Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
28 commits
Select commit Hold shift + click to select a range
f723abe
Correct spelling of CSV
ravage84 Jul 31, 2025
ded602c
Correct spelling of KeePass & KeePassXC
ravage84 Jul 31, 2025
128589d
Correct spelling of Microsoft
ravage84 Jul 31, 2025
9b95338
Correct spelling of TOTP
ravage84 Jul 31, 2025
f430222
Correct spelling of Windows
ravage84 Jul 31, 2025
4814a86
Correct spelling of Google
ravage84 Jul 31, 2025
61081cb
Correct spelling of KDBX
ravage84 Jul 31, 2025
4bde680
Correct spelling of LastPass
ravage84 Jul 31, 2025
2c9c9e5
Correct spelling of 1Password
ravage84 Jul 31, 2025
cb9e45c
Correct spelling of NordPass
ravage84 Jul 31, 2025
5f0e03b
Correct spelling of MacPass
ravage84 Jul 31, 2025
80976e9
Correct spelling of Passbolt
ravage84 Jul 31, 2025
23370cb
Correct spelling of YubiKey
ravage84 Jul 31, 2025
017434c
Correct spelling of GPG
ravage84 Jul 31, 2025
ff4040b
Correct spelling of Passbolt
ravage84 Jul 31, 2025
f4f6aa2
Correct spelling of HTTP & HTTPS
ravage84 Jul 31, 2025
bde302e
Correct spelling of Debian
ravage84 Jul 31, 2025
713ec45
Correct spelling of Ubuntu
ravage84 Jul 31, 2025
3e7656c
Correct spelling of information
ravage84 Jul 31, 2025
5212408
Correct spelling of IP
ravage84 Jul 31, 2025
cfc0097
Correct spelling of Linux
ravage84 Jul 31, 2025
1f89e1a
Typos
ravage84 Jul 31, 2025
f85da01
Correct spelling of (Passbolt) Quickaccess
ravage84 Jul 31, 2025
a850e51
Correct spelling of MySQL
ravage84 Jul 31, 2025
c6e21e4
Correct spelling of MariaDB
ravage84 Jul 31, 2025
5734068
Correct spelling of Apache
ravage84 Jul 31, 2025
ae2099e
Correct spelling of PHP
ravage84 Jul 31, 2025
19d8399
Merge remote-tracking branch 'origin/main' into correct-spelling
ravage84 Sep 2, 2025
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -36,8 +36,8 @@ Affero General Public License v3.

## About Passbolt help site

This repository contains the code used for the knowledge base and help section of passbolt website.
Find out more about passbolt here:
This repository contains the code used for the knowledge base and help section of Passbolt website.
Find out more about Passbolt here:
[https://www.passbolt.com](https://www.passbolt.com "Passbolt Homepage")

## Contributing
Expand Down
2 changes: 1 addition & 1 deletion data/import-resources.json
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
[
{
"name": "Lastpass",
"name": "LastPass",
"slug": "lastpass",
"logo": "/img/import/lastpass.svg",
"formats": ["CSV"]
Expand Down
2 changes: 1 addition & 1 deletion data/mfa-providers.json
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
"logo": "/img/mfa-providers/duo.svg"
},
{
"name": "Yubikey",
"name": "YubiKey",
"slug": "yubikey",
"logo": "/img/mfa-providers/yubikey.svg"
},
Expand Down
2 changes: 1 addition & 1 deletion docs/admin/_includes/sso/email-matching-warning.mdx
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
:::danger
Emails from the SSO provider must match the email from passbolt you are authenticating with. This is to avoid having the possibility to use any accounts from the app registration and bypass the authentication.
Emails from the SSO provider must match the email from Passbolt you are authenticating with. This is to avoid having the possibility to use any accounts from the app registration and bypass the authentication.
:::
6 changes: 3 additions & 3 deletions docs/admin/authentication/account-recovery.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ You can follow this procedure if you are meeting the following requirements:

## How does it work?

Account recovery is a feature introduced with passbolt v3.6.0 that helps users to recover their accounts in
Account recovery is a feature introduced with Passbolt v3.6.0 that helps users to recover their accounts in
case of recovery kit or passphrase loss.

