unable to fully remove user from vaultwarden

[farfromrefug]

I have an issue with removing users in order to create them again (lost password).
After trying many times i realized the removed users were still in the sqlite datable under the user table.
I tried to remove them directly from the db but i cant because of constrains.

Any idea how to solve this?

Thanks

[stefan0xC]

Did you only remove the from the Admin Console (from your organization) or did you use the /admin panel to delete the user? Did you get an error message? (If the user is the last owner of an organization you'd have to delete that first.)

[farfromrefug]

@stefan0xC yes i used the admin console and no i did not try to use the admin panel yet. Had to recreate my docker so i tried first without doing it.
I found many references to the user_uuid under devices and other tables. After cleaning them i managed to remove the user from the users db. So now i think it can create the user again.
Shouldn't all those references be removed when we remove a user using the admin console?
BTW that 'bug' creates a very bad UX problem. If you removed a user and try to invite it again. The invite mail will be sent, if the user click on the link it will bring him to the login screen (after a redirect) without explaining the issue (account already existing in db though not present anywhere in the UX). It is very disturbing.

[vincentization]

yes this is actually an issue! A user in our organization forgot their password so I deleted that user in the admin console and sent them a new invite but they are unable to create a new password. If I understand it correctly there is currently no way to solve this without manually modifying the database and deleting the user there.

I wonder if thats just an oversight or if there are technical reasons why users aren't fully deleted. I assume this has something to do with the revoke feature

[BlackDex]

If you mean with Admin Console the interface of the organization it self, where you can manage members, then that is correct.

Users have an account on the server, not specifically an account within an organization. Removing a user from an organization doesn't remove their account from the server, as a user could be part of multiple organizations or have personal items etc...
Also, one could accidentally remove a user from an organization, which would mean a user needs to re-create their account fully.

So, no this isn't an oversight, this is just security.

If you want to remove a user fully from the system, you need to use the Vaultwarden Admin Backend where you can fully remove a user. If you then re-invite a user to the org they will be able to start from scratch.

So, use the right interface to do what you want to do.

[vincentization]

ok got it, that solved my problem - thanks for the info 👍🏻

In our case its still kind of unintuitive since we have the 'Single Organization' policy turned on as well as the one with data ownership. So all accounts are tied to that organization only and they can only create store passwords in that org. This is why the org admin felt like the last admin layer and I wasn't aware of the admin layer above that