Configure Bitwarden

refer to this section and the bitwarden about key connector https //bitwarden com/help/about key connector/ and deploy key connector https //bitwarden com/help/deploy key connector/ instructions for installation and configuration guidance perform the following steps to configure bitwarden set up and deploy key connector confirm endpoint values create database create and rsa key pair activate key connector before you start to get started using key connector for customer managed encryption, review the following requirements to use key connector, you must have the following components an enterprise organization a self hosted bitwarden server an active sso implementation enabled single organization and require single sign on authentication policies if your organization meets these requirements, including a team and infrastructure that supports key server management, contact bitwarden so they can activate key connector set up and deploy key connector after you contact bitwarden regarding key connector, they reach out to schedule a key connector discussion perform the following tasks to set up and deploy key connector obtain a new license file initialize key connector configure key connector obtain a license file after bitwarden enables key connector for your organization, complete the following steps to obtain the new license open the bitwarden cloud web app and go to your organization billing > subscription screen in the admin console scroll down and select \[ download license ] when prompted, enter the installation id used to install your self hosted server and select \[ submit ] if you don't know your installation id, retrieve it from /bwdata/env/global override env you won't need your license file immediately, but you must upload it to your self hosted server later initialize key connector to prepare your bitwarden server, perform the following steps to i nitialize key connector save a backup of bwdata/mssql after you start using key connector, we recommend that you have access to a pre key connector backup image in case you need it if you use an external mssql database, back up your database by following your usual procedure update your self hosted bitwarden installation to retrieve the latest changes /bitwarden sh update edit the bwdata/config yml file and enable key connector by setting enable key connector to true nano bwdata/config yml rebuild your self hosted bitwarden installation /bitwarden sh rebuild update your self hosted bitwarden installation again to apply the changes /bitwarden sh update configure key connector to configure key connector, perform the following steps d ownload the tarball of the linux pkcs #11 binaries from the {{futurex}} portal copy the linux pkcs #11 tar file to your bitwarden server extract the tar file the extracted content of the tar file is a single fxpkcs11 directory this directory contains the following files and directories (only the files and folders relevant to the installation process are included in this list) file name or directory description fxpkcs11 cfg pkcs #11 configuration file to use for hsm integrations x86/ this folder contains the module files for the 32 bit architecture x64/ this folder contains the module files for the 64 bit architecture the x86 and x64 directories contain multiple directories named for the specific openssl versions these openssl directories contain the pkcs #11 module files built with the respective openssl versions you must use the openssl 3 x binaries because that version is installed in the bitwarden key connector container file name description configtest program to test the configuration and connection to the hsm libfxpkcs11 so pkcs #11 library file pkcs11manager program to test the connection and manage the hsm through the pkcs #11 library convert the pem certificate created with fxcli in the previous section to pfx format using openssl openssl pkcs12 export nokeys in bitwarden cert pem out bitwarden cert pfx specify futurex123 as the password for the pfx file copy the following files to the /opt/bitwarden/bwdata/key connector directory as previously noted above, you must use the openssl 3 x binaries because that version is installed in the bitwarden key connector container bitwarden pfx pki p12 (the tls client certificate created for the {{futurex}} pkcs #11 library to mutually authenticate to the {{k3}} ) libfxpkcs11 so fxpkcs11 cfg pkcs11manager by putting these files in the /opt/bitwarden/bwdata/key connector directory, the system bind mounts them inside the bitwarden key connector container at /etc/bitwarden/key connector edit the bwdata/env/key connector override env file that came with the /bitwarden sh update you downloaded example key connector override env env keyconnectorsettings webvaulturi=https //ec2 34 193 223 21 compute 1 amazonaws com keyconnectorsettings identityserveruri=http //identity 5000 keyconnectorsettings database provider=json keyconnectorsettings database jsonfilepath=/etc/bitwarden/key connector/data json keyconnectorsettings certificate provider=filesystem keyconnectorsettings certificate filesystempath=/etc/bitwarden/key connector/bitwarden pfx keyconnectorsettings certificate filesystempassword=futurex123 keyconnectorsettings rsakey provider=pkcs11 keyconnectorsettings rsakey pkcs11librarypath=/etc/bitwarden/key connector/libfxpkcs11 so fxpkcs11 cfg=/etc/bitwarden/key connector/fxpkcs11 cfg keyconnectorsettings rsakey pkcs11slottokenserialnumber=3174612105 keyconnectorsettings rsakey pkcs11loginusertype=user keyconnectorsettings rsakey pkcs11loginpin=edy0dd29b2t82 fc0&@511h1m4d8 keyconnectorsettings rsakey pkcs11privatekeylabel=bitwarden the fxpkcs11 cfg=/etc/bitwarden/key connector/fxpkcs11 cfg enables the {{futurex}} pkcs #11 module to find the configuration file at the non default location ( /etc ) to determine the keyconnectorsettings rsakey pkcs11slottokenserialnumber value you must specify, run the pkcs11manager utility against your {{k3}} and select option 1 ( print library/token info ) set keyconnectorsettings rsakey pkcs11loginpin to the password value you configured for the bitwarden identity confirm endpoint values the automated setup populates endpoint values based on your installation configuration however, we recommend that you confirm the following values in key connector override env are accurate for your setup keyconnectorsettings webvaulturi=https //your bitwarden domain com keyconnectorsettings identityserveruri=http //identity 5000 create database key connector must access a database that stores encrypted user keys for your organization members create a secure database to store encrypted user keys and replace the default keyconnectorsettings database values in key connector override env with the values designated in the required values https //bitwarden com/help/deploy key connector/# text=http%3a//identity%3a5000 ,database, key%20connector%20must column for the chosen database the preceding example key connector override env defines local json , but we do not recommend this option except for testing for production environments, bitwarden recommends using one of the other supported database options (such as microsoft sql server, postgresql, mysql/mariadb, or mongodb) create an rsa key pair key connector uses an rsa key pair to protect user keys at rest you must replace the default keyconnectorsettings rsakey and keyconnectorsettings certificate values in key connector override env with the values required to integrate with {{ch}} the rsa key pair must be at a minimum 2048 bits in length key connector directly accesses the {{ch}} stored private key through the {{futurex}} pkcs #11 module and the x 509 certificate in the file system activate key connector now that you configured key connector and have a key connector enabled license complete the following steps restart your self hosted bitwarden installation to apply the configuration changes /bitwarden sh restart log in to your self hosted bitwarden as an organization owner and go to the admin console billing > subscription screen select \[ update license ] and upload the key connector enabled license retrieved in an earlier step if you haven't already, go to the settings > policies screen and enable the single organization and require single sign on authentication policies, which are required to use key connector go to the settings > single sign on screen the next few steps assume that you already have an active login with sso implementation using saml 2 0 or oidc if you don't, implement and test login with sso before proceeding in the member decryption options section, select key connector in the key connector url input, enter the address where you are running key connector (by default, https //your domain/key connector ) and select \[ test ] to ensure you can reach key connector scroll to the bottom of the screen and select \[ save ]