From 415821f173dcd2756e471a36d36f1b615b948142 Mon Sep 17 00:00:00 2001
From: Derek Nance <dnance@bitwarden.com>
Date: Thu, 22 Jan 2026 15:20:38 -0600
Subject: [PATCH] [PM-29142] Config for SSO cookie vending (#6880)

This config may be used when a load balancer in front of Bitwarden is
first verifying an auth cookie issued by an IdP before proxying the
request to Bitwarden.
---
 dev/secrets.json.example                      | 10 +++++++++-
 src/Core/Settings/GlobalSettings.cs           | 15 ++++++++++++++-
 src/Core/Settings/ICommunicationSettings.cs   |  7 +++++++
 src/Core/Settings/IGlobalSettings.cs          |  1 +
 src/Core/Settings/ISsoCookieVendorSettings.cs |  8 ++++++++
 5 files changed, 39 insertions(+), 2 deletions(-)
 create mode 100644 src/Core/Settings/ICommunicationSettings.cs
 create mode 100644 src/Core/Settings/ISsoCookieVendorSettings.cs

diff --git a/dev/secrets.json.example b/dev/secrets.json.example
index 0d4213aec1..7bf753e938 100644
--- a/dev/secrets.json.example
+++ b/dev/secrets.json.example
@@ -39,6 +39,14 @@
     },
     "licenseDirectory": "<full path to license directory>",
     "enableNewDeviceVerification": true,
-    "enableEmailVerification": true
+    "enableEmailVerification": true,
+    "communication": {
+      "bootstrap": "none",
+      "ssoCookieVendor": {
+        "idpLoginUrl": "",
+        "cookieName": "",
+        "cookieDomain": ""
+      }
+    }
   }
 }
diff --git a/src/Core/Settings/GlobalSettings.cs b/src/Core/Settings/GlobalSettings.cs
index 1f4fa6104b..6ccbd1ee85 100644
--- a/src/Core/Settings/GlobalSettings.cs
+++ b/src/Core/Settings/GlobalSettings.cs
@@ -83,7 +83,6 @@ public class GlobalSettings : IGlobalSettings
     public virtual ILaunchDarklySettings LaunchDarkly { get; set; } = new LaunchDarklySettings();
     public virtual string DevelopmentDirectory { get; set; }
     public virtual IWebPushSettings WebPush { get; set; } = new WebPushSettings();
-
     public virtual int SendAccessTokenLifetimeInMinutes { get; set; } = 5;
     public virtual bool EnableEmailVerification { get; set; }
     public virtual string KdfDefaultHashKey { get; set; }
@@ -93,6 +92,7 @@ public class GlobalSettings : IGlobalSettings
     public virtual string SendDefaultHashKey { get; set; }
     public virtual string PricingUri { get; set; }
     public virtual Fido2Settings Fido2 { get; set; } = new Fido2Settings();
+    public virtual ICommunicationSettings Communication { get; set; } = new CommunicationSettings();
 
     public string BuildExternalUri(string explicitValue, string name)
     {
@@ -776,4 +776,17 @@ public class GlobalSettings : IGlobalSettings
     {
         public HashSet<string> Origins { get; set; }
     }
+
+    public class CommunicationSettings : ICommunicationSettings
+    {
+        public string Bootstrap { get; set; } = "none";
+        public ISsoCookieVendorSettings SsoCookieVendor { get; set; } = new SsoCookieVendorSettings();
+    }
+
+    public class SsoCookieVendorSettings : ISsoCookieVendorSettings
+    {
+        public string IdpLoginUrl { get; set; }
+        public string CookieName { get; set; }
+        public string CookieDomain { get; set; }
+    }
 }
diff --git a/src/Core/Settings/ICommunicationSettings.cs b/src/Core/Settings/ICommunicationSettings.cs
new file mode 100644
index 0000000000..26259a8448
--- /dev/null
+++ b/src/Core/Settings/ICommunicationSettings.cs
@@ -0,0 +1,7 @@
+namespace Bit.Core.Settings;
+
+public interface ICommunicationSettings
+{
+    string Bootstrap { get; set; }
+    ISsoCookieVendorSettings SsoCookieVendor { get; set; }
+}
diff --git a/src/Core/Settings/IGlobalSettings.cs b/src/Core/Settings/IGlobalSettings.cs
index c316836d09..7f5323fac0 100644
--- a/src/Core/Settings/IGlobalSettings.cs
+++ b/src/Core/Settings/IGlobalSettings.cs
@@ -29,4 +29,5 @@ public interface IGlobalSettings
     IWebPushSettings WebPush { get; set; }
     GlobalSettings.EventLoggingSettings EventLogging { get; set; }
     GlobalSettings.WebAuthnSettings WebAuthn { get; set; }
+    ICommunicationSettings Communication { get; set; }
 }
diff --git a/src/Core/Settings/ISsoCookieVendorSettings.cs b/src/Core/Settings/ISsoCookieVendorSettings.cs
new file mode 100644
index 0000000000..a9f2169b13
--- /dev/null
+++ b/src/Core/Settings/ISsoCookieVendorSettings.cs
@@ -0,0 +1,8 @@
+namespace Bit.Core.Settings;
+
+public interface ISsoCookieVendorSettings
+{
+    string IdpLoginUrl { get; set; }
+    string CookieName { get; set; }
+    string CookieDomain { get; set; }
+}