+
+
+## Import to Bitwarden
+
+Importing data to Bitwarden **can only be done from the Web Vault** or CLI. Data is [encrypted]({{site.baseurl}}/article/what-encryption-is-used) locally before being sent to the server for storage. To import your data:
+
+1. In the Web Vault, select **Tools** from the top navigation bar.
+2. Select **Import Data** from the left-hand Tools menu.
+3. From the format dropdown, choose **Safari and macOS (csv)**.
+4. Select the **Choose File** button and add the file to import or copy/paste the contents of your file into the input box.
+
+ {% callout warning %}Import to Bitwarden can't check whether items in the file to import are duplicative of items in your Vault. This means that **importing multiple files will create duplicates** of Vault items if that item is alread in the Vault.{% endcallout %}
+5. Select the **Import Data** button to complete your import.
+6. After successful import, delete the import source file from your computer. This will protect you in the event your computer is compromised.
+
+Currently, file attachments are not included in Bitwarden import operations and will need to be uploaded to your Vault manually. For more information, see [File Attachments]({{site.baseurl}}/article/attachments/).
diff --git a/_articles/login-with-sso/about-key-connector.md b/_articles/login-with-sso/about-key-connector.md
new file mode 100644
index 00000000..c54daae4
--- /dev/null
+++ b/_articles/login-with-sso/about-key-connector.md
@@ -0,0 +1,70 @@
+---
+layout: article
+title: About Key Connector
+categories: [login-with-sso]
+featured: false
+popular: false
+tags: [key connector, customer-managed encryption, login with sso]
+order: "05"
+description: "Bitwarden enterprise plan users can take advantage of Single Sign On (SSO) Customer-managed Encryption through Key Connector to streamline Vault authentication and decryption. Find out more in this article."
+---
+
+## What is Key Connector?
+
+Key Connector is a self-hosted application that facilitates **Customer-managed Encryption**, allowing Enterprise Organizations to serve cryptographic keys to Bitwarden clients. Key Connector runs as a docker container on the same network as existing services, and can be used with [Login with SSO]({{site.baseurl}}/article/about-sso/) to serve cryptographic keys for an Organization as an alternative to requiring a Master Password for Vault decryption ([learn more](#why-use-key-connector)).
+
+ Key Connector requires connection to a **database where encrypted user keys are stored** and an **RSA Key Pair to encrypt and decrypt stored user keys**. Key Connector can be [configured]({{site.baseurl}}/article/deploy-key-connector/) with a variety of both database providers (e.g. MSSQL, PostgreSQL, MySQL) and Key Pair storage providers (e.g. Hashicorp Vault, Cloud KMS Providers, On-prem HSM devices) in order to fit your business' infrastructure requirements.
+
+{% image sso/keyconnector/keyconnector-diagram.png Key Connector Architecture %}
+
+## Why use Key Connector?
+
+**In implementations that leverage Master Password decryption**, your Identity Provider handles authentication and a member's Master Password is required for Vault decryption. This separation of concerns is an important step that ensures that only an Organization member has access to the key which is required to decrypt your Organization's sensitive Vault data.
+
+**In implementations that leverage Key Connector for decryption**, your Identity Provider still handles authentication, but Vault decryption is handled by Key Connector. By accessing an encrypted Key Database (*see the above diagram*), Key Connector provides a user their decryption key when they log in, without requiring a Master Password.
+
+We often refer to Key Connector implementations as leveraging **Customer-Managed Encryption**, because your business has sole responsibility for the management of the Key Connector application and of the Vault decryption keys it serves. For enterprises ready to deploy and maintain a Customer-Managed Encryption environment, Key Connector facilitates a streamlined Vault login experience.
+
+### Impact on Master Passwords
+
+Because Key Connector replaces Master Password-based decryption with customer-managed decryption keys, Organization members will be **required to remove the Master Password from their account**. Once removed, all Vault decryption actions will be conducted using the stored user key. Besides logging in, this will have some impacts on [offboarding](#impact-on-offboarding) and [on other features](#impact-on-other-features) you should be aware of.
+
+{% callout warning %}
+Currently, there is not a way to re-create Master Passwords for accounts that have removed them.
+
+For this reason, Organization Owners and Admins are not able to remove their Master Password and must continue using their Master Password even if using SSO. It is possible to elevate a user who has removed their Master Password to Owner or Admin, however we **strongly recommend** that your Organization always have at least one Owner with a Master Password.
+{% endcallout %}
+
+### Impact on Organization Membership
+
+Key Connector required users to [remove their Master Passwords](#impact-on-master-passwords) and instead uses a company-owned database of cryptographic keys to decrypt users' Vaults. Because Master Passwords can not be re-created for accounts that have removed them, this means that once an account uses Key Connector decryption it is for all intents and purposes **owned by the Organization**.
+
+These accounts **may not leave the Organization**, as in doing so they would lose any means of decrypting Vault data. Similarly, if an Organization administrator removes the account from the Organization, the account will lose any means of decrypting Vault data.
+
+### Impact on other Features
+
+|Feature|Impact|
+|-------|------|
+|**Verification**|There are a number of features in Bitwarden client applications that ordinarily require entry of a Master Password in order to be used, including [exporting]({{site.baseurl}}/article/export-your-data/) Vault data, changing [Two-step Login]({{site.baseurl}}/article/setup-two-step-login) settings, retrieving [API Keys]({{site.baseurl}}/article/personal-api-key/), and more.
+{% capture safari_content %}
+### Safari
+
+To export your data from Safari:
+
+1. Select **File** → **Export** → **Passwords...** from the macOS menu bar:
+
+ {% image importing/safari.png Export from Safari %}
+2. You will be prompted with a dialog confirming that you want to export saved passwords. Select **Export Passwords...** to continue.
+3. Save your export to any location and use Touch ID or your macOS password to complete the export.
+
+{% endcapture %}
+{{ safari_content | markdownify }}
+
+
+{% capture macos_content %}
+### macOS System Preferences
+
+To export your data from macOS:
+
+1. Open the macOS **System Preferences** app.
+2. In System Preferences, select **Passwords**. You'll be prompted to use Touch ID or your password to continue.
+3. On the Passwords dialog, select the menu icon ( {% icon fa-ellipsis-h %} ) and select **Export Passwords...**:
+
+ {% image importing/macos.png Export from macOS System preferences %}
+4. You will be prompted with a dialog confirming that you want to export saved passwords. Select **Export Passwords...** to continue.
+5. Save your export to any location and use Touch ID or your password to complete the export.
+
+{% endcapture %}
+{{ macos_content | markdownify }}
+
+**All these features** will replace Master Password confirmation with email-based TOTP verification.| +|**Vault Lock/Unlock**|Under ordinary circumstances, a [locked Vault can be unlocked]({{site.baseurl}}/article/vault-timeout/#vault-timeout-action) using a Master Password. When your Organization is using Key Connector, locked client applications can only be unlocked with a [PIN]({{site.baseurl}}/article/unlock-with-pin/) or with [Biometrics]({{site.baseurl}}/article/biometrics/).
If neither PIN nor Biometrics are enabled for a client application, the Vault will always log out instead of lock. Unlike unlocking, logging in **always** requires an internet connection ([learn more]({{site.baseurl}}/article/vault-timeout/#vault-timeout-action)).| +|**Master Password re-prompt**|When Key Connector is being used, [Master Password re-prompt]({{site.baseurl}}/article/managing-items/#protect-individual-items) will be disabled for any user that has removed their Master Password as a result of your Key Connector implementation.| +|**Admin Password Reset**|When Key Connector is being used, [Admin Password Reset]({{site.baseurl}}/article/admin-reset/) will be disabled for any user that has removed their Master Password as a result of your Key Connector implementation.| +|**Emergency Access**|When Key Connector is being used, the Emergency Access [Account Takeover option]({{site.baseurl}}/article/emergency-access/#user-access) will be disabled for any user that has removed their Master Password as a result of your Key Connector implementation.
