Set up a Panther connector

Capabilities

Resource	Sync	Provision
Accounts
Roles

Gather Panther credentials

Configuring the connector requires you to pass in credentials generated in Panther. Gather these credentials before you move on.

A user with the permission to make API tokens in Panther must perform this task.

Create a Panther API token

In Panther, click the gear icon in the top menu bar and select API Tokens.

Make a note of the GraphQL API URL shown at the top of the page. Panther displays two API URLs: use the GraphQL API URL (ending in /public/graphql), not the REST API URL.

The GraphQL API URL format depends on your deployment type:

SaaS: https://api.{your-tenant}.runpanther.net/public/graphql
Self-hosted: https://{your-domain}/v1/public/graphql

The C1 connector requires this URL to authenticate and sync data.

Click Create New Token.

Give the API token a name, such as “C1”.

Give the token the following permissions:

In the User Management section of the page, select Read User Info
In the Configuration section of the page, select Read Panther Settings Info
In the Supplementary section of the page, select Read API Token Info

Click Create API Token. The token is shown on a new page.

Carefully copy and save the token.

Done. Next, move on to the connector configuration instructions.

Configure the Panther connector

To complete this task, you’ll need:

The Connector Administrator or Super Administrator role in C1
Access to the set of Panther credentials generated by following the instructions above

Cloud-hosted
Self-hosted

Follow these instructions to use a built-in, no-code connector hosted by C1.Follow these instructions to use a built-in, no-code connector hosted by C1.

In C1, navigate to Apps > Connectors and click Add connector.

Search for Panther and click Add.

Choose where to add the connector: Create a new app, or Add to an existing app (then select the app).If you’re creating a new app, choose whether to link it to an application discovered from your identity provider: select Yes and pick the IdP application, or No to continue with just the connector.

Set the connector’s Name and, optionally, a Description.

Click the pencil icon next to Owners to choose who can configure and manage this connector.

Click Add. The connector is created and its configuration page opens.

Find the Settings area of the page and click Edit.

In the API key and API URL fields, enter the credentials you created in Panther. For the API URL, use the GraphQL API URL (ending in /public/graphql).

Click Save.

The connector’s label changes to Syncing, followed by Connected. You can view the logs to ensure that information is syncing.

Done. Your Panther connector is now pulling access data into C1.

Follow these instructions to use the Panther connector, hosted and run in your own environment.When running in service mode on Kubernetes, a self-hosted connector maintains an ongoing connection with C1, automatically syncing and uploading data at regular intervals. This data is immediately available in the C1 UI for access reviews and access requests.

Resources

GitHub repository: Access the source code, report issues, or contribute to the project.

Step 1: Set up a new Panther connector

In C1, navigate to Apps > Connectors and click Add connector.

Search for Baton and click Add.

Set the connector’s Name and, optionally, a Description.

Click the pencil icon next to Owners to choose who can configure and manage this connector.

Click Add. The connector is created and its configuration page opens.

In the Settings area of the page, click Edit.

Click Rotate to generate a new Client ID and Secret.Carefully copy and save these credentials. We’ll use them in Step 2.

Step 2: Create Kubernetes configuration files

Create two Kubernetes manifest files for your Panther connector deployment:

Secrets configuration

# baton-panther-secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: baton-panther-secrets
type: Opaque
stringData:
  # C1 credentials
  BATON_CLIENT_ID: <C1 client ID>
  BATON_CLIENT_SECRET: <C1 client secret>
  
  # Panther credentials
  BATON_TOKEN: <Panther API token>
  BATON_URL: <GraphQL API URL of your Panther account (ending in /public/graphql)>

See the connector’s README or run --help to see all available configuration flags and environment variables.

Deployment configuration

# baton-panther.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: baton-panther
  labels:
    app: baton-panther
spec:
  selector:
    matchLabels:
      app: baton-panther
  template:
    metadata:
      labels:
        app: baton-panther
        baton: true
        baton-app: panther
    spec:
      containers:
      - name: baton-panther
        image: public.ecr.aws/conductorone/baton-panther:latest
        imagePullPolicy: IfNotPresent
        env:
        - name: BATON_HOST_ID
          value: baton-panther
        envFrom:
        - secretRef:
            name: baton-panther-secrets

Step 3: Deploy the connector

Create a namespace in which to run C1 connectors (if desired), then apply the secret config and deployment config files.

Check that the connector data uploaded correctly. In C1, click Apps. On the Managed apps tab, locate and click the name of the application you added the Panther connector to. Panther data should be found on the Entitlements and Accounts tabs.

Done. Your Panther connector is now pulling access data into C1.

Welcome

Manage connectors

Deploy connectors

Upload connector data

Configurable connectors

Pre-built connectors

Set up a Panther connector

Capabilities

Gather Panther credentials

Create a Panther API token

Configure the Panther connector

Resources

Step 1: Set up a new Panther connector

Step 2: Create Kubernetes configuration files

Secrets configuration

Deployment configuration

Step 3: Deploy the connector

​Capabilities

​Gather Panther credentials

​Create a Panther API token

​Configure the Panther connector

​Resources

​Step 1: Set up a new Panther connector

​Step 2: Create Kubernetes configuration files

​Secrets configuration

​Deployment configuration

​Step 3: Deploy the connector

Capabilities

Gather Panther credentials

Create a Panther API token

Configure the Panther connector

Resources

Step 1: Set up a new Panther connector

Step 2: Create Kubernetes configuration files

Secrets configuration

Deployment configuration

Step 3: Deploy the connector