Vaultwarden Won’t Connect After Domain Migration (“Connecting… Reconnecting…”)

[oauth2-tmp-cloudron-1784273754379-im6vnh]

Hello everyone,
I migrated Vaultwarden from another Cloudron instance to my own instance (my server has an new Cloudron domain). Since then, the web UI hasn’t been connecting properly and constantly displays “Connecting… Reconnecting…”. Organizations and vaults aren’t loading.

I suspect that SSO was not enabled on the old instance, but SSO/proxy auth is now enabled on the new instance, and Vaultwarden doesn’t support it.

I created a final backup in the old environment and migrated the domain to another server. I then imported the entire configuration from the backups.

--> Current status in the Cloudron app's configuration overview: Not responding

Could someone help me and check whether my Vaultwarden app on Cloudron currently has SSO/proxy auth enabled and tell me how to disable it correctly? I have the feeling, that this problem happend since the last big update with SSO topics

Thanks for your support and feedback.

Greetings Wolfgang

[james]

Hello @oauth2-tmp-cloudron-1784273754379-im6vnh and welcome to the Cloudron forum

I see you did not chose a good username when logging in for the first time.
If you want me to change your username in the forum, please let me know.

@oauth2-tmp-cloudron-1784273754379-im6vnh said:

I suspect that SSO was not enabled on the old instance, but SSO/proxy auth is now enabled on the new instance, and Vaultwarden doesn’t support it.

When you installed the Vaultwarden app you had to chose between:

• Leave user management to the app (1)
• Allow all users on this Cloudron (2)
• Only allow selected users (3)

Only when you chose option 1 SSO is not enabled.

The Vaultwarden package is configuring the OIDC configuration dynamically on every app start up.
I don't think this is the issue.

@oauth2-tmp-cloudron-1784273754379-im6vnh said:

Could someone help me and check whether my Vaultwarden app on Cloudron currently has SSO/proxy auth enabled and tell me how to disable it correctly? I have the feeling, that this problem happend since the last big update with SSO topics

This can only be "enabled" and "disabled" when installing the Vaultwarden app.

Check the Log Viewer of the failing Vaultwarden installation and report any error here.
Or donwload the log file and upload it to https://paste.cloudron.io/ and provide the paste URL here so we can analyse the logs.

[oauth2-tmp-cloudron-1784273754379-im6vnh]

Hi James,

thanks for the clarification. I checked the Vaultwarden logs and I’m seeing several errors that seem related to the domain migration and the OIDC/SSO initialization that happens during app startup.

Here are the relevant log entries:
WebSocket connection failed: Error during WebSocket handshake
WebSocket URL mismatch: expected wss://<old-domain>, got wss://<new-domain>

OIDC: failed to initialize provider
OIDC: discovery failed
OIDC: invalid issuer URL
Failed to load OIDC settings from database

Error: Unauthorized: missing or invalid authentication header

startTask: installationState: pending_restart
startTask: runState: running

The symptoms match these errors:

UI stuck on “Connecting… Reconnecting…”

Organizations and vaults not loading

App status in Cloudron: “Not responding”

Vaultwarden was originally installed with Option 1 – Leave user management to the app, so SSO should not be active. The issue only appeared after the recent Cloudron update.

I restored the app from a backup of the old instance and then changed the domain. Since then, the WebSocket connection breaks immediately and the UI never loads.

Any guidance on how to resolve this would be appreciated.

Thanks for your help,
Wolfgang

[oauth2-tmp-cloudron-1784273754379-im6vnh]

@james I sent you a direct message
with for the uploaded logsfiles under: https://paste.cloudron.io

[james]

Hello @oauth2-tmp-cloudron-1784273754379-im6vnh
Please see https://forum.cloudron.io/topic/14812/vaultwarden-fails-to-start-after-update-db-migration-error-sso and apply the fix.