Trusted emergency contacts may still **View** a grantor's personal Vault data, subject to the established [emergency access workflow]({{site.baseurl}}/article/emergency-access/#initiate-emergency-access).| + +## How do I start using Key Connector? + +In order to get started using Key Connector for Customer-managed Encryption, please review the following requirements: + +{% callout warning %} +Management of cryptographic keys is incredibly sensitive and is **only recommended for enterprises with a team and infrastructure** that can securely support deploying and managing a key server. +{% endcallout %} + +In order to use Key Connector you must also: + +- [Have an Enterprise Organization]({{site.baseurl}}/article/about-bitwarden-plans/#enterprise-organizations) +- [Have a self-hosted Bitwarden server]({{site.baseurl}}/hosting/) +- [Have an active SSO implementation]({{site.baseurl}}/article/about-sso/) +- [Activate the Single Organization and Single Sign-On policies]({{site.baseurl}}/article/policies/) + +
+If your Organization meets or can meet these requirements, including a team and infrastructure that can support management of a key server, [Contact Us](https://bitwarden.com/contact) and we'll activate Key Connector. diff --git a/_articles/login-with-sso/about-sso.md b/_articles/login-with-sso/about-sso.md index 2452842a..37788d79 100644 --- a/_articles/login-with-sso/about-sso.md +++ b/_articles/login-with-sso/about-sso.md @@ -13,51 +13,34 @@ description: "Bitwarden enterprise plan users can take advantage of Single Sign ## What is Login with SSO? -Login with SSO separates user authentication from Vault decryption by leveraging your existing Identity Provider (IdP) to authenticate users into their Bitwarden Vault and using Master Passwords for decryption of Vault data. +Login with SSO is the Bitwarden solution for Single Sign-On. Using Login with SSO, [Enterprise Organizations]({{site.baseurl}}/article/about-organizations/#types-of-organizations) can leverage their existing Identity Provider to authenticate users with Bitwarden using the **SAMl 2.0** or **Open ID Connect (OIDC)** protocols. -Login with SSO currently supports SAML 2.0 and OpenID Connect authentication for customers on the current Enterprise Plan. +What makes Login with SSO unique is that it retains our zero-knowledge encryption model. Nobody at Bitwarden has access to your Vault data and, similarly, **neither should your Identity Provider**. That's why Login with SSO **decouples authentication and decryption**. In all Login with SSO implementations, your Identity Provider cannot and will not have access to the decryption key needed to decrypt Vault data. -Users of Bitwarden authenticate into their vaults using the **Enterprise Single Sign-On** button located on the login screen of any Bitwarden client application. For more information, see [Using Login with SSO]({{site.baseurl}}/article/using-sso/). +In most scenarios, that decryption key is the user's [Master Password]({{site.baseurl}}/article/master-password/), which they retain sole responsibility for, however Organizations self-hosting Bitwarden can use [Key Connector]({{site.baseurl}}/article/about-key-connector/) as an alternative means of decrypting Vault data. -Administrators can configure Login with SSO from the Organization **Manage** screen. +{% image sso/sso-workflow-2.png Login with SSO & Master Password Decryption %} -{% image sso/sso-button-lg.png Enterprise Single Sign-On button %} +## Why use Login with SSO? -### Requiring SSO for Users +Login with SSO is a flexible solution that can fit your enterprise's needs. Login with SSO includes: -Using the **Single Sign-On Authentication** policy, Enterprise Organizations can require non-Owner/non-Admin users to log in to Bitwarden with Enterprise Single Sign-On. For more information about setting up this policy, see [Policies]({{site.baseurl}}/article/policies/). +- [SAML 2.0]({{site.baseurl}}/article/configure-sso-saml/) and [OIDC]({{site.baseurl}}/article/configure-sso-oidc/) configuration options that support integration with a wide variety of Identity Providers. +- An [Enterprise Policy]({{site.baseurl}}/article/policies/#single-sign-on-authentication) to optionally require non-Owner/non-Admin users to log in to Bitwarden with Single Sign-On. +- Two distinct [Member Decryption Options]({{site.baseurl}}/article/sso-decryption-options/) for safe data access workflows. +- "Just-in-time" end-user onboarding via SSO. -## Enterprise Free Trial -Login with SSO is available for all customers on the current Enterprise plan (for more information, see [About Bitwarden Plans]({{site.baseurl}}/article/about-bitwarden-plans/). If you're new to Bitwarden, we'd love to help you through the process of setting up an account and starting your 7 Day Free Trial Enterprise Organization with our dedicated signup page: +## How do I start using Login with SSO? + +Login with SSO is available for all customers with an [Enterprise Organization]({{site.baseurl}}/article/about-bitwarden-plans/#enterprise-organizations). If you're new to Bitwarden, we'd love to help you through the process of setting up an account and starting your 7 Day Free Trial Enterprise Organization with our dedicated signup page: Start your Enterprise Free Trial -If you're an experienced Bitwarden user, refer to the [this article]({{site.baseurl}}/article/enterprise-free-trial/) for help. If you're self-hosting Bitwarden, you will need to generate a new license file after starting your 7 Day Free Trial. We recommend using a separate Bitwarden instance for testing Login with SSO. For more information, see [Licensing Paid Features]({{site.baseurl}}/article/licensing-on-premise/). +**Once you have an Enterprise Organization**, deployment should include the following steps: -## Requirements - -Login with SSO has the following requirements: - -### Identity Server Requirements -Your Identity Provider must support one of the following: -- SAML 2.0 -- OpenID Connect (OIDC) - -### Client Application Requirements -Your Bitwarden client applications require the following versions: - -- **Desktop Application**: v1.2+ -- **Browser Extension**: v1.46+ -- **Mobile App** (Android or iOS): v2.6+ -- **CLI**: v1.12+ (Must run on systems with an available web browser) - -### Self-Hosting Requirements -If you are self-hosting Bitwarden, your installation must be on v1.37+. - -For information on updating your self-hosted instance, see [Updating your Self-Hosted Installation]({{site.baseurl}}/article/updating-on-premise/). - -## Workflow Diagram -The following diagram is an overview of the workflow used by Bitwarden to authenticate using SSO: - -{%image /sso/sso-workflow.png Bitwarden SSO Workflow %} +1. Follow one of our [SAML 2.0]({{site.baseurl}}/article/configure-sso-saml/) or [OIDC]({{site.baseurl}}/article/configure-sso-oidc/) Implementation Guides to configure and deploy Login with SSO with Master Password decryption. +2. Test [the end-user Login with SSO experience]({{site.baseurl}}/article/using-sso/) using Master Password decryption. +3. (**If self-hosting**) Review our different [Member Decryption Options]({{site.baseurl}}/article/sso-decryption-options/) to determine whether using [Key Connector]({{site.baseurl}}/article/about-key-connector/) might be right for your Organization. +4. (**If self-hosting**) If you're interested in implementing Key Connector, [Contact Us](https://bitwarden.com/contact/) and we'll help you get started [deploying Key Connector]({{site.baseurl}}/article/deploy-key-connector/). +5. Educate your Organization members on how to [use Login with SSO]({{site.baseurl}}/article/using-sso/). diff --git a/_articles/login-with-sso/configure-sso-oidc.md b/_articles/login-with-sso/configure-sso-oidc.md index 4b26441d..ea938bbe 100644 --- a/_articles/login-with-sso/configure-sso-oidc.md +++ b/_articles/login-with-sso/configure-sso-oidc.md @@ -30,9 +30,13 @@ Once you have your Organization Identifier, you can proceed to enabling and conf 1. From the Organization Vault, navigate to the **Manage** tab and select **Single Sign-On** from the left-hand menu: {% image sso/manage-sso.png Enable SSO %} -2. On the Single Sign-On Screen, check the **Enabled** checkbox. +2. On the Single Sign-On Screen, check the **Allow SSO Authentication** checkbox. 4. From the **Type** dropdown menu, select the **OpenID Connect** option. If you intend to use SAML instead, switch over the the [SAML Configuration Guide]({{site.baseurl}}/article/configure-sso-saml/). +{% callout success %} +If you're self-hosting Bitwarden, you can use alternative **Member Decryption Options**. This feature is disabled by default, so continue with **Master Password** decryption for now and learn how to get started using [Key Connector]({{site.baseurl}}/article/about-key-connector/) once your configuration is complete and successfully working. +{% endcallout %} + ## Step 3: Configuration From this point on, **implementation will vary provider-to-provider**. Jump to one of our specific **Implementation Guides** for help completing the configuration process: diff --git a/_articles/login-with-sso/configure-sso-saml.md b/_articles/login-with-sso/configure-sso-saml.md index 38119e98..60982d03 100644 --- a/_articles/login-with-sso/configure-sso-saml.md +++ b/_articles/login-with-sso/configure-sso-saml.md @@ -30,9 +30,13 @@ Once you have your Organization Identifier, you can proceed to enabling and conf 1. From the Organization Vault, navigate to the **Manage** tab and select **Single Sign-On** from the left-hand menu: {% image sso/manage-sso.png Enable SSO %} -2. On the Single Sign-On Screen, check the **Enabled** checkbox. +2. On the Single Sign-On Screen, check the **Allow SSO Authentication** checkbox. 