Bitwarden provider

[sHaggYcaT]

Copy of Bitwarden provider #1309 and external-secrets/kubernetes-external-secrets#675

It's an opensource and self-hosted security manager. Previous issue were closed because of incompatibility:

Hi @jdomag ! We can only support providers that have HTTP APIs / GRPC, and it would be better if they had a go sdk as well. Is that the case for Bitwarden?
If not, I'd rather close this issue until it is compatible. We are not going to install a cli to handle communications with a given provider. This was the same approach for 1 password provider - we only started considering it when a go sdk became available.

Actually, bitwarden has HTTP API (a standard/swagger REST API):

• link to documentation;
• link to cloud-based swagger UI

[gusfcarvalho]

hey @sHaggYcaT! Do you have any examples you can reference to which uses this API for getting the sensitive information? AFAIK (and from the documentation link you've just sent), there was no public method to return sensitive information.

There is even a notice on the documentation page forwarding you to use the CLI:

For management of Vault items, use the [CLI](https://bitwarden.com/help/cli/). Access to Vault items relies on Vault decryption, which must be done with a Master Password.

[sHaggYcaT]

OK. Than, I think, it doesn't work this way

[folliehiyuki]

https://bitwarden.com/help/vault-management-api has API endpoints to manage secret items. Note that they are exposed via bw serve command (not endpoints of the Bitwarden server) and doesn't have any authentication or encryption mechanism (already handled via bw serve middleman) so they shouldn't be served publicly.

This has quite a lot of limitations and security issues but I think it's worth looking into.

[WoozyMasta]

https://pkg.go.dev/github.com/cozy/cozy-stack/web/bitwarden

Package bitwarden exposes an API compatible with the Bitwarden Open-Soure apps.

[adalinesimonian]

https://pkg.go.dev/github.com/cozy/cozy-stack/web/bitwarden

Package bitwarden exposes an API compatible with the Bitwarden Open-Soure apps.

From what I can tell, that Go client package is being used precisely for the same purpose in the Cozy stack — as a vault backend for application secrets. Correct me if I'm wrong. It also seems to be actively maintained.

@gusfcarvalho, now that this package is available, could Bitwarden be re-considered as a provider in external-secrets?