Disable requiring verification code when user changes email

[tumatanquang]

I have not configured email sending (SMTP) for Vaultwarden and have also disabled the verification requirement when registering an account via - SIGNUPS_VERIFY=false in docker-compose.yml.

But when the user wants to change their login email via the web vault, they will always get a request to enter the verification code that has been sent to the new login email:

However, the problem is that no email containing the verification code will be sent, so they will not be able to change their login email.

So I hope there is a way/solution to completely disable the request to enter the verification code when the user changes their login email.

[stefan0xC]

You can enable LOG_LEVEL=debug then you should see the verification code in the logs:

vaultwarden/src/api/core/accounts.rs

Line 932 in a2ad1dc

debug!("Email change request for user ({}) to email ({}) with token ({token})", user.uuid, data.new_email);

[tumatanquang]

That is, after inviting, the user still has to create an account manually afterwards? So what is the Invite User function for? It can't even help bypass the - SIGNUPS_ALLOWED=false option.

[BlackDex]

I'm going to say this one more time. It works fine!

I even had SIGNUPS_ALLOWED set to false too haha. And... I even used a domain not even listed in the SIGNUPS_DOMAINS_WHITELIST.

Just create the user via the admin interface, let the user create an account with that specific mail address and it's done. User is logged in.

But again, what do I know about it.

[tumatanquang]

If - SIGNUPS_ALLOWED=false, the registration page will not appear so how to register an account? The Invite User function should be able to directly allow setting a password for the user, similar to when registering a user instead of just being a placeholder like it is now.

[BlackDex]

This specific info tells me that you are not running the latest version of Vaultwarden, as what you describe here is already fixed for over a month. https://github.com/dani-garcia/vaultwarden/releases/tag/1.34.3

Also, if for some reason that link isn't visible, you can still reach that page if really needed, and you can provide the user you created the placeholder for a link your self something like this https://my.domain.tld/#/signup, the main part is the /#/signup.

But, if you update to the latest version of Vaultwarden, then all your issues are gone.

Also, as mentioned before, Vaultwarden does not (and probably will not ever) contain the Bitwarden client encryption logic to generate a password and keys for a client. So, no the admin does not need to be able to provide a password, that is up to the creator of the account, and this workflow will not change in the future i think.

[tumatanquang]

It is the latest Vaultwarden version:

The latest version of Vaultwarden always shows the account creation page even if - SIGNUPS_ALLOWED=false is set, except that registration will be rejected (if not invited).

But I still hope there is an alternative to having to enter a verification code when the user changes their email address, like using TOTP.