Crate bitwarden_pam_sealed 

Bitwarden PAM Sealed Data

Commercial crate holding the PAM types that are sealed into opaque DataEnvelope blobs and stored by the server, plus the shared generator-validity check applied to them.

A hostile PAM server (or a MitM on the access connector’s TLS) controls every plaintext field it hands the connector: which account is reset, how strong the new password is, which cipher stores it, and whether sessions are killed. To close that gap, the admin client seals the security-relevant fields of a target system (TargetSystemSealedV1) and a rotation config (RotationConfigSealedV1) into blobs whose content keys are wrapped by the organization key. The server stores them opaquely; only holders of the organization key (the admin client and the access connector) can read or verify them.

This crate depends only on bitwarden-crypto, so both the admin-side bitwarden-pam crate (which uses bitwarden_core::key_management::KeySlotIds) and the access connector (which has its own, independent KeySlotIds implementation) can share the same sealed types without the connector pulling in the admin client.

What’s here

• TargetSystemSealedV1 / RotationConfigSealedV1: the plaintext structs that get sealed.
• seal_target_system / unseal_target_system and seal_rotation_config / unseal_rotation_config: seal and unseal each type, generic over any Ids: KeySlotIds.
• Sealed: the result of sealing, a DataEnvelope plus its wrapped content key.
• SealedPasswordPolicy::validate: the shared generator-validity check (length range plus at least one character class), so both the admin client and the connector agree on which policies the generator can satisfy.

Storage

The server stores sealedData and wrappedKey separately so org-key rotation re-wraps only the key (don’t bundle them like vault’s SealedCipherBlob). Both strings are self-describing, so there is no format version.

Modules

policy 🔒

Generator-validity check for sealed password policies; doesn’t assess password strength.

rotation_config 🔒

target_system 🔒

Structs

RotationConfigSealedV1

Security-relevant fields of a PAM rotation config. Sealed by the admin client so a hostile server can’t choose the account, cipher, or session-termination behavior.

Sealed

Output of sealing. The server stores the two halves as separate fields so org-key rotation only re-wraps wrapped_key.

SealedPasswordPolicy

Password policy for a PAM target system’s generated credential.

TargetSystemSealedV1

Security-relevant fields of a PAM target system. Sealed so neither a hostile server nor a MitM can change its kind, password policy, or session-termination support.

Enums

PasswordPolicyError

Errors returned by SealedPasswordPolicy::validate.

SealedTargetSystemKind

Connector plugin that rotates an automatic target.

SealedTargetSystemMethod

Whether a target’s credentials are rotated automatically or by hand.

Constants

GENERATOR_MAX_LENGTH

Mirrors bitwarden_generators::MAXIMUM_PASSWORD_LENGTH.

GENERATOR_MIN_LENGTH

Mirrors bitwarden_generators::MINIMUM_PASSWORD_LENGTH.

Functions

seal_rotation_config

Seals data under org_key.

seal_target_system

Seals data under org_key.

unseal_rotation_config

Unseals a RotationConfigSealedV1 from the output of seal_rotation_config.

unseal_target_system

Unseals a TargetSystemSealedV1 from the output of seal_target_system.