4. From the **Type** dropdown menu, select the **SAML 2.0** option. If you intend to use OIDC instead, switch over to the [OIDC Configuration Guide]({{site.baseurl}}/article/configure-sso-oidc/). +{% callout success %} +If you're self-hosting Bitwarden, you can use alternative **Member Decryption Options**. This feature is disabled by default, so continue with **Master Password** decryption for now and learn how to get started using [Key Connector]({{site.baseurl}}/article/about-key-connector/) once your configuration is complete and successfully working. +{% endcallout %} + ## Step 3: Configuration From this point on, **implementation will vary provider-to-provider**. Jump to one of our specific **Implementation Guides** for help completing the configuration process: diff --git a/_articles/login-with-sso/deploy-key-connector.md b/_articles/login-with-sso/deploy-key-connector.md new file mode 100644 index 00000000..09d11103 --- /dev/null +++ b/_articles/login-with-sso/deploy-key-connector.md @@ -0,0 +1,331 @@ +--- +layout: article +title: Deploy Key Connector +categories: [login-with-sso] +featured: false +popular: false +tags: [key connector, customer-managed encryption, login with sso] +order: "06" +description: "This article guides you through the process of installing and deploying the Key Connector Bitwarden service to your self-hosted Bitwarden server." +--- + +This article will walk you through the procedure for enabling and configuring Key Connector in an existing self-hosted environment. **Before proceeding**, please thoroughly review the [About Key Connector]({{site.baseurl}}/article/about-key-connector/) article to ensure a full understanding of what Key Connector is, how it works, and the impacts of implementation. + +## Requirements + +{% callout warning %} +Management of cryptographic keys is incredibly sensitive and is **only recommended for enterprises with a team and infrastructure** that can securely support deploying and managing a key server. +{% endcallout %} + +In order to use Key Connector you must: + +- [Have an Enterprise Organization]({{site.baseurl}}/article/about-bitwarden-plans/#enterprise-organizations) +- [Have a self-hosted Bitwarden server]({{site.baseurl}}/hosting/) +- [Have an active SSO implementation]({{site.baseurl}}/article/about-sso/) +- [Activate the Single Organization and Single Sign-On policies]({{site.baseurl}}/article/policies/) + +
+If your Organization meets or can meet these requirements, including a team and infrastructure that can support management of a key server, [Contact Us](https://bitwarden.com/contact) and we'll activate Key Connector. + +## Setup & Deploy Key Connector + +**Once you've contacted us regarding Key Connector**, we'll reach out to kick off a Key Connector discussion. The steps that follow in this article must be completed in collaboration with Bitwarden Customer Success & Implementation specialists. + +### Obtain New License File + +Once you've contacted us regarding Key Connector, a member of the Customer Success & Implementation team will generate a Key Connector-enabled license file for your Organization. When your Bitwarden collaborator instructs you it is ready, complete the following steps to obtain the new license: + +1. Open your Bitwarden Cloud Web Vault and navigate to your Organization's **Settings** → **Subscription** screen. +2. Select the **Download License** button. +3. When prompted, enter the Installation ID that was used to install your self-hosted server and select **Submit**. If you don't know your Installation ID off-hand, you can retrieve it from `./bwdata/env/global.override.env`. + +You won't need your license file immediately, but you will be required to upload it to your self-hosted server [in a later step](#activate-key-connector). + +### Initialize Key Connector + +To prepare your Bitwarden server for Key Connector: + +1. Save a [backup]({{site.baseurl}}/article/backup-on-premise/) of, at a minimum, `.bwdata/mssql`. Once Key Connector is in use, it's recommended that you have access to a pre-Key Connector backup image in case of an issue. + + {% callout info %}If you're using an [external MSSQL database]({{site.baseurl}}/article/external-db/), take a backup of your database in whatever way fits your implementation.{% endcallout %} +2. Update your self-hosted Bitwarden installation in order to retrieve the latest changes: + + ``` + ./bitwarden.sh update + ``` +3. Edit the `.bwdata/config.yml` file and enable Key Connector by toggling `enable_key_connector` to `true`. + + ``` + nano bwdata/config.yml + ``` +4. Update your self-hosted Bitwarden installation again in order to apply the change made in **Step 3**: + + ``` + ./bitwarden.sh update + ``` + +### Configure Key Connector + +To configure Key Connector: + +1. Edit the `.bwdata/env/key-connector.override.env` file that will have been downloaded with the `./bitwarden.sh update`. + + ``` + nano bwdata/env/key-connector.override.env + ``` + + {% callout warning %}This file will be pre-populated with default values that will spin up a functional local Key Connector setup, however the **default values are not recommended for production environments**.{% endcallout %} +2. In `key-connector.override.env`, you will need to specify values for the following: + + - [Endpoints](#endpoints): What Bitwarden endpoints Key Connector can communicate with. + - [Database](#database): Where Key Connector will store and retrieve user keys. + - [RSA Key Pair](#rsa-key): How Key Connector will access an RSA key pair to protect user keys at rest. + +#### Endpoints + +Automated setup will populate endpoint values based on your installation configuration, however it's recommended that you confirm the following values in `key-connector.override.env` are accurate for your setup: + +``` +keyConnectorSettings__webVaultUri=https://your.bitwarden.domain.com +keyConnectorSettings__identityServerUri=https://your.bitwarden.domain.com/identity/ +``` + +#### Database + +Key Connector must access a database which stores encrypted user keys keys for your Organization members. Create a secure database to store encrypted users keys and replace the default `keyConnectorSettings__database__` values in `key-connector.override.env` with the values designated in the **Required Values** column for the chosen database: + +{% callout warning %} +Migration from one database to another is **not supported** at this time. Regardless of which provider you choose, **implement a frequent automated backup schedule** for the database. +{% endcallout %} + +|Database|Required Values| +|--------|---------------| +|Local JSON (**default**)|**Not recommended outside of testing.**
`keyConnectorSettings__database__provider=json`
`keyConnectorSettings__database__jsonFilePath={File_Path}`| +|Microsoft SQL Server|`keyConnectorSettings__database__provider=sqlserver`
`keyConnectorSettings__database__sqlServerConnectionString={Connection_String}`
[Learn how to format MSSQL Connection Strings](https://docs.microsoft.com/en-us/sql/connect/ado-net/connection-string-syntax?view=sql-server-ver15){:target="\_blank"}| +|PostgreSQL|`keyConnectorSettings__database__provider=postgresql`
`keyConnectorSettings__database__postgreSqlConnectionString={Connection_String}`
[Learn how to format PostgreSQL Connection Strings](https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNSTRING){:target="\_blank"}| +|MySQL/MariaDB|`keyConnectorSettings__database__provider=mysql`
`keyConnectorSettings__database__mySqlConnectionString={Connection_String}`
[Learn how to format MySQL Connection Strings](https://dev.mysql.com/doc/connector-net/en/connector-net-connections-string.html){:target="\_blank"}| +|SQLite|`keyConnectorSettings__database__provider=sqlite`
`keyConnectorSettings__database__sqliteConnectionString={Connection_String}`
[Learn how to format SQLite Connection Strings](https://docs.microsoft.com/en-us/dotnet/standard/data/sqlite/connection-strings){:target="\_blank"}| +|MongoDB|`keyConnectorSettings__database__provider=mongo`
`keyConnectorSettings__database__mongoConnectionString={Connection_String}`
`keyConnectorSettings__database__mongoDatabaseName={DatabaseName}`
[Learn how to format MongoDB Connection Strings](https://docs.mongodb.com/manual/reference/connection-string/){:target="\_blank"}| + +#### RSA Key Pair + +Key Connector uses an RSA key pair to protect user keys at rest. Create a key pair and replace the default `keyConnectorSettings__rsaKey__` and `keyConnectorSettings__certificate__` values in `key-connector.override.env` with the values required for your chosen implementation. + +{% callout success %} +The RSA key pair must be **at a minimum** 2048 bits in length. +{% endcallout %} + +Generally, your options include granting Key Connector access to an X509 **Certificate** that contains the key pair or granting Key Connector access directly to the **Key Pair**: + + + +
+
+
+### Activate Key Connector
+
+Now that Key Connector is [fully configured](#configure-key-connector) and you have a [Key Connector-enabled license](#obtain-a-new-license), complete the following steps:
+
+1. Restart your self-hosted Bitwarden installation in order to apply the configuration changes:
+
+ ```
+ ./bitwarden.sh restart
+ ```
+2. Log in to your self-hosted Bitwarden as an **Organization Owner** and navigate to the Organization **Settings** → **Subscription** screen.
+3. Select the **Update License** button and upload the Key Connector-enabled license [retrieved in an earlier step](#obtain-new-license-file):
+
+ {% image hosting/update-license.png Update your License %}
+3. Navigate to the Organization **Manage** screen.
+4. If you haven't already, navigate to the **Policies** screen and enable the [Single Organization]({{site.baseurl}}/article/policies/#single-organization) and [Single Sign-On Authentication]({{site.baseurl}}/article/policies/#single-sign-on-authentication) policies. **Both are required to use Key Connector**.
+5. Navigate to the **Single Sign-On** screen:
+
+ {% callout success %}The next few steps assume that you already have an active [Login with SSO]({{site.baseurl}}/article/about-sso/) implementation using [SAML 2.0]({{site.baseurl}}/article/configure-sso-saml/) or [OIDC]({{site.baseurl}}/article/configure-sso-oidc/). **If you don't**, please implement and test Login with SSO before proceeding.{% endcallout %}
+ {% image sso/keyconnector/enable-keyconnector.png %}
+6. In the **Member Decryption Options** section, select **Key Connector**.
