Why does this connector look different from most others?Unlike most of the software C1 integrates with, 1Password doesn’t expose APIs that can be used to connect the two systems. Additionally, 1Password data can only be gathered from unlocked vaults, which means that a user must unlock the vault and manually kick off the data collection process; a periodic automated data pull won’t work.To work around these issues, C1’s 1Password Baton connector uses the 1Password CLI to interact with your vaults. Once the CLI is set up,
baton-1password uses it to interact with your 1Password vaults. The connector will capture user and entitlement data in a file that you upload to C1.Capabilities
| Resource | Sync | Provision |
|---|---|---|
| Accounts | ||
| Groups | ||
| Users | ||
| Vaults |
Configure the 1Password connector
To complete this task, you’ll need:
- The Connector Administrator or Super Administrator role in C1
- 1Password 8 on a Families, Teams, Business, or Enterprise plan
- A 1Password vault
- Cloud-hosted
- Self-hosted
Follow these instructions to use a built-in, no-code connector hosted by C1.Cloud-hosted connector not currently available.
Follow these instructions to use the 1Password connector, hosted and run in your own environment.Step 2: Install and run
That’s it! Your 1Password connector is now pulling access data into C1
Step 1: Set up the 1Password CLI and locate your sign-in address
1
Install the 1Password CLI and make sure it is upgraded to the current version.
2
Locate your 1Password sign-in address by following the instructions in the 1Password docs. We’ll use this address in Step 2.
Step 2: Install and run baton-1password
1
Run the relevant source commands shown below to install If using a service account:If you’re using a service account, its token must be stored in a local environment variable in order for the 1Password CLI to authenticate properly.
baton-1password, substituting the sign-in address you looked up in Step 1 for myaddress.1password.com.
If using a user account:go install github.com/conductorone/baton/cmd/baton@main
go install github.com/conductorone/baton-1password/cmd/baton-1password@main
BATON_ADDRESS=myaddress.1password.com
BATON_SECRET_KEY=Secret Key
BATON_EMAIL=Email
BATON_PASSWORD=Password
baton-1password
baton resources
go install github.com/conductorone/baton/cmd/baton@main
go install github.com/conductorone/baton-1password/cmd/baton-1password@main
BATON_ADDRESS=myaddress.1password.com
BATON_AUTH_TYPE=service
OP_SERVICE_ACCOUNT_TOKEN=your service account token
baton-1password
baton resources
Step 3: Configure the 1Password connector in C1
1
In C1, navigate to Apps > Connectors and click Add connector.
2
Search for Baton and click Add.
3
Choose where to add the connector: Create a new app, or Add to an existing app (then select the app).If you’re creating a new app, choose whether to link it to an application discovered from your identity provider: select Yes and pick the IdP application, or No to continue with just the connector.
4
Set the connector’s Name and, optionally, a Description.
5
Click the pencil icon next to Owners to choose who can configure and manage this connector.
6
Click Add. The connector is created and its configuration page opens.
7
In the Settings area of the page, click Edit.
8
Click Rotate to generate a new Client ID and Secret.Carefully copy and save these credentials. We’ll use them in Step 2.
Step 4: Add credentials to your self-hosted connector
1
On the server or VM where your self-hosted connector is running, pass in the Client ID and Secret generated in Step 3 by running
--client-id <CLIENT ID> --client-secret <SECRET>.Run baton-1password --help to see the list of flags to be used when passing your credentials to the connector.2
The connector syncs current data, uploads it to C1, and prints a
Task complete! message when finished.3
Check that the connector data uploaded correctly. In C1, click Apps. On the Managed apps tab, locate and click the name of the application you added the Baton connector to. The data should be found on the Resources and Accounts tabs, as appropriate.