Depending on the organisation policy, all users will be able to deposit an encrypted backup of their private keys in
Expand Down Expand Up @@ -66,7 +66,7 @@ encrypt the escrow of the organisation users private keys.

#### Import the organisation key

This method is the recommended one as it will keep your organisation key isolated from passbolt until the moment you
This method is the recommended one as it will keep your organisation key isolated from Passbolt until the moment you
need it.

<Figure
Expand All @@ -78,7 +78,7 @@ size={{ width: '450px', height: 'auto' }}

In order to be accepted, the organisation key should meet these requirements:

- The key should be public gpg key
- The key should be public GPG key
- The key should use the algorithm RSA
- The key should have a length of 4096 bits
- The key should have a passphrase
Expand Down
20 changes: 10 additions & 10 deletions docs/admin/authentication/mfa/duo.mdx
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
---
title: How to configure passbolt to use Duo
title: How to configure Passbolt to use Duo
sidebar_label: Duo
description: How to configure Duo with Passbolt
hide_table_of_contents: false
Expand Down Expand Up @@ -32,7 +32,7 @@ Multi Factor Authentication requires HTTPS to work.

When using Duo as a form of multi-factor authentication, it is recommended to set up at least one additional multi-factor authentication method as a backup. Should the Duo service experience downtime, this measure guarantees that users can continue to access their accounts despite the malfunction of one authentication method.

In order to authenticate using Duo, the user will be redirected to Duo’s authentication page. Whether the authentication was successful, the user will be redirected back to passbolt. Make sure your users have access to internet or do not enable this authentication provider if you are running passbolt on a private network that is not connected to internet.
In order to authenticate using Duo, the user will be redirected to Duo’s authentication page. Whether the authentication was successful, the user will be redirected back to Passbolt. Make sure your users have access to internet or do not enable this authentication provider if you are running Passbolt on a private network that is not connected to internet.

## Install Duo app

Expand Down Expand Up @@ -71,11 +71,11 @@ Click on "Protect an application" then find the "Web SDK" application type in th

<Figure
src="/img/help/2023/02/mfa-duo-admin.png"
alt="Duo web sdk application for passbolt"
caption="fig. Duo web sdk application for passbolt"
alt="Duo web sdk application for Passbolt"
caption="fig. Duo web sdk application for Passbolt"
/>

Note down the "Client ID", "Client secret", and "API hostname" details, as it will be request to you later to configure the Duo integration in passbolt.
Note down the "Client ID", "Client secret", and "API hostname" details, as it will be request to you later to configure the Duo integration in Passbolt.

## Enable Duo access

Expand All @@ -84,17 +84,17 @@ Duo can be set up through either the administration interface or environment var
### Generate a salt

:::info
Required only for passbolt server < 3.11.
Required only for Passbolt server < 3.11.
:::

Generating a random salt to configure Duo is mandatory, a salt is a random piece of data that is generated and used in the hashing process to protect sensitive information. It is generated and combined with the secret key before hashing it.

To generate a random salt, you can use the passbolt interface, generate a new password as shown below and use it as the generated salt.
To generate a random salt, you can use the Passbolt interface, generate a new password as shown below and use it as the generated salt.

<Figure
src="/img/help/2023/05/password-generator.png"
alt="Generate a salt with passbolt password generator"
caption="fig. Generate a salt with passbolt password generator"
alt="Generate a salt with Passbolt password generator"
caption="fig. Generate a salt with Passbolt password generator"
size={{ width: '450px', height: 'auto' }}
/>

Expand Down Expand Up @@ -144,7 +144,7 @@ size={{ width: '450px', height: 'auto' }}

## Authenticate with Duo

After setting up Duo, each time you sign-in to Passbolt, you'll be prompted to plug authenticate with the method you have chosen during the setup. Additionally, if permitted by the "Multi-factor Authentication Policy", passbolt can remember your MFA authentication for a month.
After setting up Duo, each time you sign-in to Passbolt, you'll be prompted to plug authenticate with the method you have chosen during the setup. Additionally, if permitted by the "Multi-factor Authentication Policy", Passbolt can remember your MFA authentication for a month.