+7. In the **Key Connector URL** input, enter the address Key Connector is running at (by default, `http://localhost:5000`) and select the **Test** button to ensure you can reach Key Connector.
+8. Scroll to the bottom of the screen and select **Save**.
diff --git a/_articles/login-with-sso/oidc-azure.md b/_articles/login-with-sso/oidc-azure.md
index ab55a021..50e6dc1c 100644
--- a/_articles/login-with-sso/oidc-azure.md
+++ b/_articles/login-with-sso/oidc-azure.md
@@ -24,6 +24,10 @@ Navigate to your Organization's **Manage** → **Single Sign-On** screen:
You don't need to edit anything on this screen yet, but keep it open for easy reference.
+{% callout success %}
+If you're self-hosting Bitwarden, you can use alternative **Member Decryption Options**. This feature is disabled by default, so continue with **Master Password** decryption for now and learn how to get started using [Key Connector]({{site.baseurl}}/article/about-key-connector/) once your configuration is complete and successfully working.
+{% endcallout %}
+
## Create an App Registration
In the Azure Portal, navigate to **App registrations** and select the **New registration** button:
diff --git a/_articles/login-with-sso/oidc-okta.md b/_articles/login-with-sso/oidc-okta.md
index ce6543e1..04c5efeb 100644
--- a/_articles/login-with-sso/oidc-okta.md
+++ b/_articles/login-with-sso/oidc-okta.md
@@ -23,6 +23,10 @@ Navigate to your Organization's **Manage** → **Single Sign-On** screen:
You don't need to edit anything on this screen yet, but keep it open for easy reference.
+{% callout success %}
+If you're self-hosting Bitwarden, you can use alternative **Member Decryption Options**. This feature is disabled by default, so continue with **Master Password** decryption for now and learn how to get started using [Key Connector]({{site.baseurl}}/article/about-key-connector/) once your configuration is complete and successfully working.
+{% endcallout %}
+
## Create an Okta App
In the Okta Admin Portal, select **Applications** → **Applications** from the navigation. On the Applications screen, select the **Create App Integration** button. For Sign-on method, select **OIDC - OpenID Connect**. For Application type, select **Web Application**:
diff --git a/_articles/login-with-sso/saml-adfs.md b/_articles/login-with-sso/saml-adfs.md
index 8a1b9772..70dd4c96 100644
--- a/_articles/login-with-sso/saml-adfs.md
+++ b/_articles/login-with-sso/saml-adfs.md
@@ -29,6 +29,10 @@ Navigate to your Organization's **Manage** → **Single Sign-On** screen:
You don't need to edit anything on this screen yet, but keep it open for easy reference.
+{% callout success %}
+If you're self-hosting Bitwarden, you can use alternative **Member Decryption Options**. This feature is disabled by default, so continue with **Master Password** decryption for now and learn how to get started using [Key Connector]({{site.baseurl}}/article/about-key-connector/) once your configuration is complete and successfully working.
+{% endcallout %}
+
## Create a Relying Party Trust
In the AD FS Server Manager, select **Tools** → **AD FS Management** → **Action** → **Add Relying Party Trust**. In the Wizard, make the following selections:
diff --git a/_articles/login-with-sso/saml-auth0.md b/_articles/login-with-sso/saml-auth0.md
index 02d5cf99..979bbcf5 100644
--- a/_articles/login-with-sso/saml-auth0.md
+++ b/_articles/login-with-sso/saml-auth0.md
@@ -29,6 +29,10 @@ Navigate to your Organization's **Manage** → **Single Sign-On** screen:
You don't need to edit anything on this screen yet, but keep it open for easy reference.
+{% callout success %}
+If you're self-hosting Bitwarden, you can use alternative **Member Decryption Options**. This feature is disabled by default, so continue with **Master Password** decryption for now and learn how to get started using [Key Connector]({{site.baseurl}}/article/about-key-connector/) once your configuration is complete and successfully working.
+{% endcallout %}
+
## Create an Auth0 Application
In the Auth0 Portal, use the Applications menu to create a **Regular Web Application**:
diff --git a/_articles/login-with-sso/saml-aws.md b/_articles/login-with-sso/saml-aws.md
index d2701b85..fd357acb 100644
--- a/_articles/login-with-sso/saml-aws.md
+++ b/_articles/login-with-sso/saml-aws.md
@@ -30,6 +30,10 @@ Navigate to your Organization's **Manage** → **Single Sign-On** screen:
You don't need to edit anything on this screen yet, but keep it open for easy reference.
+{% callout success %}
+If you're self-hosting Bitwarden, you can use alternative **Member Decryption Options**. This feature is disabled by default, so continue with **Master Password** decryption for now and learn how to get started using [Key Connector]({{site.baseurl}}/article/about-key-connector/) once your configuration is complete and successfully working.
+{% endcallout %}
+
## Create an AWS SSO Application
In the AWS Console, navigate to **AWS SSO**, select **Applications** from the navigation, and select the **Add a new application** button:
diff --git a/_articles/login-with-sso/saml-azure.md b/_articles/login-with-sso/saml-azure.md
index 03ddac7c..dcbb13c4 100644
--- a/_articles/login-with-sso/saml-azure.md
+++ b/_articles/login-with-sso/saml-azure.md
@@ -30,6 +30,10 @@ Navigate to your Organization's **Manage** → **Single Sign-On** screen:
You don't need to edit anything on this screen yet, but keep it open for easy reference.
+{% callout success %}
+If you're self-hosting Bitwarden, you can use alternative **Member Decryption Options**. This feature is disabled by default, so continue with **Master Password** decryption for now and learn how to get started using [Key Connector]({{site.baseurl}}/article/about-key-connector/) once your configuration is complete and successfully working.
+{% endcallout %}
+
## Create an Enterprise Application
In the Azure Portal, navigate to **Azure Active Directory** and select **Enterprise applications** from the navigation menu:
diff --git a/_articles/login-with-sso/saml-duo.md b/_articles/login-with-sso/saml-duo.md
index 7927d526..27cba8f0 100644
--- a/_articles/login-with-sso/saml-duo.md
+++ b/_articles/login-with-sso/saml-duo.md
@@ -33,6 +33,10 @@ Navigate to your Organization's **Manage** → **Single Sign-On** screen:
You don't need to edit anything on this screen yet, but keep it open for easy reference.
+{% callout success %}
+If you're self-hosting Bitwarden, you can use alternative **Member Decryption Options**. This feature is disabled by default, so continue with **Master Password** decryption for now and learn how to get started using [Key Connector]({{site.baseurl}}/article/about-key-connector/) once your configuration is complete and successfully working.
+{% endcallout %}
+
## Protect an Application
In the Duo Admin Portal, navigate to the **Applications** screen and select the **Protect an Application** button:
diff --git a/_articles/login-with-sso/saml-google.md b/_articles/login-with-sso/saml-google.md
index 296a7353..d0b903d2 100644
--- a/_articles/login-with-sso/saml-google.md
+++ b/_articles/login-with-sso/saml-google.md
@@ -30,6 +30,10 @@ Navigate to your Organization's **Manage** → **Single Sign-On** screen:
You don't need to edit anything on this screen yet, but keep it open for easy reference.
+{% callout success %}
+If you're self-hosting Bitwarden, you can use alternative **Member Decryption Options**. This feature is disabled by default, so continue with **Master Password** decryption for now and learn how to get started using [Key Connector]({{site.baseurl}}/article/about-key-connector/) once your configuration is complete and successfully working.
+{% endcallout %}
+
## Create a SAML app
In the Google Workspace Admin console, select **Apps** → **Web and mobile apps** from the navigation. On the Web and mobile apps screen, select **Add App** → **Add custom SAML app**:
diff --git a/_articles/login-with-sso/saml-jumpcloud.md b/_articles/login-with-sso/saml-jumpcloud.md
index e48a70a4..c6d86c05 100644
--- a/_articles/login-with-sso/saml-jumpcloud.md
+++ b/_articles/login-with-sso/saml-jumpcloud.md
@@ -30,6 +30,10 @@ Navigate to your Organization's **Manage** → **Single Sign-On** screen:
You don't need to edit anything on this screen yet, but keep it open for easy reference.
+{% callout success %}
+If you're self-hosting Bitwarden, you can use alternative **Member Decryption Options**. This feature is disabled by default, so continue with **Master Password** decryption for now and learn how to get started using [Key Connector]({{site.baseurl}}/article/about-key-connector/) once your configuration is complete and successfully working.
+{% endcallout %}
+
## Create a JumpCloud SAML App
In the JumpCloud Portal, select **SSO** from the menu and select the {% icon fa-plus %} **Add** icon:
diff --git a/_articles/login-with-sso/saml-keycloak.md b/_articles/login-with-sso/saml-keycloak.md
index edf0e4b4..021832f9 100644
--- a/_articles/login-with-sso/saml-keycloak.md
+++ b/_articles/login-with-sso/saml-keycloak.md
@@ -29,6 +29,10 @@ Navigate to your Organization's **Manage** → **Single Sign-On** screen:
You don't need to edit anything on this screen yet, but keep it open for easy reference.
