Bitwarden CLI - Get passwords, username, TOTP and more from Bitwarden

[blacs30]

Bitwarden Alfred Workflow

https://github.com/blacs30/bitwarden-alfred-workflow

 

Quote

Access your Bitwarden passwords, secrets, attachments and more via this powerful Alfred Workflow

 

Features

* Completely rewritten in go
* fast secret / item search thanks to caching (no secrets are cached only the keys/names)
  * cache is encrypted
* access to (almost) all object information via this workflow
* download attachments via this workflow
* show favicons of the websites
* auto update
* uses the [awgo](https://pkg.go.dev/github.com/deanishe/awgo?tab=doc) framework/library
* many customizations possible

Quote

Requires Alfred 4.1 or newer; NOT tested with Alfred 3

 

 

Installation
- Download the latest release https://github.com/blacs30/bitwarden-alfred-workflow/releases
- Open the downloaded file in Finder
- Make sure that the Bitwarden CLI https://github.com/bitwarden/cli#downloadinstall is installed
- If running on macOS Catalina or later, you _**MUST**_ add Alfred to the list of security exceptions for running unsigned software. See  this guide https://github.com/deanishe/awgo/wiki/Catalina for instructions on how to do this.
  - Yes, this sucks and is annoying, but there is unfortunately is no easy way around this. macOS requires a paying Developer account for proper app notarization. I'm afraid I'm not willing to pay a yearly subscription fee to Apple just so that this (free and open source) project doesn't pester macOS Gatekeeper

 

Usage
To use, activate Alfred and type `.bw` to trigger this workflow. From there:

- type `.bwauth` for login/logout/unlock/lock
- type `.bwconfig` for settings/sync/workflow update/help/issue reports
- type any search term to search for secrets/notes/identities/cards
- modifier keys and actions are presented in the subtitle, different actions are available depending on the object type

 

Advanced Features / Configuration

Please see the README in the git repository, the table is better formatted over there https://github.com/blacs30/bitwarden-alfred-workflow/blob/master/README.md

Develop locally

1. Install alfred cli <br>
`go get -u github.com/jason0x43/go-alfred/alfred`

2. Clone [this repo](https://github.com/blacs30/bitwarden-alfred-workflow).

3. Link the workflow directory with Alfred <br>
`cd workflow; alfred link`

4. Install dependency and run the first build<br>
`make build`

 

Colors and Icons

*Light blue*

Hex: #175DDC <br>
RGB: 23,93,220

*Darker blue*

Hex: #134db7 <br>
RGB: 20,81,192

Get icons as pngs here https://fa2png.app/ and this is the browser https://fontawesome.com/cheatsheet

Licensing and Thanks

The icons are based on [Bitwarden Brand](https://github.com/bitwarden/brand) , (https://fontawesome.com/) and [Material Design](https://materialdesignicons.com/) Icons.

Parts of the README are taken over from [alfred-aws-console-services-workflow](https://github.com/rkoval/alfred-aws-console-services-workflow)

Source that helped me to get started

- [Writing Alfred workflows in Go](https://medium.com/@nikitavoloboev/writing-alfred-workflows-in-go-2a44f62dc432)
- [Example of the awgo package] (https://github.com/deanishe/awgo/blob/master/_examples/update/main.go)
- [awgo package](https://pkg.go.dev/github.com/deanishe/awgo?tab=doc)

Troubleshooting

- "I'm seeing the following dialog when running the workflow" 

  Per the installation steps https://github.com/blacs30/bitwarden-alfred-workfloww#installation, you **_MUST_** add Alfred to the list of Developer Tool exceptions for Alfred to run any workflow that contains an executable (like this one)

Edited August 11, 2020 by blacs30
Version 2.0.3 released

[Andrey Ivanov]

Hi Claas,

 

Thanks for a great workflow.

 

Unfortunately, I get the  "Permission denied" error when trying to 'bwlogin'  after I srtup my email and bitwarden server to https://bitwarden.com .

 

Any ideas what could cause that?

 

Thank you,

Andrey

[blacs30]

Hi Andrey,

 

could you send me a screenshot of the error please?

Do you get a pop-up which asks you for the password?

 

If not then it might be that Alfred 3 or Script Editor have to be allowed in the Accessibility settings.

 

Regards

Claas

[Andrey Ivanov]

Hey Claas,

 

I've checked the Accessibility settings and both Alfred and Script editor wasn't there so I've added them manually.

But the problem still persists.

 

Here's the screenshot with the error.

 

My guess is there's something with the path escaping, because the whole path to the workflow is "/Volumes/320GB/Cloud/Resilio Sync/Application Support/Alfred 2/Alfred.alfredpreferences/workflows/user.workflow.1FD14E1C-2721-438B-9A2E-9E449F4D8E88"

 

I'm on Mac OS X 10.11.6 just in case.

