Permission inheritance on nested collection

[MaxiStarling56]

Would it be possible to implement permission inheritance an nested collections?
I still don't understand why it isn't implemented in Bitwarden, it would be THE most usefull feature.

[BlackDex]

In what sense? That when using main_collection/sub_collection sub_collection has the exact same rights as main?

It clearly states in the documentation of Bitwarden that nesting is for display purposes only and that all collections, nested or not are handled as separate collections with there own access policies.

https://bitwarden.com/help/about-collections/#nested-collections

[BlackDex]

Also, i want to make clear that on the server side we do not know if a collection is nested or not.
Same btw for folders, we do not receive the the collection (and folder) names in plain-text, and thus are not able to see if there is a / located in the name.

[deajan]

I have a usecase where I would indeed need collection permissions inheritance.
As far as I could understand, this isn't technically possible, altough bitwarden announced it since a couple of years but didn't implement it yet.

Anyway, I have collection structure like:

• CUSTOMERS
  • CUSTOMER1
  • CUSTOMER2
  • ...
  • CUSTOMER500
• ADMIN
  • CUSTOMER1
  • CUSTOMER2
  • ...
  • CUSTOMER500

I don't really want foreach CUSTOMER1 to CUSTOMER500 assign user/group permissions.
Is there anything that can be used to overcome that limitation ? I just cannot imagine having to change permisssions everytime a customer is added, on top of the initial work burden.

Best regards.

[julianullrich99]

I would also appreciate this feature!

[RiekertKBW]

I would really like this feature too.
Otherwise, I have to manage the access to the Main Collections with separate Organizations. But that's more a Workaround than how it should be.

There could be a checkbox in the User-Management like "Inherit all Sub-Collections"

[BlackDex]

That would be needed to be added client side and some link between them.
Again, as mentioned earlier, the server doesn't know if collections are related/sub-collections at all.

So, there is no way on the server side to detect this and act upon it.

[RiekertKBW]

Well.. but how do you have the choice of nesting a Collection under another Collection, if they "don't know eachother"?

[BlackDex]

It works by using the / as a separator. The same as for folders.
Once decrypted the clients nest them.

[deajan]

@RiekertKBW You should open a ticket at bitwarden. Vaultwarden needs to be API compatible with bitwarden, so as long as they don't implement it, vaultwarden can't neither I suspect. See the link I posted above where they promise this for years.

[mdowais]

Sad to see that the request is not addressed by bitwarden.

I do recognize that unless bitwarden implements such a method it would not be possible. But I have an idea about this,

What if we add a new mechanism example, "auto inherit permission" to all existing and newly created collections.

When a new nested collection is created, and if first of any of the parent collection has inheritance rule set, then add the same rule to the newly created collection.

This would be a server level implementation, but this setting can only be configured in the vault-warden web application, as none of the official bitwarden clients would have this.

The Implmentation would be as

New Collection Created (Event Triggered) -> Get First Parent Collection with Inherit Policy -> Get ACL from parent (Read, Read except Password, Edit, Edit except Password) -> apply same acl to the new collection.

Please let me know if this is doable? or am i missing something @BlackDex

[BlackDex]

This isn't possible. The server doesn't know if it is a nested collection or folder. Those names are send fully encrypted. So we are unable to determine if any of those items are nested to any other.

[mdowais]

Owh, Could it be possible to do the same at the client side?

As in if an Owner/Admin creates a collection, then perform necessary operations.?

[BlackDex]

This project does not maintain the clients, so no from our side.

[mdowais]

Thanks for the replies, much appreciated!

[deajan]

Bitwarden didn't implement this since 2018 and probably won't for inheritance leak questions (as far as I read on unofficial statements).

We have a "cheap" solution which does inheritance manually, but has to be run on every collection creation.
See https://github.com/bitwarden-labs/admin-scripts/blob/main/Bash%20Scripts/inheritparentpermissions.sh

[deajan]

Wrote a GUI implementation of above cheap implementation, see #5581 (comment)

It's still cheap of course, but it's less painful than modding a script everytime.

[Schnatterowski]

AFAIK collections are the only way to structure entries on the org level, as folders are not available. I don't necessarily need permission inheritance, but I would like to know how to organize entries in a big collection. If I use collections to structure/group the entries, I have to repeat the permission config on every collection I create, which is not what I want to do of course.

So I hope there is another way of doing it. I have a collection CUSTOMERS, all of our support team should have read access to it. It contains credentials of around 50 customers, they were organized in folders when we used KeePass2. On import into Vaultwarden, collections were created for the folders, now I have around 300 sub-collections that I would need to maintain the access permissions for.

I need some way of organizing the entries in this CUSTOMERS collection. Sub-collections are not the way to go apparently, and folders are not available. Having all ~600 entries in flat 1-level structure is not an option either. What should I do?

What is the recommended solution for such a situation?

Thank you very much.

[owirtifo]

It would be convenient to have a Select all button to be able to select all collections from the list:

[BlackDex]

I would suggest to suggest this at Bitwarden. This project doesn't develop the web-vault, and will not add new or different features on the web-vault.