+{% callout success %}
+If you're self-hosting Bitwarden, you can use alternative **Member Decryption Options**. This feature is disabled by default, so continue with **Master Password** decryption for now and learn how to get started using [Key Connector]({{site.baseurl}}/article/about-key-connector/) once your configuration is complete and successfully working.
+{% endcallout %}
+
## Create a Client
In the Keycloak portal, create a new Client:
diff --git a/_articles/login-with-sso/saml-okta.md b/_articles/login-with-sso/saml-okta.md
index a2f1b450..aa88b257 100644
--- a/_articles/login-with-sso/saml-okta.md
+++ b/_articles/login-with-sso/saml-okta.md
@@ -30,6 +30,10 @@ Navigate to your Organization's **Manage** → **Single Sign-On** screen:
You don't need to edit anything on this screen yet, but keep it open for easy reference.
+{% callout success %}
+If you're self-hosting Bitwarden, you can use alternative **Member Decryption Options**. This feature is disabled by default, so continue with **Master Password** decryption for now and learn how to get started using [Key Connector]({{site.baseurl}}/article/about-key-connector/) once your configuration is complete and successfully working.
+{% endcallout %}
+
## Create an Okta App
In the Okta Admin Portal, select **Applications** → **Applications** from the navigation. On the Applications screen, select the **Add Application** button:
diff --git a/_articles/login-with-sso/saml-onelogin.md b/_articles/login-with-sso/saml-onelogin.md
index 880f7965..7dcdb8e5 100644
--- a/_articles/login-with-sso/saml-onelogin.md
+++ b/_articles/login-with-sso/saml-onelogin.md
@@ -29,6 +29,10 @@ Navigate to your Organization's **Manage** → **Single Sign-On** screen:
You don't need to edit anything on this screen yet, but keep it open for easy reference.
+{% callout success %}
+If you're self-hosting Bitwarden, you can use alternative **Member Decryption Options**. This feature is disabled by default, so continue with **Master Password** decryption for now and learn how to get started using [Key Connector]({{site.baseurl}}/article/about-key-connector/) once your configuration is complete and successfully working.
+{% endcallout %}
+
## Create a OneLogin App
In the OneLogin Portal, navigate to the the **Applications** screen and select the **Add App** button:
diff --git a/_articles/login-with-sso/sso-decryption-options.md b/_articles/login-with-sso/sso-decryption-options.md
new file mode 100644
index 00000000..16044f97
--- /dev/null
+++ b/_articles/login-with-sso/sso-decryption-options.md
@@ -0,0 +1,24 @@
+---
+layout: article
+title: Member Decryption Options
+categories: [login-with-sso]
+featured: false
+popular: false
+tags: [key connector, customer-managed encryption, login with sso, master password decryption]
+order: "04"
+description: "This article covers the Vault decryption options available for Enterprise Organizations leveraging Login with SSO."
+---
+
+What makes Login with SSO unique is that it retains our zero-knowledge encryption model. Nobody at Bitwarden has access to your Vault data and, similarly, **neither should your Identity Provider**. That's why Login with SSO **decouples authentication and decryption**. In all Login with SSO implementations, your Identity Provider cannot and will not have access to the decryption key needed to decrypt Vault data.
+
+**Member Decryption Options** are used to determine what decryption key will be used to decrypt Vault data in scenarios where Login with SSO is handling authentication. Options include:
+
+- **Master Password**: Once authenticated, Organization members will decrypt Vault data using their [Master Passwords]({{site.baseurl}}/article/master-password/).
+- **Key Connector**: Connect Login with SSO to your self-hosted decryption key server. Using this option, Organization members won't need to use their Master Passwords to decrypt Vault data. Instead, [Key Connector]({{site.baseurl}}/article/about-key-connector/) will retrieve a decryption key securely stored in a database owned and managed by you.
+
+
+{% callout success %}
+Due to the sensitivity of storing decryption keys, the **Key Connector** option is **disabled by default** and currently **only available to Organizations self-hosting Bitwarden**.
+
+If you're interesting in using Key Connector, check out the [About Key Connector]({{site.baseurl}}/article/about-key-connector/) and [Deploy Key Connector]({{site.baseurl}}/article/deploy-key-connector/) articles and [Contact Us](https://bitwarden.com/contact/) to setup a time for us to help you get started.
+{% endcallout %}
diff --git a/_articles/login-with-sso/using-sso.md b/_articles/login-with-sso/using-sso.md
index 719a8e08..8211b5f0 100644
--- a/_articles/login-with-sso/using-sso.md
+++ b/_articles/login-with-sso/using-sso.md
@@ -5,7 +5,7 @@ categories: [login-with-sso]
featured: false
popular: false
tags: [sso]
-order: "04"
+order: "07"
redirect_from:
- /article/link-to-sso/
- /article/sso-access-your-vault/
@@ -24,27 +24,73 @@ Every Bitwarden Organization has a unique identifier specifically for Login with
## Login using SSO
-To login to Bitwarden using SSO:
+The steps required to login using SSO will be slightly different depending on whether your Organization is using [Key Connector]({{site.baseurl}}/article/about-key-connector/) or not:
-1. Open your Bitwarden Web Vault or App and select the **Enterprise Single Sign-On** button:
+
+
+
+{% capture cert_content %}
+### Certificate
+
+To use an X509 certificate that contains an RSA key pair, specify the values required depending on the location where your certificate is stored (see **Filesystem**, **OS Certificate Store**, etc.):
+
+{% callout success %}
+The certificate **must** be made available as a PKCS12 `.pfx` file, for example:
+
+```
+openssl req -x509 -newkey rsa:4096 -sha256 -nodes -keyout bwkc.key -out bwkc.crt -subj "/CN=Bitwarden Key Connector" -days 36500
+
+openssl pkcs12 -export -out ./bwkc.pfx -inkey bwkc.key -in bwkc.crt -passout pass:{Password}
+```
+
+In all certificate implementations, you'll need the `CN` value shown in this example.
+{% endcallout %}
+
+#### Filesystem (default)
+
+If the certificate is stored on the filesystem of the machine running Key Connector, specify the following values:
+
+{% callout info %}
+By default, Key Connector will be configured to create a `.pfx` file located at `etc/bitwarden/key-connector/bwkc.pfx` with a generated password. **It is not recommended** for enterprise implementations to use these defaults.
