Cannot save new login if personal ownership is disabled iOS Native app

[Gerardv514]

@BlackDex @stefan0xC question, Bitwarden had a bug for a long time where a site couldn't be saved using an iOS device, share sheet from browser when on a website. At the time we just saw a spinning wheel and it wouldn't do anything. As per issue bitwarden/mobile#1874 Bitwarden is stating it has been resolved in the new native apps. As per pull request bitwarden/mobile#3265 it is still open (unless this is for the old apps - I'm a bit confused on what they did).

Is this something I would have to wait for Vaultwarden to bring in or is this strictly a client issue and should be working as they stated they have resolved in native apps? I tested this in native app and although it doesn't spin anymore, I now see a message stating an organizational policy is preventing you from saving items to your personal vault (on ios when adding an item thru browser using the share sheet and selecting bitwarden app).

[stefan0xC]

I'm not sure what they did either. Have you tested the new native app (which is currently in an open beta) if the issue still occurs?

[Gerardv514]

I did, I mentioned it in the post above of what I’m seeing now: “ I tested this in native app and although it doesn't spin anymore, I now see a message stating an organizational policy is preventing you from saving items to your personal vault (on ios when adding an item thru browser using the share sheet and selecting bitwarden app).”

The spin is gone but I cannot save because it thinks I’m saving to personal vault even though we have personal ownership disabled.

So just trying to figure out if it’s something still on their end (that isn’t fixed or is still being worked on) or would changes have to be applied too on VW to get this to fully work.

[stefan0xC]

Which vaultwarden version are you using? testing or latest release?

[Gerardv514]

Latest

[stefan0xC]

Can you try with testing (just to make sure it's still a thing and not something that was caused by us, e.g. #4726).

Also from your description, I'm not sure what the issue exactly is. Can you maybe add screenshots and possibly logs? (If there are no server-side logs I'm afraid it will be a bit hard to find the issue or rather I'd suspect that the issue is caused client-side.)

[Gerardv514]

The issue exists even with testing.

Here is the workflow:

1. Organization with "single Organization" and "remove individual vault" on. (I believe this issue more pertains to the remove individual vault policy though.)
2. Create a user (with user role) of an organization. I have assigned two collections to this user.
3. Using iOS iPhone with the native app installed.
4. Navigate to any website that has login fields, using a mobile browser such as Safari on the iPhone.
5. When on the login screen click the share sheet (square icon with the up arrow).
6. Find the bitwarden app in the list, the native app is listed as "Autofill with Bitwarden"
7. This will bring up login items, since this is a new site and we want to add to Bitwarden click the add + to add as a new item.
8. You'll see add item screen, with banner at top "An organization policy is affecting your ownership options" this is due to policy (no issue with this)
9. Scroll to the bottom, you'll see "Who owns this item?" which should be the organization.
10. Choose a collection to save to
11. Click save
    11a. Previously on the standard Bitwarden app when clicking save you would just get a spinning circle and nothing happens; this is
    what they were fixing
    11b. Bitwarden mentioned in the issue that this issue was resolved in the native app.
12. In the native app when we hit save we receive an error has occurred. "Due to an Enterprise Policy, you are restricted from saving items to your personal vault."

We shouldn't get this error because we have remove individual (personal) vault ownership policy on. Furthermore, we can see the organization is the one that is owning this item.

I just also tested, opening up the native app and trying to add an item from there and I get the same error. So although bitwarden fixed the constant spinning circle, this second issue maybe a VW thing, maybe the code just hasn't come downstream yet? idk

[stefan0xC]

Ooh. That's bad. Sounds like this issue another user has reported. @BlackDex maybe we should warn users about using the beta apps (at least with iOS)?

[Gerardv514]

Agreed. Vault items no longer appear even in web vault, I just have a spinning circle. This is just a test container so I’m not worried about it. If I can help dig out anymore information for you guys I’d be happy to, just keep in mind all the backend stuff is a bit over my head. I’m also away until Thursday ish, so only have access thru my phone.

[BlackDex]

And this does not happen on the Bitwarden Cloud instance?
Or you do not know this?

