/web/account, offered to everyone, lists every browser and client signed
in as you, with when each was last used, and signs any of them out, or all
but the current one. It sets up, replaces and removes the second factor,
and holds the password form, moved from the vault page. Administrators can
sign a user out everywhere from the People page.
The API gains GET and DELETE /api/v1/auth/sessions and DELETE
/api/v1/auth/totp. Sessions are named by a digest of their token, never the
token, and record when they were last used. Replacing or removing an active
second factor now needs the password and a current code.
Server version 0.10.0.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The Android app kept a pending browser sign-in in a thread inside the
login screen. Android often kills the process while the browser is in
front, so the approval reached the server but nothing collected it, and
the app came back signed out with nothing saved.
The pending device code is now kept in Prefs and collected whenever the
login screen resumes. The app passes return_url=keeporg://device-approved
when it starts the sign-in, and the server's approval page, after a
password or single sign-on, links back to it. Only the keeporg: scheme is
accepted. Against a server older than 0.9, which rejects the field, the
app retries without it.
Verified on an Android 15 emulator: approval collected after the process
was killed, and the fallback against the 0.8 server.
Server 0.9.0, Android 0.3.0 (versionCode 3).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Why: two questions about operating this turned up two gaps. "Where do I get
the admin password" had no answer once the line scrolled out of the log,
and "how do I set up OIDC" ran straight into a sign-in link that could not
work.
What:
- /oidc/login with no parameters now signs a browser in and ends in a
session cookie. It previously required the user code of a waiting client,
so the link on the web sign-in page always failed. With a code it still
approves a device, and the two paths no longer overlap: an empty user
code matches no pending device.
- POST /api/v1/auth/password, `keeporg passwd`, and a form on /web/vaults.
Changing a password requires the current one, and the one-time code when
a second factor is enrolled, and revokes that account's other sessions.
Until now nothing could change a password, which made the advice printed
at first start impossible to follow.
- keeporgd -reset-admin, for when that first password was not kept: a new
one printed once, any second factor cleared, sessions revoked. It writes
the state document directly and says to stop the server first.
- The client read stdin through a new buffered reader per prompt, so the
first prompt swallowed the rest and anything asking twice could not be
scripted. One shared reader now. A prompt for a password being set no
longer reads $KEEPORG_PASSWORD either; that variable holds the password
you sign in with, and taking it here would have set the new password to
the old one.
- HANDOVER gains a first-sign-in section and an OIDC setup section covering
the redirect URI, the config block, both entry points and how an identity
becomes an account.
Proved: OIDC now has tests, against a stub provider that serves discovery,
authorization, token and userinfo. They cover the web sign-in that was
broken, device approval, linking an existing account by username, the
refusal when auto_create is off, and a forged callback state. Eight more
cover the password change. Checked by hand with the real binaries: the
first-start password logs once and works, -reset-admin replaces it while
the old one stops working, and `keeporg passwd` changes it from a pipe.
Server 0.5.0, desktop clients 0.3.0.
Why: collaborative KeePass use needs one arbiter of "who wrote last" that
never sees a master password, plus access control that follows an org chart.
What: stdlib-only Go server. Metadata is a single JSON document with one
writer and atomic commit; KDBX payloads are versioned blobs on disk. Access
comes from a group tree where a grant on a group reaches every member below
it. Login is password+TOTP, invite links, or OIDC through a browser-approved
device flow. Pushes carry If-Match and are arbitrated by a per-database merge
strategy (server-wins by default). Updates are pushed to clients over SSE.
Proved: go test ./internal/... covers RFC 6238 vectors, ACL inheritance and
isolation, store rollback, blob pruning, every push verdict, and an
end-to-end HTTP pass over login, conflict, force, read-only grants, invite
redemption, TOTP enrolment, device login and the event stream.
root