<Figure
src="/img/help/2023/02/mfa-duo-login.png"
Expand Down
2 changes: 1 addition & 1 deletion docs/admin/authentication/mfa/index.mdx
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
---
title: How to configure passbolt to use MFA
title: How to configure Passbolt to use MFA
sidebar_label: MFA
description: How to configure MFA with Passbolt
hide_table_of_contents: true
Expand Down
8 changes: 4 additions & 4 deletions docs/admin/authentication/mfa/totp.mdx
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
---
title: How to configure passbolt to use TOTP
title: How to configure Passbolt to use TOTP
sidebar_label: TOTP
description: How to configure passbolt to use TOTP
description: How to configure Passbolt to use TOTP
hide_table_of_contents: false
---

Expand Down Expand Up @@ -47,7 +47,7 @@ To enable TOTP for the organization, navigate to the multi-factor authentication

## Setup TOTP as a user

To setup TOTP as multi-factor authentication method, navigate to the multi-factor authentication user settings page: *Avatar > Profil > Multi Factor Authentication*. Next, you should be able to select the provider "TOTP Authenticator".
To setup TOTP as multi-factor authentication method, navigate to the multi-factor authentication user settings page: *Avatar > Profile > Multi Factor Authentication*. Next, you should be able to select the provider "TOTP Authenticator".

<Figure
src="/img/help/2025/04/totp-passbolt-user-enable.png"
Expand All @@ -67,7 +67,7 @@ The next step will show a QR code that you can scan with the Google Authenticato

## Authenticate with TOTP

After setting up TOTP, each time you sign-in to Passbolt, you'll need to enter the six-digit code from the Google Authenticator app. Additionally, if permitted by the "Multi-factor Authentication Policy", passbolt can remember your MFA authentication for a month.
After setting up TOTP, each time you sign-in to Passbolt, you'll need to enter the six-digit code from the Google Authenticator app. Additionally, if permitted by the "Multi-factor Authentication Policy", Passbolt can remember your MFA authentication for a month.

<Figure
src="/img/help/2025/04/totp-passbolt-user-authenticate.png"
Expand Down
34 changes: 17 additions & 17 deletions docs/admin/authentication/mfa/yubikey.mdx
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
---
title: How to configure passbolt to use Yubikey
sidebar_label: Yubikey
title: How to configure Passbolt to use YubiKey
sidebar_label: YubiKey
description: How to configure YubiKey with Passbolt
hide_table_of_contents: false
---
Expand All @@ -14,34 +14,34 @@ import Chips from "/src/components/Chips/Chips";
<Chips link="https://www.passbolt.com/pricing/cloud" isUnderMainTitle={true}>Cloud</Chips>
</div>

Passbolt Pro Edition since v2.5 and CE since v3.9 support Yubikeys and more precisely Yubico OTP as a multi factor authentication option.
Passbolt Pro Edition since v2.5 and CE since v3.9 support YubiKeys and more precisely Yubico OTP as a multi factor authentication option.

Yubico OTP is a simple authentication mechanism that is supported by all YubiKeys out of the box and it can be used in addition to another authentication method (such as username and password).

<Figure
src="/img/help/2018/11/mfa-yubikey-login.jpg"
alt="Using a Yubikey at login"
caption="fig. Using a Yubikey at login"
alt="Using a YubiKey at login"
caption="fig. Using a YubiKey at login"
/>

:::important
Please note than only [Yubikey 5 Series](https://www.yubico.com/products/yubikey-5-overview/) are supported. [Security Keys](https://www.yubico.com/products/security-key/) with FIDO2/U2F/WebAuthN support are currently not supported.
Please note than only [YubiKey 5 Series](https://www.yubico.com/products/yubikey-5-overview/) are supported. [Security Keys](https://www.yubico.com/products/security-key/) with FIDO2/U2F/WebAuthN support are currently not supported.
:::
:::important
Multi Factor Authentication requires HTTPS to work.
:::

## Security considerations

When using Yubikey as a form of multi-factor authentication, it is recommended to set up at least one additional multi-factor authentication method as a backup. Should users lose their Yubikeys, this measure guarantees that users can continue to access their accounts despite the malfunction of one authentication method.
When using YubiKey as a form of multi-factor authentication, it is recommended to set up at least one additional multi-factor authentication method as a backup. Should users lose their YubiKeys, this measure guarantees that users can continue to access their accounts despite the malfunction of one authentication method.