+{% endcallout %}
+
+```
+keyConnectorSettings__rsaKey__provider=certificate
+keyConnectorSettings__certificate__provider=filesystem
+keyConnectorSettings__certificate__filesystemPath={Certificate_Path}
+keyConnectorSettings__certificate__filesystemPassword={Certificate_Password}
+```
+
+#### OS Certificate Store
+
+If the certificate is stored on the Operating System Certificate Store of the machine running Key Connector, specify the following values:
+
+```
+keyConnectorSettings__rsaKey__provider=certificate
+keyConnectorSettings__certificate__provider=store
+keyConnectorSettings__certificate__storeThumbprint={Certificate_Thumbprint}
+```
+
+#### Azure Blob Storage
+
+If the certificate is uploaded to Azure Blob Storage, specify the following values:
+
+```
+keyConnectorSettings__rsaKey__provider=certificate
+keyConnectorSettings__certificate__provider=azurestorage
+keyConnectorSettings__certificate__azureStorageConnectionString={Connection_String}
+keyConnectorSettings__certificate__azureStorageContainer={Container_Name}
+keyConnectorSettings__certificate__azureStorageFileName={File_Name}
+keyConnectorSettings__certificate__azureStorageFilePassword={File_Password}
+```
+
+[Learn how to format Azure Blob Storage Connection Strings](https://docs.microsoft.com/en-us/azure/data-explorer/kusto/api/connection-strings/storage#azure-blob-storage){:target="\_blank"}
+
+#### Azure Key Vault
+
+If certificate is stored in Azure Key Vault, specify the following values:
+
+{% callout info %}
+To use Azure Key Vault to store your `.pfx` certificate, you'll need to create an Active Directory **App Registration**. This App Registration must:
+- Give delegated API permissions to access Azure Key Vault
+- Have a client secret generated to allow access by Key Connector
+{% endcallout %}
+
+```
+keyConnectorSettings__certificate__provider=azurekv
+keyConnectorSettings__certificate__azureKeyvaultUri={Vault_URI}
+keyConnectorSettings__certificate__azureKeyvaultCertificateName={Certificate_Name}
+keyConnectorSettings__certificate__azureKeyvaultAdTenantId={ActiveDirectory_TenantId}
+keyConnectorSettings__certificate__azureKeyvaultAdAppId={AppRegistration_ApplicationId}
+keyConnectorSettings__certificate__azureKeyvaultAdSecret={AppRegistration_ClientSecretValue}
+```
+
+#### Hashicorp Vault
+
+If the certificate is stored in Hashicorp Vault, specify the following values:
+
+```
+keyConnectorSettings__rsaKey__provider=certificate
+keyConnectorSettings__certificate__provider=vault
+keyConnectorSettings__certificate__vaultServerUri={Server_URI}
+keyConnectorSettings__certificate__vaultToken={Token}
+keyConnectorSettings__certificate__vaultSecretMountPoint={Secret_MountPoint}
+keyConnectorSettings__certificate__vaultSecretPath={Secret_Path}
+keyConnectorSettings__certificate__vaultSecretDataKey={Secret_DataKey}
+keyConnectorSettings__certificate__vaultSecretFilePassword={Secret_FilePassword}
+```
+
+{% endcapture %}
+{{ cert_content | markdownify }}
+
+
+{% capture key_content %}
+### Key Pair
+
+To use a Cloud Provider or physical device to store to a RSA 2048 key pair, specify the values required depending on your chosen implementation (see **Azure Key Vault**, **Google Cloud Key Management**, etc.):
+
+#### Azure Key Vault
+
+If you're using Azure Key Vault to store a RSA 2048 key pair, specify the following values:
+
+{% callout info %}
+To use Azure Key Vault to store your RSA 2048 key, you'll need to create an Active Directory **App Registration**. This App Registration must:
+- Give delegated API permissions to access Azure Key Vault
+- Have a client secret generated to allow access by Key Connector
+{% endcallout %}
+
+```
+keyConnectorSettings__rsaKey__provider=azurekv
+keyConnectorSettings__rsaKey__azureKeyvaultUri={Vault_URI}
+keyConnectorSettings__rsaKey__azureKeyvaultKeyName={Key_Name}
+keyConnectorSettings__rsaKey__azureKeyvaultAdTenantId={ActiveDirectory_TenantId}
+keyConnectorSettings__rsaKey__azureKeyvaultAdAppId={AppRegistration_ApplicationId}
+keyConnectorSettings__rsaKey__azureKeyvaultAdSecret={AppRegistration_ClientSecretValue}
+```
+
+[Learn how to use Azure Key Vault to create a key pair](https://docs.microsoft.com/en-us/azure/key-vault/keys/quick-create-portal){:target="\_blank"}
+
+#### Google Cloud Key Management
+
+If you're using Google Cloud Key Management to store a RSA 2048 key pair, specify the following values:
+
+```
+keyConnectorSettings__rsaKey__provider=gcpkms
+keyConnectorSettings__rsaKey__googleCloudProjectId={Project_Id}
+keyConnectorSettings__rsaKey__googleCloudLocationId={Location_Id}
+keyConnectorSettings__rsaKey__googleCloudKeyringId={Keyring_Id}
+keyConnectorSettings__rsaKey__googleCloudKeyId={Key_Id}
+keyConnectorSettings__rsaKey__googleCloudKeyVersionId={KeyVersionId}
+```
+
+[Learn how to use Google Cloud Key Management Service to create key rings and asymmetric keys](https://cloud.google.com/kms/docs/creating-asymmetric-keys){:target="\_blank"}
+
+#### AWS Key Management Service
+
+If you're using AWS Key Management Service (KMS) to store a RSA 2048 key pair, specify the following values:
+
+```
+keyConnectorSettings__rsaKey__provider=awskms
+keyConnectorSettings__rsaKey__awsAccessKeyId={AccessKey_Id}
+keyConnectorSettings__rsaKey__awsAccessKeySecret={AccessKey_Secret}
+keyConnectorSettings__rsaKey__awsRegion={Region_Name}
+keyConnectorSettings__rsaKey__awsKeyId={Key_Id}
+```
+
+[Learn how to use AWS KMS to create asymmetric keys](https://docs.aws.amazon.com/kms/latest/developerguide/asymm-create-key.html){:target="\_blank"}
+
+#### PKCS11 Physical HSM
+
+If you're using a physical HSM device with the PKCS11 provider, specify the following values:
+
+```
+keyConnectorSettings__rsaKey__provider=pkcs11
+keyConnectorSettings__rsaKey__pkcs11Provider={Provider}
+keyConnectorSettings__rsaKey__pkcs11SlotTokenSerialNumber={Token_SerialNumber}
+keyConnectorSettings__rsaKey__pkcs11LoginUserType={Login_UserType}
+keyConnectorSettings__rsaKey__pkcs11LoginPin={Login_PIN}
+
+ONE OF THE FOLLOWING TWO:
+keyConnectorSettings__rsaKey__pkcs11PrivateKeyLabel={PrivateKeyLabel}
+keyConnectorSettings__rsaKey__pkcs11PrivateKeyId={PrivateKeyId}
+```
+
+Where:
+- `{Provider}` can be `yubihsm` or `opensc`
+- `{Login_UserType}` can be `user`, `so`, or `context_specific`
+
+{% callout info %}
+If you're using the PKCS11 provider to store your private key on an HSM device, the associated public key must be made available and configured as a certificate using any of the options found in the **Certificates** tab.
+{% endcallout %}
+
+{% endcapture %}
+{{ key_content | markdownify }}
+
+
+
+
+
## Link your Account
You should only need to link your account to SSO if you already have a Bitwarden account that's a member of the Organization or if your Organization does not require you to use SSO:
diff --git a/_articles/miscellaneous/cli.md b/_articles/miscellaneous/cli.md
index 575c5130..c09720b2 100644
--- a/_articles/miscellaneous/cli.md
+++ b/_articles/miscellaneous/cli.md
@@ -562,7 +562,7 @@ bw confirm org-member 7063feab-4b10-472e-b64c-785e2b870b92 --organizationid 310d
The `config` command specifies settings for the Bitwarden CLI to use:
```
-bw config
+{% capture mp_content %}
+### Login with SSO & Master Password
+
+To login using SSO and your Master Password:
+
+1. Open your Bitwarden Web Vault and select the **Enterprise Single Sign-On** button:
{% image sso/sso-button-lg.png Enterprise Single Sign-On button %}
-
2. Enter your **Organization Identifier** and select **Log In**:
{% image sso/org-id-input.png Organization Identifier field %}
- {% callout success %}We recommend bookmarking this page with your Organization Identifier included as a query string so that you don't have to enter it each time, for example `https://vault.bitwarden.com/#/sso?identifier=YOUR-ORG-ID` or `https://your.domain.com/#/sso?identifier=YOUR-ORG-ID`.{% endcallout %}
-3. Now that you've authenticated your identity using Login with SSO, you'll be prompted to either **create** a [Master Password]({{site.baseurl}}/article/master-password/) for your new account or if you already have a Bitwarden account, to enter your [Master Password]({{site.baseurl}}/article/master-password/) on the Login screen to **decrypt** your Vault.
+ {% callout success %}We recommend bookmarking this page with your Organization Identifier included as a query string so that you don't have to enter it each time, for example `https://vault.bitwarden.com/#/sso?identifier=YOUR-ORG-ID` or `https://your.domain.com/#/sso?identifier=YOUR-ORG-ID`. {% endcallout %}
+3. Now that you've authenticated your identity using SSO, you'll be prompted to either **create** a [Master Password]({{site.baseurl}}/article/master-password/) for your new account or, if you already have a Bitwarden account, to enter your Master Password to decrypt your Vault.
-{% callout success %}
+{% callout info %}
**Why is my Master Password still required?**
-All Vault data, including credentials [shared by your Organization]({{site.baseurl}}/article/sharing/), is kept by Bitwarden **only** in its encrypted form. This means that in order to use any of those credentials, **you** need a way to decrypt that data (we can't).
+All Vault data, including credentials [shared by your Organization]({{site.baseurl}}/article/sharing/), is kept by Bitwarden **only** in its encrypted form. This means that in order to use any of those credentials, **you** need a way to decrypt that data. We can't.
-Your Master Password is the source of that decryption key. Even though you're authenticating (proving your identity) to Bitwarden using SSO, you still must use that decryption key (your Master Password) to see any meaningful data.
+Your Master Password is the source of that decryption key. Even though you're authenticating (proving your identity) to Bitwarden using SSO, you still need to use a decryption key (your Master Password) to unscramble Vault data.
{% endcallout %}
+{% endcapture %}
+{{ mp_content | markdownify }}
+
+
+{% capture kc_content %}
+### Login with SSO & Key Connector
+
+To login using SSO and Key Connector:
+
+1. Open your Bitwarden Web Vault and select the **Enterprise Single Sign-On** button:
+
+ {% image sso/sso-button-lg.png Enterprise Single Sign-On button %}
+2. Enter your **Organization Identifier** and select **Log In**:
+
+ {% image sso/org-id-input.png Organization Identifier field %}
+
+ {% callout success %}We recommend bookmarking this page with your Organization Identifier includes as a query string so that you don't have to enter it each time, for example `https://vault.bitwarden.com/#/sso?identifier=YOUR-ORG-ID` or `https://your.domain.com/#/sso?identifier=YOUR-ORG-ID`.{% endcallout %}
+3. Depending on your account status, you might be required to enter or create a Master Password the first time you login with SSO and Key Connector. If you do, the following dialog should prompt you to remove your Master Password:
+
+ {% image sso/keyconnector/remove-mpw.png Remove Master Password %}
+
+ {% callout success %}We encourage you to read [this]({{site.baseurl}}/article/about-key-connector/#impact-on-master-passwords) and [this]({{site.baseurl}}/article/about-key-connector/#impact-on-organization-membership) to fully understand what it means to remove a Master Password from your account. You can instead elect to **Leave the Organization** instead, however this will remove access to both Organization-owned Vault items and Collections and to Single Sign-On.{% endcallout %}
+
+Once you're removed your Master Password, or if this isn't your first time logging in using SSO and Key Connector, you'll be logged in to your Vault with no further steps required!
