Logout if a manager role user opens settings of an organisation #324

New issue

Closed

opened 2026-02-20 08:01:23 -05:00 by deekerman · 4 comments

deekerman commented

2026-02-20 08:01:23 -05:00

Owner

Originally created by @kaotika on GitHub (Jun 17, 2019).

I added a user to an organisation with user rights. I changed the users permissions to manager later. If the user tries to open the settings menu of the organisation, the user will be logged out with a session timed out message.

Logs (rustbacktrace=full)

[2019-06-17 09:29:43][rocket::rocket][INFO] GET /api/collections application/json:
[2019-06-17 09:29:43][_][INFO] Matched: GET /api/collections (get_user_collections)
[2019-06-17 09:29:43][_][INFO] Outcome: Success
[2019-06-17 09:29:43][_][INFO] Response succeeded.
[2019-06-17 09:29:44][rocket::rocket][INFO] GET /api/organizations/0211c99f-2947-470e-9408-16a619436234/collections/64abcfbf-5d84-4ce2-ac5e-3e26a2d5ebb9/details application/json:
[2019-06-17 09:29:44][_][INFO] Matched: GET /api/organizations/<org_id>/collections/<coll_id>/details (get_org_collection_detail)
[2019-06-17 09:29:44][bitwarden_rs::auth][ERROR] Unauthorized Error: You need to be Admin or Owner to call this endpoint
[2019-06-17 09:29:44][_][INFO] Outcome: Failure
[2019-06-17 09:29:44][_][WARN] Responding with 401 Unauthorized catcher.
[2019-06-17 09:29:44][_][INFO] Response succeeded.

Another related issue:

After relogin in the same window, the vault is greyed out completely and no ui element is usable. The page is operational after a reload.

Originally created by @kaotika on GitHub (Jun 17, 2019). I added a user to an organisation with `user` rights. I changed the users permissions to `manager` later. If the user tries to open the `settings` menu of the organisation, the user will be logged out with a `session timed out` message. Logs (`rustbacktrace=full`) ``` [2019-06-17 09:29:43][rocket::rocket][INFO] GET /api/collections application/json: [2019-06-17 09:29:43][_][INFO] Matched: GET /api/collections (get_user_collections) [2019-06-17 09:29:43][_][INFO] Outcome: Success [2019-06-17 09:29:43][_][INFO] Response succeeded. [2019-06-17 09:29:44][rocket::rocket][INFO] GET /api/organizations/0211c99f-2947-470e-9408-16a619436234/collections/64abcfbf-5d84-4ce2-ac5e-3e26a2d5ebb9/details application/json: [2019-06-17 09:29:44][_][INFO] Matched: GET /api/organizations/<org_id>/collections/<coll_id>/details (get_org_collection_detail) [2019-06-17 09:29:44][bitwarden_rs::auth][ERROR] Unauthorized Error: You need to be Admin or Owner to call this endpoint [2019-06-17 09:29:44][_][INFO] Outcome: Failure [2019-06-17 09:29:44][_][WARN] Responding with 401 Unauthorized catcher. [2019-06-17 09:29:44][_][INFO] Response succeeded. ``` Another related issue: After relogin in the same window, the vault is greyed out completely and no ui element is usable. The page is operational after a reload. ![image](https://user-images.githubusercontent.com/1773553/59594480-31985e80-90f4-11e9-8a0b-a1b5ff86bc72.png)

deekerman closed this issue

2026-02-20 08:01:24 -05:00

deekerman commented

2026-02-20 08:01:24 -05:00

Author

Owner

@mprasil commented on GitHub (Jun 17, 2019):

The "manager" permission level is not really supported in bitwarden_rs beyond very basic implementation that understands the order of privilege from user to owner. It is one of the feature requests in #246, but there isn't much traction as creating more organizations alleviates the need for more granular in-org permissions. (PR would be certainly welcome though)

As for the broken UI, it got unexpected reply from the server, this tends to break the UI in general. As you noted, reload does restore the functionality.

What did you try to accomplish with manager level? Maybe there's some other way to do the same or maybe there's some subset of the API that we can extend to support manager level of access.

@mprasil commented on GitHub (Jun 17, 2019): The "manager" permission level is not really supported in bitwarden_rs beyond very basic implementation that understands the order of privilege from `user` to `owner`. It is one of the feature requests in #246, but there isn't much traction as creating more organizations alleviates the need for more granular in-org permissions. (PR would be certainly welcome though) As for the broken UI, it got unexpected reply from the server, this tends to break the UI in general. As you noted, reload does restore the functionality. What did you try to accomplish with manager level? Maybe there's some other way to do the same or maybe there's some subset of the API that we can extend to support manager level of access.

deekerman commented

2026-02-20 08:01:24 -05:00

Author

Owner

@kaotika commented on GitHub (Jun 17, 2019):

Ok, makes sense. I clicked on the collection name.
Maybe it's easier to hide the elements, that are not usable until they are fully implemented.
I intend to use it for a small team ~10 persons max, and I don't see a need for the manager role.

@kaotika commented on GitHub (Jun 17, 2019): Ok, makes sense. I clicked on the collection name. Maybe it's easier to hide the elements, that are not usable until they are fully implemented. I intend to use it for a small team ~10 persons max, and I don't see a need for the `manager` role.

deekerman commented

2026-02-20 08:01:24 -05:00

Author

Owner

@mprasil commented on GitHub (Jun 17, 2019):

We can't just hide these parts, because they are valid for users with higher level of access. I think we need to improve some API responses to either not expose some info to managers or to implement collection managing functionality for manager.

@mprasil commented on GitHub (Jun 17, 2019): We can't just hide these parts, because they are valid for users with higher level of access. I think we need to improve some API responses to either not expose some info to managers or to implement collection managing functionality for manager.

deekerman commented

2026-02-20 08:01:24 -05:00

Author

Owner

@mprasil commented on GitHub (Nov 11, 2019):

I think we can close this one as the question was answered.

@mprasil commented on GitHub (Nov 11, 2019): I think we can close this one as the question was answered.