Another key point to consider is that Passbolt verifies whether the key ID used during a login attempt matches the one used at setup. If a user needs to change their key, the second factor must be disabled in advance, either by the user in their User Profile or by an administrator in the Users workspace, especially if the device is lost.

## Register to YubiCloud

In order to use YubiKey to authenticate to passbolt you first need get an API key for YubiCloud, Yubico’s web service for verifying one time passwords (OTPs).
In order to use YubiKey to authenticate to Passbolt you first need get an API key for YubiCloud, Yubico’s web service for verifying one time passwords (OTPs).

Navigate to [upgrade.yubico.com](https://upgrade.yubico.com/getapikey) and signup to the service using your email and your Yubikey.
Navigate to [upgrade.yubico.com](https://upgrade.yubico.com/getapikey) and signup to the service using your email and your YubiKey.

Please note that it is no longer possible to [host yourself the OTP validation server](https://support.yubico.com/hc/en-us/articles/360021227000-YK-VAL-YK-KSM-and-YubiHSM-1-End-of-Life).

Expand All @@ -53,7 +53,7 @@ Please note that it is no longer possible to [host yourself the OTP validation s

## Allow connections to YubiCloud

To authenticate with Yubikey, passbolt will establish a connection with the YubiCloud service. Make sure that the passbolt server allows outgoing connections to the following domains:
To authenticate with YubiKey, Passbolt will establish a connection with the YubiCloud service. Make sure that the Passbolt server allows outgoing connections to the following domains:

- api.yubico.com
- api2.yubico.com
Expand All @@ -63,11 +63,11 @@ To authenticate with Yubikey, passbolt will establish a connection with the Yubi

Please note that one or more of these domains may be used to try to validate an OTP.

## Enable Yubikey access
## Enable YubiKey access

Yubikey can be set up through either the administration interface or environment variables. Should both settings providers be utilized, the configurations made in the administration interface will take precedence over those specified by environment variables.
YubiKey can be set up through either the administration interface or environment variables. Should both settings providers be utilized, the configurations made in the administration interface will take precedence over those specified by environment variables.

### Enable Yubikey access via the interface
### Enable YubiKey access via the interface

To enable YubiKey via the interface, navigate to the multi-factor authentication administration page: *Administration > Multi Factor Authentication*.

Expand All @@ -79,7 +79,7 @@ Subsequently, enable the "YubiKey" provider by moving the adjacent toggle to the
caption="fig. Enable YubiKey in administration settings"
/>

### Enable Yubikey access via environment variables
### Enable YubiKey access via environment variables

If you are [using docker](/hosting/install/ce/docker/), you can set these environment variables to enable YubiKey for your organization.

Expand All @@ -96,13 +96,13 @@ The next step will require you to plug your YubiKey and touch it to release a Yu

<Figure
src="/img/help/2025/04/yubikey-passbolt-user-setup.png"
alt="Register your Yubikey"
caption="fig. Register your Yubikey"
alt="Register your YubiKey"
caption="fig. Register your YubiKey"
/>

## Authenticate with YubiKey

After setting up YubiKey, each time you sign-in to Passbolt, you'll be prompted to plug your device and touch it to release a Yubico OTP. Additionally, if permitted by the "Multi-factor Authentication Policy", passbolt can remember your MFA authentication for a month.
After setting up YubiKey, each time you sign-in to Passbolt, you'll be prompted to plug your device and touch it to release a Yubico OTP. Additionally, if permitted by the "Multi-factor Authentication Policy", Passbolt can remember your MFA authentication for a month.

