Connect with OIDC to Vaultwarden with DEX

Support apps
, , , ,
1

What app is this about, and its version: 1.36.0~ynh1
What YunoHost version are you running: 12.1.40.1 (stable)
What type of hardware are you using: Other(?)

Describe your issue

I’ve tried to connnect Vaultwarden to DEX but i am facing this issue :

IHM

SSO session binding mismatch for uh61XArdsQSSl0ErnjtFzeN2RbcQr2q28af5ZdZybDbkegGghn9hJygZHhDlw7F6_identifier=00000000-01DC-01DC-01DC-000000000000

Share relevant logs or error messages

Vault Logs :

[2026-06-16 14:23:01.367][vaultwarden::api::identity][ERROR] SSO session binding mismatch for eFJkmmvepE2PQLopGcmIpZBLj0Imd52Pz12TMQkfic5S7FJVORFuCCTel0joNIk7_identifier=00000000-01DC-01DC-01DC-000000000000
[2026-06-16 14:23:09.339][vaultwarden::api::identity][ERROR] SSO session binding mismatch for eFJkmmvepE2PQLopGcmIpZBLj0Imd52Pz12TMQkfic5S7FJVORFuCCTel0joNIk7_identifier=00000000-01DC-01DC-01DC-000000000000
[2026-06-16 14:23:09.339][vaultwarden::api::identity][ERROR] SSO session binding mismatch for eFJkmmvepE2PQLopGcmIpZBLj0Imd52Pz12TMQkfic5S7FJVORFuCCTel0joNIk7_identifier=00000000-01DC-01DC-01DC-000000000000
[2026-06-16 14:25:07.281][vaultwarden::api::identity][ERROR] SSO session binding mismatch for 1dUO1UpeeaXJTS0oNoxR0A6WApq4MbOppMy8AhuEOhKTVquqdSquYvftvWjZTDH3_identifier

Dex logs :

time=2026-06-16T14:32:36.872Z level=INFO msg=“shutdown now” err=“received signal terminated”
time=2026-06-16T14:32:37.145Z level=INFO msg=“Version info” dex_version=v2.43.1 go.version=go1.24.3 go.os=linux go.arch=amd64
time=2026-06-16T14:32:37.145Z level=INFO msg=“config issuer” issuer=https://sso.domain.fr/
time=2026-06-16T14:32:37.147Z level=INFO msg=“config storage” storage_type=sqlite3
time=2026-06-16T14:32:37.147Z level=INFO msg=“config static client” client_name=vaultwarden
time=2026-06-16T14:32:37.147Z level=INFO msg=“config connector” connector_id=ldap
time=2026-06-16T14:32:37.147Z level=INFO msg=“config skipping approval screen”
time=2026-06-16T14:32:37.148Z level=INFO msg=“config refresh tokens rotation” enabled=true
time=2026-06-16T14:32:37.150Z level=INFO msg=“listening on” server=http address=127.0.0.1:5556
time=2026-06-16T14:33:26.400Z level=INFO msg=“performing ldap search” connector.type=ldap connector.id=ldap base_dn=“ou=users,dc=yunohost,dc=org” scope=sub filter=“(&(objectClass=InetOrgPerson)(uid=eva))”
time=2026-06-16T14:33:26.401Z level=INFO msg=“username mapped to entry” connector.type=ldap connector.id=ldap username=eva user_dn=“uid=eva,ou=users,dc=yunohost,dc=org”

2

I’m in the same situation,

I would do that to simplify user identification but is it relevant to expose the same ynh user password access to full password list ? if ldap password is hacked all thirdparty passworwds will be exposed.
Am i wrong in my thought ?

1 Like
3

No you’re right.

BTW, a full OIDC will be better than a LDAP based user list IMHO but Yunohost started with LDAP so big breaking change