About Trusted Devices
SSO with trusted devices allows users to authenticate using SSO and decrypt their vault using a device-stored encryption key, eliminating the need to enter a master password. Trusted devices must either be registered in advance of the login attempt, or approved through a few different methods.
SSO with trusted devices gives business end users a passwordless experience that is also zero-knowledge and end-to-end encrypted. This prevents users from getting locked out due to forgotten master passwords and allows them to enjoy a streamlined login experience.
Start using trusted devices
To get started using SSO with trusted devices:
Setup SSO with trusted devices for your organization.
Provide administrators with information on how to approve device requests.
Provide end-users with information on how to add trusted devices.
How it works
The following tabs describe encryption processes and key exchanges that occur during different trusted devices procedures:
När en ny användare går med i en organisation skapas en kontoåterställningsnyckel (läs mer) genom att kryptera deras kontokrypteringsnyckel med organisationens offentliga nyckel. Kontoåterställning krävs för att aktivera SSO med betrodda enheter.
Användaren tillfrågas sedan om de vill komma ihåg, eller lita på, enheten. När de väljer att göra det:
En ny enhetsnyckel genereras av klienten. Denna nyckel lämnar aldrig klienten.
Ett nytt RSA-nyckelpar, kallat Device Private Key och Device Public Key, genereras av klienten.
Användarens kontokrypteringsnyckel krypteras med den okrypterade enhetens publika nyckel och det resulterande värdet skickas till servern som den offentliga nyckelkrypterade användarnyckeln.
Den offentliga enhetens nyckel krypteras med användarens kontokrypteringsnyckel och det resulterande värdet skickas till servern som den användarnyckelkrypterade publika nyckeln.
Enhetens privata nyckel krypteras med den första enhetsnyckeln och det resulterande värdet skickas till servern som den enhetsnyckelkrypterade privata nyckeln.
Den offentliga nyckel-krypterade användarnyckeln och enhetsnyckel-krypterade privata nyckel kommer, avgörande, att skickas från server till klient när en inloggning initieras.
Den användarnyckel-krypterade publika nyckeln kommer att användas om användaren behöver rotera sin kontokrypteringsnyckel.
Keys used for trusted devices
This table provides more information about each key used in the procedures described above:
Key | Details |
|---|---|
Device Key | AES-256 CBC HMAC SHA-256, 512 bits in length (256 bits for key, 256 bits for HMAC) |
Device Private Key & Device Public Key | RSA-2048 OAEP SHA1, 2048 bits in length |
Public Key-Encrypted User Key | RSA-2048 OAEP SHA1 |
User Key-Encrypted Public Key | AES-256 CBC HMAC SHA-256 |
Device Key-Encrypted Private Key | AES-256 CBC HMAC SHA-256 |
Impact on master passwords
While SSO with trusted devices eliminates the need for a master password, it doesn't in all cases eliminate the master password itself:
If a user is onboarded before SSO with trusted devices is activated, their account will retain its master password.
If a user is onboarded after SSO with trusted devices is activated and they select Log in → Enterprise SSO from the organization invite for JIT provisioning, their account will not have a master password. Should you change to the master password member decryption option, these users will be prompted to create a master password when they log in as long as they are still a member of the organization (learn more).
warning
För de konton som inte har huvudlösenord som ett resultat av SSO med betrodda enheter, avbryts all åtkomst till deras Bitwarden-konto om du tar bort dem från din organisation om:
Du tilldelar dem ett huvudlösenord med kontoåterställning i förväg.
Användaren loggar in minst en gång efter kontoåterställning för att fullständigt slutföra arbetsflödet för kontoåterställning.
Dessutom kommer användare inte att kunna gå med i din organisation igen om inte ovanstående steg vidtas innan de tas bort från organisationen. I det här scenariot kommer användaren att behöva ta bort sitt konto och få en ny inbjudan att skapa ett konto och gå med i din organisation.
Att återkalla åtkomst till organisationen, men inte ta bort dem från organisationen, kommer fortfarande att tillåta dem att logga in på Bitwarden och bara komma åt sitt individuella valv.
If a user account is recovered using account recovery, their account will necessarily be assigned a master password. A master password cannot currently be removed from an account once it has one, so to avoid this outcome we recommend that you (i) instruct the user to export their data to a backup, (ii) completely delete the lost account, (iii) ask the user to re-onboard to your organization using trusted devices and (iv) once they've done so instruct them to import their backup.
Impact on other features
Depending on whether a master password hash is available in memory for your client, which is dictated by how your client application is initially accessed, it may exhibit the following behavior changes:
Feature | Impact |
|---|---|
Verification | There are a number of features in Bitwarden client applications that ordinarily require entry of a master password in order to be used, including exporting vault data, changing two-step login settings, retrieving API keys, and more. If the user doesn't use a master password to access the client, all these features will replace master password confirmation with email-based TOTP verification. |
Vault lock/unlock | Under ordinary circumstances, a locked vault can be unlocked using a master password. If the user doesn't use a master password to access the client, locked client applications can only be unlocked with a PIN or with biometrics. If neither PIN nor biometrics are enabled for a client application, the vault will always log out instead of lock. Unlocking and logging in will always require an internet connection. |
Master password re-prompt | If the user does not unlock their vault with a master password, master password re-prompt will be disabled. |
Changing email address | Users who do not have master passwords will not be able to change their email address. |
CLI | Users who do not have master passwords will not be able to access Password Manager CLI. |