<Figure
src="/img/help/2025/04/yubikey-passbolt-user-authenticate.png"
Expand Down
2 changes: 1 addition & 1 deletion docs/admin/authentication/sso/google.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -138,7 +138,7 @@ When credentials are created, you'll get Client ID and Client secret. These are
/>

:::caution[Things to consider]
The Authorized redirect URIs should be the URL given by the passbolt while configuring SSO from administration (https://your-domain.com/app/administration/sso). Google can accept any valid URL in redirect URLs but it might not work with passbolt.
The Authorized redirect URIs should be the URL given by the passbolt while configuring SSO from administration (https://your-domain.com/app/administration/sso). Google can accept any valid URL in redirect URLs but it might not work with Passbolt.
:::

## Configure SSO through the GUI
Expand Down
18 changes: 9 additions & 9 deletions docs/admin/authentication/sso/microsoft.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ Since version 3.9, Passbolt Pro Edition supports SSO with Entra ID.

## How does it work?

In short Passbolt SSO leverages Entra ID OAuth2/OpenID on top of the existing [challenge-based authentication](https://help.passbolt.com/api/authentication). The user by logging in Microsoft unlocks a key stored server side needed to decrypt the secret key passphrase twice encrypted with a non-extractable symetric key stored in the browser extension local storage client side.
In short Passbolt SSO leverages Entra ID OAuth2/OpenID on top of the existing [challenge-based authentication](https://help.passbolt.com/api/authentication). The user by logging in Microsoft unlocks a key stored server side needed to decrypt the secret key passphrase twice encrypted with a non-extractable symmetric key stored in the browser extension local storage client side.

To understand which user flows are supported currently, the risk analysis, and how it works in practice please read the [developer documentation](https://docs.google.com/document/d/1S58TonJ2uXwkaKl7WwLzTzmwJGiSJdhlqP-xbmxFBd0/edit).

Expand All @@ -47,10 +47,10 @@ Open both the Entra admin center and Passbolt:
caption="fig. Passbolt administration"
/>

You must ensure users are present both in passbolt and Entra ID, the email is used to correlate accounts.
You must ensure users are present both in Passbolt and Entra ID, the email is used to correlate accounts.

* Users that are not present in Entra ID but are present in passbolt will not be able to use SSO (a message on microsoft side will be shown).
* Users that are not present in passbolt but are present in Entra ID will not be able to login in passbolt (a message on passbolt side will be shown).
* Users that are not present in Entra ID but are present in Passbolt will not be able to use SSO (a message on Microsoft side will be shown).
* Users that are not present in Passbolt but are present in Entra ID will not be able to login in Passbolt (a message on Passbolt side will be shown).

<Figure
src="/img/help/2024/10/just_logged_onEntra.png"
Expand All @@ -63,8 +63,8 @@ You must ensure users are present both in passbolt and Entra ID, the email is us
In your Entra ID portal:

* Go to *Identity > Overview* from the left panel menu.
* Make sure your user email in Azure Directory matches the one in passbolt
* Copy your Tenant ID (a UUID) and paste it in passbolt
* Make sure your user email in Azure Directory matches the one in Passbolt
* Copy your Tenant ID (a UUID) and paste it in Passbolt
* Click on *Add > App registration*

<Figure
Expand All @@ -80,7 +80,7 @@ Register a new application
* Copy the redirect url from Passbolt to Entra, it should be something like `https://yourdomain.com/sso/azure/redirect`.
* In "Select a platform", select "Web"
* Click register, you should be back on the Entra application page
* Copy the application (client) ID back to your passbolt instance
* Copy the application (client) ID back to your Passbolt instance

<Figure
src="/img/help/2024/10/register_application_onEntra.png"
Expand All @@ -94,15 +94,15 @@ Add a secret for the application
* Click on "New client secret"
* Choose a name like "Passbolt SSO Secret"
* Select an expiry date
* Copy the secret value and expiry back to your passbolt instance
* Copy the secret value and expiry back to your Passbolt instance

<Figure
src="/img/help/2024/10/create_secret_onEntra.png"
alt="App secret creation"
caption="fig. App secret creation"
/>

In your passbolt instance:
In your Passbolt instance:

* Click save settings
* A dialog will open with Microsoft button, click on it
Expand Down
Loading