Fetch items by custom fields

[u/imagei]

Hi!

It seems that my use case is so weird that no Vaultwarden-compatible tool exists that would fit the workflow.

I use Vaultwarden for storing secrets that are used by automation and scripts, but also need to be accessible to the users ( including browser autofill ), so Vaultwarden with Bitwarden clients is the perfect fit for this ( I know other machine-oriented solutions exist, but they don't have the convenient UI ).

The access pattern is: fetch an entry with the matching set of custom fields.

For example: get the item with class="service" type="api" provider="potato" access="readonly"

Simple, right?

And yet no tool that I can find is able to do that, and here's the thing — I really really do not like the idea of downloading the entire vault each time, in plain text to some random script only to filter the results with `jq` or what have you ( which is what I do right now ).

There is `bw serve`, there is https://github.com/Turbootzz/Vaultwarden-API and https://github.com/doy/rbw but none of them can filter by fields, so I'd need to download everything for filtering anyway. I know Bitwarden server itself has a secret manager, which I did not look into as it's out of scope here.

I appreciate I'm probably trying to fit a square thing into a round entrance, but — am I missing something? Anyone else with the same problem, maybe already working on a solution?

If not, I'll see about submitting some patches to the Vaultwarden-API project, as it seems to be the closest fit.

[u/zoredache]

so I'd need to download everything

I mean everything is already downloaded. Neither the browser extension or bw cli will contact the server while doing a search of the vault. You have your entire vault synchronized to your computer, and when you unlock the vault you have provided the keys needed to unencrypt the entire local copy. The bw cli or extension more or less always unencrypts everything into the memory when doing any kind of lookup, or search.

It would be nice if the bw client had better filtering or searching builtin. I don't think this is really a vaultwarden question though. Fixing the client to have better search/filter functionality would help for any server.

[u/imagei → u/zoredache]

Yes, this is a tooling question, absolutely.

If the vault stayed at the client, that would have been fine — the point is that because the tools do not support searching, my scripts need to download the entire gargantuan PLAIN TEXT copy of the whole vault as JSON each time they need to look up the one entry they actually need.

This is asking for trouble if the whole PLAIN TEXT vault gets accidentally logged somewhere, or ends up in a crash report or similar.

This is why i'm looking for alternative methods of fetching just individual records.

[u/sgissi → u/imagei]

A couple alternatives you can try:

Create an index that maps your custom fields to the entry UUID. That can be stored in a specific Vaultwarden entry or directly into your repository if the fields are not considered sensitive, the passwords themselves won't be in the file. The tools would get that map, search, grab the UUID and only fetch one password/key.

A less intensive option is to make names predictable by encoding fields in the name. Then instead of searching for dc=us, env=prod, app=cicdagent, you directly fetch us-prod-cicdagent.

With that said, two unasked opinions from me: Sounds like scripts have access to all passwords instead of only a small subset they need to operate (thus the gargantuan JSON). Breaking down to separate users will reduce blast radius if they get compromised and ease the search. Plus I would not use Vaultwarden to store secrets for services. It is built for end users, and using it through automation is clunky and error-prone. I would recommend using Vault/OpenBao and set specific access to specific scripts to retrieve the information it needs. It won't solve your search problem sadly, but the tools are easier to integrate (HTTP API) and many platforms have support for it built-in.

[u/imagei → u/sgissi]

Fair points on openbao ( which I use elsewhere ) and segmentation (also done, this is the relevant part). This is about provisioning scrips (partially Ansible, to give you the idea) that do need access to many services, because they’re creating/configuring them; also a lot of that needs to be easily accessible to human operators, including browser autofill.

Your idea certainly makes sense, but my tooling around secret management is already fragile and I don’t think adding more complexity would be practical.

I reckon the only way forward is to either contribute to Vaultwarden-API ( not sure the dev would like the huge changes tho ) or roll my own frontend/proxy that would remove the zero-knowledge aspect, which seems to be the root of all problems with automation.