Single sign-on for Vaultwarden

1. 1

   Register Vaultwarden in Casdoor

   In the Casdoor console, open Applications, add an application for Vaultwarden, and on its OIDC/OAuth tab copy the Client ID and Client secret. Add this redirect URL to Redirect URLs:

   • https://vault.example.com/identity/connect/oidc-signin
2. 2

   Configure Vaultwarden

   Set these environment variables on Vaultwarden 1.35.0 or later, for example in Docker Compose, and restart it. Vaultwarden builds the redirect URI from DOMAIN.

   services:
     vaultwarden:
       image: vaultwarden/server:latest
       environment:
         DOMAIN: "https://vault.example.com"
         SSO_ENABLED: "true"
         SSO_AUTHORITY: "https://auth.example.com"
         SSO_CLIENT_ID: "<client ID>"
         SSO_CLIENT_SECRET: "<client secret>"
         SSO_SCOPES: "email profile"
         SSO_PKCE: "true"

3. 3

   Sign in

   Users can now choose single sign-on on the Vaultwarden login page, sign in at Casdoor, and then unlock their vault. Add SSO_ONLY: "true" once everyone has switched, to turn off email-and-password login.

Vaultwarden settings are from its documentation as of October 2026 (Vaultwarden SSO wiki, Vaultwarden releases). Vaultwarden is a trademark of its owner.