+
+{% endcapture %}
+{{ kc_content | markdownify }}
+
+This approach ensures that you can: - Leverage your existing Identity Provider - Protect the end-to-end encryption of your data - Provision users automatically - Configure access with or without SSO -- Decrypt Vault data wile offline +- Decrypt Vault data according to your company's security needs ### Enterprise Policies diff --git a/_articles/plans-and-pricing/about-bitwarden-plans.md b/_articles/plans-and-pricing/about-bitwarden-plans.md index 98a35aff..7efdd6e7 100644 --- a/_articles/plans-and-pricing/about-bitwarden-plans.md +++ b/_articles/plans-and-pricing/about-bitwarden-plans.md @@ -110,22 +110,10 @@ In the following table, "premium features" (included for **Teams Organizations** |[API access]({% link _articles/organizations/public-api.md %})|-||| |[Directory Connector]({% link _articles/directory-connector/directory-sync.md %})|-||| |[Login with SSO]({% link _articles/login-with-sso/about-sso.md %})|-|-|| +|[Key Connector]({{site.baseurl}}/article/about-key-connector/)|-|-|| |[Enterprise Policies]({% link _articles/organizations/policies.md %})|-|-|| |[Admin Password Reset]({{site.baseurl}}/article/admin-reset/)|-|-|| +|[Self-host Option]({{site.baseurl}}/article/install-on-premise/)|-|-|| |[Custom Management Role]({{site.baseurl}}/article/user-types-access-control/)|-|-|| -|[Self-host option]({{site.baseurl}}/article/install-on-premise/)|-|-|| +|[Families Sponsorship for Members]({{site.baseurl}}/article/families-for-enterprise/)|-|-|| |Cost to you|Free|$3 Per User Per Month, billed annually
or
$4 Per User Per Month, billed monthly|$5 Per User Per Month, billed annually
or
$6 Per User Per Month, billed monthly| - -### Next Steps - -For help choosing the right plan, see: -- [What Plan is Right for Me?]({{site.baseurl}}/article/what-plan-is-right-for-me/) - -For help moving from an individual plan to an Organization, see: -- [Upgrade From Individual to Organization]({{site.baseurl}}/article/upgrade-from-individual-to-org/) - -For help starting a free trial of Bitwarden Enterprise, see: -- [Start a Free Trial of Bitwarden Enterprise]({{site.baseurl}}/article/enterprise-free-trial/) - -Still can't find what you're looking for? -- Try our [Billing FAQs]({{site.baseurl}}/article/billing-faqs/) diff --git a/_articles/plans-and-pricing/enterprise-feature-list.md b/_articles/plans-and-pricing/enterprise-feature-list.md index 3c171372..3febb1ec 100644 --- a/_articles/plans-and-pricing/enterprise-feature-list.md +++ b/_articles/plans-and-pricing/enterprise-feature-list.md @@ -23,6 +23,7 @@ This document describes and references the features available to Bitwarden Enter |Desktop Applications|Available for Windows, Mac, and Linux. [Learn more]({{site.baseurl}}/article/directory-sync-desktop/).| |CLI|Fully featured and self-documented command-line tool. [Learn more]({{site.baseurl}}/article/cli/). |Streamlined UI Design|Simple and uniform interfaces across apps for complete ease-of-use.| +|Complimentary Families Plan for Employees|All Enterprise Organization members can redeem a complimentary Bitwarden families plan for a new or existing personal Bitwarden account. [Learn more]({{site.baseurl}}/article/families-for-enterprise/).| #### Administrative Features and Capabilities @@ -50,7 +51,7 @@ This document describes and references the features available to Bitwarden Enter |2FA for Individuals|A robust set of 2FA options for any Bitwarden user. [Learn more]({{site.baseurl}}/article/setup-two-step-login/).| |2FA at Organization-level|Enable 2FA via Duo for your entire Organization. [Learn more]({{site.baseurl}}/article/setup-two-step-login-duo/).| |Biometric Authentication|Available for:
-Android (fingerprint unlock or face unlock) and iOS (Touch ID and Face ID)
-Windows Desktop Apps (Windows Hello using PIN, Facial Recognition, and more) and macOS Desktop Apps (Touch ID)
-Chromium, Firefox 87+, and Safari Browser Extensions
[Learn more]({{site.baseurl}}/article/biometrics/).| -|Login with SSO|Leverage your existing Identity Provider to authenticate your Bitwarden Organization users via SAML 2.0 or OpenID Connect (OIDC). [Learn more]({{site.baseurl}}/article/about-sso/).| +|Login with SSO|Leverage your existing Identity Provider to authenticate your Bitwarden Organization users via SAML 2.0 or OpenID Connect (OIDC). [Learn more]({{site.baseurl}}/article/about-sso/).
Using Login with SSO, you can use one of two decryption options to determine how users decrypt Vault data once authenticated. [Learn more]({{site.baseurl}}/article/sso-decryption-options).| #### Security diff --git a/_articles/plans-and-pricing/enterprise-free-trial.md b/_articles/plans-and-pricing/enterprise-free-trial.md index cdc9525c..bc0b5247 100644 --- a/_articles/plans-and-pricing/enterprise-free-trial.md +++ b/_articles/plans-and-pricing/enterprise-free-trial.md @@ -32,6 +32,7 @@ If you already have a Bitwarden account, complete the following steps to start y {% endcallout %} 4. If you're trialing the Enterprise Plan on behalf of a business: + - Check the **This account is owned by a business** checkbox. - Provide your **Business Name**. 5. Select the **Enterprise** plan option. Doing so will trigger additional enterprise-oriented fields to be displayed. diff --git a/_articles/plans-and-pricing/families-for-enterprise.md b/_articles/plans-and-pricing/families-for-enterprise.md new file mode 100644 index 00000000..c049694f --- /dev/null +++ b/_articles/plans-and-pricing/families-for-enterprise.md @@ -0,0 +1,72 @@ +--- +layout: article +title: Redeem Families Sponsorship +categories: [plans-and-pricing] +featured: false +popular: false +tags: [families organizations, enterprise organizations, sponsorship] +order: "05" +description: "This article explains how Enterprise Organization users can redeem a free Families Organization for use in their personal lives." +--- + +Members of [Enterprise Organizations]({{site.baseurl}}/article/about-organizations/#types-of-organizations) are offered a **free Families Organization** sponsorship that can be applied to a new or pre-existing Families Organization and redeemed directly from the Web Vault. + +Using a **Families Organization**, you can securely share Vault data between yourself and up to 5 friends or family members. Families Organizations include premium Bitwarden features for all 6 users, including [advanced Two-step Login methods]({{site.baseurl}}/article/setup-two-step-login), [encrypted file attachments]({{site.baseurl}}/article/attachments), [Emergency Access]({{site.baseurl}}/article/emergency-access/), and [more]({{site.baseurl}}/article/about-bitwarden-plans/#compare-the-plans). + +## Redeem your Sponsorship + +To redeem your sponsorship: + +1. Log in to the Bitwarden account attached to the sponsoring Organization. +2. Navigate to **Settings** → **Free Bitwarden Families**: + + {% image plans-and-pricing/f4e/f4e-1-alt.png Redeem your Free Bitwarden Families Sponsorship %} +3. On this screen, provide a **personal email** you want to redeem the sponsorship with and select **Redeem**: + + {% callout success%}If you already have a separate personal Bitwarden account, use the email address attached to that account. If you don't already have a separate personal Bitwarden account, you'll need to create one with the personal email you enter here.
**Do not** use the email address or Bitwarden account attached to the sponsoring Organization.{% endcallout %} +4. In your inbox, you'll get an email from Bitwarden inviting you to accept the sponsorship: + + {% image plans-and-pricing/f4e/f4e-2.png Families Sponsorship Email %} + + Select **Accept Sponsorship** to continue. +5. If there is a Bitwarden account associated with the provided **personal email**, log in. If there is not an account associated with the personal email, you'll be directed to the Create Account screen. +6. Once you've logged in, you'll be directed to a screen where you can finish redeeming your sponsorship for a **New Families Organization** or an **Existing Families Organization**: + + +
+
+
+{% callout success %}
+**Congratulations!** If you're new to using Bitwarden Families Organizations, we recommend checking out [this article]({{site.baseurl}}/article/getting-started-organizations/#get-to-know-your-organization) to learn the basics.
