Create a user account

Two alternatives, depending on the user’s autonomy :

• Non-technical (new to computers): ask them as little as possible.
• Technical (used to computer tools): they define their own access.

Three account types

Type	Declaration	Access
Linux	config.yaml	Linux machines (posix), services and vault, Matrix
Services	Vaultwarden, Kanidm	services and vault, Matrix
Matrix friend	Matrix token	Matrix only

Choosing an alternative

Secret	Non-technical user	Technical user
Linux session	Set by the admin	Entered by the user
Kanidm identity	Set by the admin, stored in the vault	Set by the user
Master password	Set by the user	Set by the user
Vault 2FA	Optional	At the user’s discretion
Forgotten master password	The admin resets it	Lost vault*

* Vault recovery

Vaultwarden has an “Emergency access” 🡕 mechanism with a trusted contact. It is useful to :

• set the admin as the trusted contact for non-technical users
• or recommend enabling this option to technical users.

Initial declaration (Linux)

Common to both alternatives : declare, attach and deploy the user. Deploying the HCS also creates their Kanidm account.

Alternative for non-technical users

The user only remembers their master password : the administrator stores all their other access in a shared vault collection.

1. Vaultwarden collection

   In the organization, create a collection named alice.

   Note

   A collection makes it possible to share access between several users.

2. Prepare the access

   just invite alice

   • Linux session (Linux account only): enter a generated password in an item in the collection.
   • Displays the welcome card, a Kanidm link valid for 1 h and the list of remaining tasks.
   • Then validate and deploy the password.

3. Kanidm identity

   • Open the link: there, set a Bitwarden-generated password, a key and a TOTP code.
   • Store the whole thing in an item in the collection.

4. Invite the user to the organization (Members → Invite member)

   • Use the email address defined in config.yaml.
   • Give them write access to the alice collection.

5. The user receives the email and the welcome card

   They create their vault by setting their master password. This is their only action.

6. Confirm the member (Members → Confirm)

   The collection items appear in their vault.

7. Install and configure Bitwarden on their browsers and smartphone.

   On Linux machines, access is pre-defined. On other hosts, the user will need a little help to set up their access.

A trust compromise

The administrator knows the Kanidm and session access. They can reset the master password. To make the user independent, they can remove their credentials from the shared collection with the administrator.

Alternative for technical users

The administrator provides the entry points and the user defines their access.

1. Prepare the access

   just invite alice advanced

   • Linux session (Linux account only): the user types their password.
   • Remotely, they send their fingerprint → just invite alice a '<fingerprint>'.
   • Sends the invitation to the vault.
   • Displays the welcome card to forward to them, with a Kanidm link valid for 24 h and their QR code.

2. The user follows the card

   • They create their vault and their 2FA.
   • They define their Kanidm identity: password, TOTP, access keys.

3. YubiKey (optional)

   Enroll with just yubikey alice and the user’s key, who enters their own PIN.

   • See Passkey enrollment order.

4. User settings

   The user can install Bitwarden on their browsers and smartphone.

FAQ

A few useful pieces of information and tips to know.

How to reset an access?

Run just invite alice again (or advanced): an already defined access is only replaced after confirmation. See also Reset a user’s password.

just invite : Vaultwarden connection refused?

Vaultwarden’s /admin panel only responds from the LAN and the tailnet. Run just invite from a machine on a zone, or with the tailnet active.

Forgot master password?

Vault access may be permanently lost

Without recovery configured in advance, the vault contents are lost.

Enable emergency access 🡕: in their vault, the user opens Settings → Emergency access and invites a trusted contact, with the Takeover access. Once the invitation is accepted, they confirm this contact.

Other prevention mechanisms exist 🡕 : password hint, emergency access via a trusted contact, login with a known device, alternate passkey…

Does Kanidm require 2FA?

By default, yes. A TOTP code or an access key is required. Stored in an item, the key or the TOTP can be offered by Bitwarden autofill.

And the Matrix account?

It is created on first login in Element (IDM button) : nothing to prepare.

Bitwarden login problem

Choosing “self-hosted” in Bitwarden is required. By default, the Bitwarden client connects to bitwarden.com. Enter the URL of the network’s Vaultwarden, then your master password.

Can I use my YubiKey?

Yes! It is even recommended: it is simpler and more secure.

A YubiKey replaces the session password with a touch. It is the only access the vault cannot fill in, since the session opens before it.