 

Cheers,

Andrey

Edited August 12, 2018 by Andrey Ivanov

[blacs30]

Thanks Andrey,

that is indeed an issue in the code (which is currently still a mixture of old and new).

I will look into it this week.

[Andrey Ivanov]

22 hours ago, blacs30 said:

Thanks Andrey,

that is indeed an issue in the code (which is currently still a mixture of old and new).

I will look into it this week.

 

Thanks, Claas!

[blacs30]

Hi Andrey,

I've just released version 1.2.0 which hopefully fixes that issue of yours.

Can you please try that version and let me know if it works now?

 

https://github.com/blacs30/bitwarden-alfred-workflow/releases/tag/1.2.0

 

Thanks!

Edited August 20, 2018 by blacs30

[Andrey Ivanov]

Hi Claas,

 

Thanks for an update.

 

I can log in now, at least I get a notification that 'login is successful'

 

But the Vault keeps locked for me when I try to make a search. Unlock command doesn't make any difference... ?

 

Best.

Andrey

[blacs30]

Hi Andrey,

 

oh, I am sorry. It could be now some issue with keychain.

Can you please do the following:

Check in the keychain if a session-key entry exist.

 

And could you please also enable debug (the bug in the top right corner) in Alfred and post the result, shouldn't contain complete secrets.

 

Thanks a lot.

 

 

Edit:

Please see version 1.2.1. I hope this fixes your issue.

Thanks for your patience.

 

 

 

 

Edited August 21, 2018 by blacs30
add edit section with a link to a new version.

[Andrey Ivanov]

Hi Claas,

 

It works great now with v1.2.1 ?

 

Thank you very much!

 

Best,

Andrey

 

[springles]

Doesn't work for me, keeps saying my master password is incorrect :(. Might have something to do with my master password -- it contains spaces. Looking at the login python code, it seems to call bw --raw unlock {password}, and so I added quotes to my password like 

"password with spaces"

but it still does not work. Calling the command directly in the cli does work, so I'm not sure how it's being processed by the script.

 

EDIT: Tracing the code, it seems like calling split is causing the issue, will try to change the delimiter and test

 

EDIT2: Fixed by changing the delimiter to something else, make sure you call rstrip() on cmd to remove the newline too.

def login(login_mail, mfa_enabled=None, mfa_method=None):
    ........

    if not mfa_enabled:
        # NOTE: DELIMITER CHANGED TO [[[, replace all spaces in cmd with [[[
        cmd = "/usr/local/bin/bw[[[--raw[[[login[[[{login_mail}[[[{password}".format(login_mail=login_mail, password=password)
    elif mfa_enabled and not mfa_method:
        mfa_code, err, status, message = build_osascript(login_mail, 'Enter Bitwarden second factor code', True)
        cmd = "/usr/local/bin/bw[[[--raw[[[login[[[{login_mail}[[[{password}[[[--code[[[{mfa_code}".format(login_mail=login_mail, password=password, mfa_code=mfa_code)
    else:
        mfa_code, err, status, message = build_osascript(login_mail, 'Enter Bitwarden second factor code', True)
        cmd = "/usr/local/bin/bw[[[--raw[[[login[[[{login_mail}[[[{password}[[[--method[[[{mfa_method}[[[--code[[[{mfa_code}".format(login_mail=login_mail, password=password, mfa_method=mfa_method, mfa_code=mfa_code)
    # NOTE: Since delimiter is not default, need to strip new line
    cmd = cmd.rstrip()
    proc = Popen(cmd.split("[[["), env=my_env, stdout=PIPE, stderr=PIPE)
    out, err = proc.communicate()
    ........

 

Edited August 25, 2018 by springles

[blacs30]

Hi @springles,

 

thanks for reporting this issue and fixing it. 

Version 1.2.2 supports spaces in passwords now.

 

I've used shlex.split() and double quotes around the password.

https://github.com/blacs30/bitwarden-alfred-workflow/releases/tag/1.2.2

 

def login(login_mail, mfa_enabled=None, mfa_method=None):
[...]