+{% endcallout %}
diff --git a/_articles/plans-and-pricing/organization-renewal.md b/_articles/plans-and-pricing/organization-renewal.md
index 2b98a1dc..6e4da3e4 100644
--- a/_articles/plans-and-pricing/organization-renewal.md
+++ b/_articles/plans-and-pricing/organization-renewal.md
@@ -6,7 +6,7 @@ featured: false
popular: false
hidden: false
tags: [plans, premium, renewal]
-order: "07"
+order: "08"
description: "Learn what to do when your Bitwarden Organization subscription renewal date approaches."
---
diff --git a/_articles/plans-and-pricing/premium-renewal.md b/_articles/plans-and-pricing/premium-renewal.md
index 80f11a46..2c76acbc 100644
--- a/_articles/plans-and-pricing/premium-renewal.md
+++ b/_articles/plans-and-pricing/premium-renewal.md
@@ -6,7 +6,7 @@ featured: false
popular: false
hidden: false
tags: [plans, premium, renewal]
-order: "06"
+order: "07"
description: "Learn what to do when your Bitwarden subscription renewal date approaches."
---
diff --git a/_articles/plans-and-pricing/update-billing-info.md b/_articles/plans-and-pricing/update-billing-info.md
index 2ca16a22..6e4eaaca 100644
--- a/_articles/plans-and-pricing/update-billing-info.md
+++ b/_articles/plans-and-pricing/update-billing-info.md
@@ -5,7 +5,7 @@ categories: [plans-and-pricing]
featured: false
popular: false
tags: [account, billing, billing information, individual, organization, subscription]
-order: "05"
+order: "06"
description: "Learn how to update billing info in Bitwarden, including steps for individual and Organization subscriptions."
---
diff --git a/_articles/plans-and-pricing/upgrade-from-individual-to-org.md b/_articles/plans-and-pricing/upgrade-from-individual-to-org.md
index 7564948c..60c777fa 100644
--- a/_articles/plans-and-pricing/upgrade-from-individual-to-org.md
+++ b/_articles/plans-and-pricing/upgrade-from-individual-to-org.md
@@ -12,7 +12,7 @@ description: "Learn how to add an Organization subscription to your individual B
This article will guide existing individual Bitwarden users ([**Free**]({{site.baseurl}}/article/about-bitwarden-plans/#free-individual) or [**Premium**]({{site.baseurl}}/article/about-bitwarden-plans/#premium-individual)) through the process of transitioning to an Organizations plan ([**Free**]({{site.baseurl}}/article/about-bitwarden-plans/#free-organizations), [**Families**]({{site.baseurl}}/article/about-bitwarden-plans/#families-organizations), [**Teams**]({{site.baseurl}}/article/about-bitwarden-plans/#teams-organizations), or [**Enterprise**]({{site.baseurl}}/article/about-bitwarden-plans/#enterprise-organizations)) in order to start securely sharing data from Organizations with friends, family, co-workers, a department, or an entire company.
{% callout success %}
-If you're looking for how to upgrade an existing Free Organization to a paid Organization, see [this FAQ item]({{site.baseurl}}/article/org-faqs/#q-how-do-i-upgrade-my-free-organization) instead.
+If you're looking for how to upgrade an existing Free Organization to a paid Organization, see [this FAQ]({{site.baseurl}}/article/org-faqs/#q-how-do-i-upgrade-my-free-organization) instead.
{% endcallout %}
## Start Your Organization
@@ -30,11 +30,14 @@ Complete the following steps to start your Organization:
{% endcallout %}
4. If you're creating an Organization on behalf of a business:
+
- Check the **This account is owned by a business** checkbox.
- Provide your **Business Name**.
+
+
+
+
+
+
+
+ +
Select New Families Organization from the dropdown:
+
+ +
+
Fill in the following information:
+-
+
- An Organization Name. +
- A Billing Email. +
- Whether you want to add Additional Storage (GB). Your sponsorship covers 1 GB free. +
- Payment Information. +
+
You won't have to make any payments for the Families Organization as long as you are an active member of the sponsoring Organization, unless you add Additional Storage. When you're done filling in your information, select Submit.
+
+
+
+
+
+
+ +
Select the Organization from the dropdown and select Accept Offer:
+
+ +
+
When you accept the offer, your old subscription will be replaced by the Enterprise Sponsorship. You won't have to make any payments for the Families Organization as long as you are an active member of the sponsoring Organization.
+Checking the **This account is owned by a business** checkbox will automatically filter your plan options to those suited to businesses. If you represent a business interested in testing secure sharing using a Free Organization, leave this option unchecked. 5. In the **Choose Your Plan** section, select which type of Organization to create. Options include: + - **Free:** For testing or personal users to share with 1 other user. **[Learn more]({{site.baseurl}}/article/about-bitwarden-plans/#free-organizations)**. - **Families:** For personal use, to share with family & friends. **[Learn more]({{site.baseurl}}/article/about-bitwarden-plans/#families-organizations)**. - **Teams:** For businesses and other team organizations. **[Learn more]({{site.baseurl}}/article/about-bitwarden-plans/#teams-organizations)**. @@ -43,6 +46,7 @@ Complete the following steps to start your Organization: {% callout info %}Paid Organizations (Families, Teams, or Enterprise) include premium features for all enrolled users. For more information about Premium features, see [About Bitwarden Plans]({{site.baseurl}}/article/about-bitwarden-plans/#compare-the-plans/). {% endcallout %} 6. If you selected a Paid Organization, enter the following information: + - For **Teams** or **Enterprise**, enter the number of **User Seats** you need. Seats will be added if you exceed this number, unless you [specify a limit]({{site.baseurl}}/article/managing-users/#set-a-seat-limit). - For **Families**, **Teams**, or **Enterprise**, enter the amount of **Additional Storage (GB)** you need. You plan comes with 1 GB of shared encrypted file attachments, and you can add additional storage later if needed. - For **Teams** or **Enterprise**, select whether you'd like to be billed **Annually** or **Monthly**. Families Organizations may only be billed annually. diff --git a/_articles/plans-and-pricing/what-plan-is-right-for-me.md b/_articles/plans-and-pricing/what-plan-is-right-for-me.md index 22e7a1b7..5422c4e6 100644 --- a/_articles/plans-and-pricing/what-plan-is-right-for-me.md +++ b/_articles/plans-and-pricing/what-plan-is-right-for-me.md @@ -4,7 +4,7 @@ title: What Plan is Right for Me? categories: [plans-and-pricing] featured: false popular: false -hidden: false +hidden: true tags: [free, personal, organization, enterprise, teams, family, plans, subscription] order: "02" redirect_from: diff --git a/_articles/send/send-encryption.md b/_articles/send/send-encryption.md index 230a59e6..d2ed7aea 100644 --- a/_articles/send/send-encryption.md +++ b/_articles/send/send-encryption.md @@ -5,7 +5,7 @@ categories: [send] featured: true popular: false tags: [bitwarden send, send, about send, ephemeral sharing] -order: "07" +order: "08" description: "This article explains the security practices and implementation of Bitwarden Send - a tool for secure and ephemeral sharing." --- diff --git a/_articles/send/send-hosting.md b/_articles/send/send-hosting.md index b85f6802..ece03df8 100644 --- a/_articles/send/send-hosting.md +++ b/_articles/send/send-hosting.md @@ -5,7 +5,7 @@ categories: [send] featured: true popular: false tags: [] -order: "08" +order: "09" description: "This article describes steps you may need to take to use Bitwarden Send in a self-hosted environment." --- diff --git a/_articles/send/send-ios.md b/_articles/send/send-ios.md new file mode 100644 index 00000000..ef1b69f2 --- /dev/null +++ b/_articles/send/send-ios.md @@ -0,0 +1,11 @@ +--- +layout: article +title: Send from iOS Extension +categories: [send] +featured: true +popular: false +hidden: true +tags: [bitwarden send, send, create a send, how to, ephemeral sharing] +order: "07" +description: "Learn how to use Bitwarden Send directly from the iOS Share menu." +--- diff --git a/images/features/linked-custom-field.png b/images/features/linked-custom-field.png new file mode 100644 index 0000000000000000000000000000000000000000..1a64697c5556af6c0fa3789b373982faa524bb67 GIT binary patch literal 17669 zcmdVBbx>Sg^DYVm2@oK`-7Po-cXxM!d(gq%NswT{-7>iQ;1b+}yIXK~yOX@{_l4iN zb^f?@t4`ISYM4E1FWbG=>VCTW*`bQ^5=aQR2oMkuNK%rb$`BAxE8y#b*RbIKoK*pF z5D*Ak79t{wQX(S6iVgrX3u{vd2+7d+L^##he$3vT`&K7ZC~{(AiVI3fD!;g&uc#&A zl;EX^vp*-jML+0UM<_!e9iPO|!BDcJ_bY*U*ZtK