Also, not sure how to warn all the people using the beta. It's called a beta for a reason of course. But this is nasty.

We should check if this is a Vaultwarden specific item or only client.

[Gerardv514]

I do not know this for sure since I don’t have access to enterprise cloud, but as per bitwarden they are able to save and edit vault items with that policy on and using the native app. This is going by the video screenshot they posted in the git issue that was originally created (referenced earlier in this thread).

[Gerardv514]

I was able to restore using a snapshot.

Aside from having the original issue, which is with my organizational policy on where users individual vault is removed, I am going to try and break this again and see if I can reproduce.

It happened when trying to add an item or edit an item and/or when/after I took off that organization policy. From the iOS app I am not able to save or edit anything.

[Gerardv514]

Ok here’s how to reproduce. It seems like the issue just happened when I created a new vault entry on iOS native app using the admin user and saving it to the organization, which worked. Keep in mind my regular user I was not able to save any items with because of the error stating due to org policy I cannot save to personal vault. After the admin saves that vault item I received that cryptography error in that admin vault.

When this happened the first time I used the user account. I had turned off the policy “remove individual vault” then went back to the iOS native to the user account, and created a new entry. I recall coming to here to state that turning off that policy worked, meaning now I was able to save the entry using the iOS native app, but retracted because I received that cryptographic error.

[Gerardv514]

And just confirmed again, I went to the owner account of the org, turned off the remove individual vault policy. Then switch to iOS native app to user account with user role and created a new item in iOS native app. I did not receive an error on save but immediately after I received the cryptography error. Both of the broken vaults now no longer have access to any items in the vault.

[stefan0xC]

Thanks for testing @jedhamzawi. I've added a PR #4800 that should prevent such corruptions from occurring.

Regarding your third question: I don't think there's a way for us to fix corrupted entries because the organization_id is missing from the entries (making it rather impossible to somehow guess the right organization). Adding the organization id manually into the ciphers table might be enough to fix the issue but like you guessed it's not obvious which id is the correct one so it's probably better to just remove the offending entry and add it again.

[11jwolfe2]

So I encountered this issue today. Assuming I have not updated anything else in my vault would it be as easy as adding in the org_id to the cipher last updated in my db?

[stefan0xC]

@11jwolfe2 I have not tested it but I think it should be sufficient if you also know the correct organization_id.

[ibaivalencia]

Thanks for testing @jedhamzawi. I've added a PR #4800 that should prevent such corruptions from occurring.

Regarding your third question: I don't think there's a way for us to fix corrupted entries because the organization_id is missing from the entries (making it rather impossible to somehow guess the right organization). Adding the organization id manually into the ciphers table might be enough to fix the issue but like you guessed it's not obvious which id is the correct one so it's probably better to just remove the offending entry and add it again.

Hi!
Sorry, I'm new with vaultwarden and I'm suffering from this bug. Can you point how to remove that last item I added to my vaultwarden to recover the functionality of my vault which is... currently dead? :-(

Many thanks!

[ibaivalencia]

Thanks for testing @jedhamzawi. I've added a PR #4800 that should prevent such corruptions from occurring.
Regarding your third question: I don't think there's a way for us to fix corrupted entries because the organization_id is missing from the entries (making it rather impossible to somehow guess the right organization). Adding the organization id manually into the ciphers table might be enough to fix the issue but like you guessed it's not obvious which id is the correct one so it's probably better to just remove the offending entry and add it again.

Hi! Sorry, I'm new with vaultwarden and I'm suffering from this bug. Can you point how to remove that last item I added to my vaultwarden to recover the functionality of my vault which is... currently dead? :-(

Many thanks!

Already have the answer to my question.
Open the sqlite database with sudo to gain write rights:
sudo sqlite3 db.sqlite3
Query the last created item:
SELECT uuid, created_at, updated_at from ciphers order by created_at asc limit 1;
Remove the last item, getting the id:
DELETE from ciphers where uuid='2c7a4bb5-0100-46ba-9a73-35c13aa4b347';

My vaultwarden is back again!