    if not mfa_enabled:
        cmd = "/usr/local/bin/bw --raw login \"{login_mail}\" \"{password}\"".format(login_mail=login_mail.strip(), password=password.strip())
    elif mfa_enabled and not mfa_method:
        mfa_code, err, status, message = build_osascript(login_mail, 'Enter Bitwarden second factor code', True)
        cmd = "/usr/local/bin/bw --raw login \"{login_mail}\" \"{password}\" --code {mfa_code}".format(login_mail=login_mail.strip(), password=password.strip(), mfa_code=mfa_code.strip())
    else:
        mfa_code, err, status, message = build_osascript(login_mail, 'Enter Bitwarden second factor code', True)
        cmd = "/usr/local/bin/bw --raw login \"{login_mail}\" \"{password}\" --method {mfa_method} --code {mfa_code}".format(login_mail=login_mail.strip(), password=password.strip(), mfa_method=mfa_method.strip(), mfa_code=mfa_code.strip())

    split_cmd = shlex.split(cmd)
    proc = Popen(split_cmd, env=my_env, stdout=PIPE, stderr=PIPE)

 

[piggah]

YAY! I've been keeping my eye on this for a while waiting for those little bugs to get worked out. Super excited to start using this. Thanks for working on it

[blacs30]

Glad it’s of help. Feel free to report issues here or on github for things you notice.

[deanishe]

On 8/26/2018 at 5:47 PM, blacs30 said:

 

def login(login_mail, mfa_enabled=None, mfa_method=None):
[...]
        cmd = "/usr/local/bin/bw --raw login \"{login_mail}\" \"{password}\" --method {mfa_method} --code {mfa_code}".format(login_mail=login_mail.strip(), password=password.strip(), mfa_method=mfa_method.strip(), mfa_code=mfa_code.strip())

[...]
    split_cmd = shlex.split(cmd)
    proc = Popen(split_cmd, env=my_env, stdout=PIPE, stderr=PIPE)

 

 

If you don't mind my saying, that's a bit of an odd way to go about it. Precisely because Popen takes a list of arguments, not a string, you don't have to bugger about with all the formatting and  escaping. It should look more like this:

from pipes import quote
cmd = ['/usr/local/bin/bw',
       '--raw', 'login %s %s' % (quote(login_mail.strip()), quote(password.strip())),
       '--method', mfa_method.strip(),
       '--code', mfa_code.strip()]

proc = Popen(cmd, env=my_env, stdout=PIPE, stderr=PIPE)

 

[blacs30]

Thanks @deanishe for pointing out this.

There might be probably more odd in the code: https://github.com/blacs30/bitwarden-alfred-workflow/tree/master/workflow-main-scripts

Feel free to either create an issue or pull request if you want. 

I am happy to be able to learn more as I am still quite unexperienced in Python.

[andresm1126]

Just had a question, how do I login if 2fa is already turned on for my account, I didn't see an option to add a 2fa code when trying to login in via alfred

 

[blacs30]

Hi @andresm1126

for 2fa please enable 2fa in the Alfred workflow with `bwset2fa on`

In case you were already logged in in Alfred (which I think is not the case for you) logout first `bwlogout` and then login again with `bwlogin`

[andresm1126]

3 hours ago, blacs30 said:

Hi @andresm1126

for 2fa please enable 2fa in the Alfred workflow with `bwset2fa on`

In case you were already logged in in Alfred (which I think is not the case for you) logout first `bwlogout` and then login again with `bwlogin`

Hi @blacs30 The issue in my case is that I already had 2fa enabled form the website, so when I try bwlogin I get an error message since there's no option to enter the 2fa code

 

[blacs30]

@andresm1126

I understand, I have it the same way. The bitwarden alfred workflow will ask you for the 2fa code (6 digits) - but for this you need to use the command `bwset2fa on` in Alfred. That will tell the workflow when you login via alfred to ask 1. for the password and then 2. for the 6 digit 2fa code.

 

Screenshot attached, hope that helps.

[andresm1126]

5 minutes ago, blacs30 said:

@andresm1126

I understand, I have it the same way. The bitwarden alfred workflow will ask you for the 2fa code (6 digits) - but for this you need to use the command `bwset2fa on` in Alfred. That will tell the workflow when you login via alfred to ask 1. for the password and then 2. for the 6 digit 2fa code.

 

Screenshot attached, hope that helps.

 

@blacs30 Gotcha, thank you so much!!!

[llityslife]

it sames not work now! please check it.

[blacs30]

On 8/8/2019 at 3:13 PM, llityslife said:

it sames not work now! please check it.

Which version is your bitwarden cli? With the latest version 1.7.4 it is still running.

[llityslife]

On 8/13/2019 at 4:18 PM, blacs30 said:

Which version is your bitwarden cli? With the latest version 1.7.4 it is still running.

I install the latest version 1.74, and your bw workflow at here https://github.com/blacs30/bitwarden-alfred-workflow/releases

Thanks!

 

Edited August 19, 2019 by llityslife

[blacs30]

The workflow requires the Bitwarden CLI to be installed. You can find binaries here: https://github.com/bitwarden/cli/releases or you can use Homebrew to install it