Feature Request: Hybrid Login & Sync with Bitwarden.com Account

[iwannet]

It would be great if Vaultwarden had a built-in feature to automatically sync a vault from an official bitwarden.com account.

The idea is to have a section in the Vaultwarden user settings where you can enter your bitwarden.com credentials. The Vaultwarden server would then use those credentials to periodically fetch your cloud vault and sync it (one-way) into your local Vaultwarden account.

This would all happen server-side, making it a "set it and forget it" feature.

Why?

• You get the best of both: Bitwarden's official service plus a local copy for offline use and control.
• It's the ultimate backup. If Bitwarden.com is down, I can still use my local vault.
• It guarantees offline access to my passwords.
• Makes having a local copy super easy, no more manual exports.

[stefan0xC]

That's not possible.

[iwannet]

Why? This guy made a working version: https://github.com/martadams89/bitwarden-sync
It would be nice if this could be neatly integrated into vaultwarden.

[kpfleming]

That does not do what you proposed. It does not 'allow you to log in to Vaultwarden with a bitwarden.com account'. That is the part of your proposal which @stefan0xC responded to as "not possible", because it is not possible.

That script logs into two Bitwarden or Bitwarden-compatible servers separately, extracts content from one and imports it into the other one. This doesn't require any support from the server at all, but it does require client-side functionality which does not exist in the server... so this can't be done in the server.

[iwannet]

Thanks for the feedback, @stefan0xC and @kpfleming . My apologies for the confusion, my initial proposal was not clear.

You are correct, a federated login is not what I'm suggesting.

I propose adding a new section in the Vaultwarden user settings. In this section, a user could optionally enter their bitwarden.com credentials.

1. The Vaultwarden server would then use these credentials to periodically log into the bitwarden.com service in the background, acting as a client.
2. It would download the vault from bitwarden.com.
3. It would then import/sync this data (one-way) into the user's local Vaultwarden account.

So, this would be a server-side sync feature, not a login mechanism. The goal is to automate the process of keeping a self-hosted Vaultwarden instance as an up-to-date mirror of an official cloud account, without needing to run a separate script like bitwarden-sync.

[kpfleming]

Thanks! I'd still prefer for this to not be in Vaultwarden itself, but in some companion tool which can access both vaults (wherever they live). Injecting client-side behavior into Vaultwarden would be a never-ending game of staying 'caught up' with the changes that Bitwarden makes in the client/server protocol. A companion tool which leverages the Bitwarden CLI (as the linked script does) avoids this problem.

[BlackDex]

Not going to happen from my point of view.
That would make your account at bitwarden.(com|eu) able to be compromised via Vaultwarden.
If someone somehow gains access to your Vaultwarden database, it can use the stored data to login to your Bitwarden hosted account.

Also, we do not want to make adjustments to the clients in any form, only the really needed changes to make the web-vault work with the Vaultwarden backend. So, adding new user settings for features like this is also not wanted.

If you want to use something like this, use the tool you found your self as an external tool.