is there a workaround to lock the refresh process or debounce these calls within Vaultwarden?
@Timshel commented on GitHub (Jan 28, 2026):
@0xmillennium Hey not sure why it's happening only with the browser extension. It should share the same code as the desktop/web app :(.
I contributed a fix (https://github.com/bitwarden/clients/pull/10799) last year which should prevent the issue :(.
I'll try to have a look to see if I can find something.
@faustlod commented on GitHub (Feb 9, 2026):
@faustlod commented on GitHub (Feb 9, 2026):
Could you show me your Docker Compose configuration settings for SSO, your Authentik configuration, and your Traefik middleware configuration? Unfortunately, SSO is not working for me at all:
Failed to discover OpenID provider: Request failed","validationErrors":{"":["Failed to discover OpenID provider: Request failed"]}," errorModel":{"message":"Failed to discover OpenID provider: Request failed","object":"error"},"error":"","error_description":"","exceptionMessage":null,"exceptionStackTrace":null,"innerExceptionMessage":null,"object":"error"}
Thank you!
@gelbphoenix commented on GitHub (Feb 10, 2026):
Have you set the
SSO_AUTHORITYto your specific authority URL? If the.well-known/openid-configurationpage is underhttps://application.company/oidc/.well-known/openid-configurationthen mustSSO_AUTHORITYbe set tohttps://application.company/oidc.@faustlod commented on GitHub (Feb 16, 2026):
Thank you for your comment!
Unfortunately, it still doesn't work. SSO_AUTHORITY was set, I use Authentik, so I set it up as follows:
OpenID Configuration in authentik: https://auth.mydomain.tld/application/o/vaultwarden/.well-known/openid-configuration
SSO_AUTHORITY: https://auth.mydomain.tld/application/o/vaultwarden/ (tried with and without the / at the end)
Unfortunately, the error still persists.
@ChristianKilmer commented on GitHub (Feb 18, 2026):
I just wanted to chime in to mention that I am also experiencing this exact same issue, but with Authelia. At least this confirms that the issue is in Vaultwarden and not related to an OIDC provider.
Here's a log dump, please let me know if you'd like to see this with debug-level logs or something and I'd be happy to provide.
@rharish101 commented on GitHub (Feb 18, 2026):
I'm facing the same issue as @0xmillennium, also with Authelia. My logs also show two identical calls for the refresh token made at the same time, which happen both with the desktop browser extension in Firefox and the Bitwarden app on Android.
@rharish101 commented on GitHub (Feb 19, 2026):
I added
SSO_AUTH_ONLY_NOT_SESSION=true, and it seems to work so far (just been 1 day since the addition of this env var) on my Android device with Bitwarden from Google Play. However, the Bitwarden extension on Firefox desktop (Linux) ALWAYS stops working after I close and reopen the browser.EDIT: Here's my Vaultwarden config:
And here's my Authelia config for Vaultwarden (in Nix format):