Set up a Veeam connector

Capabilities

The Veeam connector syncs the following resources from Veeam Backup Enterprise Manager (REST API on port 9398):

Resource	Sync	Provision
Accounts
Roles

Accounts: Users and groups in Enterprise Manager. Provisioning: create accounts, delete accounts.
Roles: Security roles (Portal Administrator, Portal User, VM/File/Exchange/Oracle/SQL Restore Operator). Provisioning: grant and revoke role assignments to accounts.

Gather Veeam credentials

To configure the Veeam connector, you need an account with the Portal Administrator role in Veeam Backup Enterprise Manager.

Ensure Veeam Backup Enterprise Manager is installed and the REST API service is running (default port 9398).

Obtain credentials for C1:

Veeam URL: The base URL of your Enterprise Manager instance (e.g., https://veeam-server:9398).
Username: A Windows domain or local account that has been added to Enterprise Manager (e.g., DOMAIN\Administrator or hostname\username).
Password: The password for that account.
The account must have the Portal Administrator role in Enterprise Manager (required for both sync and provisioning).
Save the URL, username, and password securely for use in the connector configuration.

Configure the Veeam connector

Cloud-hosted
Self-hosted

Follow these instructions to use a built-in, no-code connector hosted by C1.

In C1, navigate to Apps > Connectors and click Add connector.

Search for Veeam and click Add.

Choose where to add the connector: Create a new app, or Add to an existing app (then select the app).If you’re creating a new app, choose whether to link it to an application discovered from your identity provider: select Yes and pick the IdP application, or No to continue with just the connector.

Set the connector’s Name and, optionally, a Description.

Click the pencil icon next to Owners to choose who can configure and manage this connector.

Click Add. The connector is created and its configuration page opens.

Find the Settings area of the page and click Edit.

Enter the required configuration:

Veeam URL: Base URL of your Veeam Backup Enterprise Manager instance (e.g., https://veeam-server:9398).
Veeam Username: Username for authentication (e.g., DOMAIN\Administrator).
Veeam Password: Password for that account.

Click Save.

The connector’s label changes to Syncing, followed by Connected. You can view the logs to ensure that information is syncing.

Done. Your Veeam connector is now pulling access data into C1.

Follow these instructions to use the Veeam connector, hosted and run in your own environment.When running in service mode on Kubernetes, a self-hosted connector maintains an ongoing connection with C1, automatically syncing and uploading data at regular intervals.

Step 1: Set up a new Veeam connector

In C1, navigate to Apps > Connectors and click Add connector.

Search for Baton and click Add.

Set the connector’s Name and, optionally, a Description.

Click the pencil icon next to Owners to choose who can configure and manage this connector.

Click Add. The connector is created and its configuration page opens.

In the Settings area of the page, click Edit.

Click Rotate to generate a new Client ID and Secret.Carefully copy and save these credentials.

Step 2: Create Kubernetes configuration files

Create two Kubernetes manifest files for your Veeam connector deployment:

Secrets configuration

# baton-veeam-secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: baton-veeam-secrets
type: Opaque
stringData:
  # C1 credentials
  BATON_CLIENT_ID: <C1 client ID>
  BATON_CLIENT_SECRET: <C1 client secret>

  # Veeam Backup Enterprise Manager credentials
  VEEAM_URL: <Veeam Enterprise Manager base URL, e.g. https://veeam-server:9398>
  VEEAM_USERNAME: <Username, e.g. DOMAIN\Administrator>
  VEEAM_PASSWORD: <Password>

  # Optional: include if you want C1 to provision access using this connector
  BATON_PROVISIONING: true

See the connector’s README or run ./baton-veeam --help to confirm environment variable names (they may be derived from the config schema).

Deployment configuration

# baton-veeam.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: baton-veeam
  labels:
    app: baton-veeam
spec:
  selector:
    matchLabels:
      app: baton-veeam
  template:
    metadata:
      labels:
        app: baton-veeam
        baton: "true"
        baton-app: veeam
    spec:
      containers:
      - name: baton-veeam
        image: public.ecr.aws/conductorone/baton-veeam:latest
        imagePullPolicy: IfNotPresent
        env:
        - name: BATON_HOST_ID
          value: baton-veeam
        envFrom:
        - secretRef:
            name: baton-veeam-secrets

Step 3: Deploy the connector

Create a namespace in which to run C1 connectors (if desired), then apply the secret config and deployment config files.

Check that the connector data uploaded correctly. In C1, click Apps. On the Managed apps tab, locate and click the name of the application you added the Veeam connector to. Veeam data should be found on the Entitlements and Accounts tabs.

Done. Your Veeam connector is now pulling access data into C1.

All versions of this connector are available at dist.conductorone.com.

Welcome

Manage connectors

Deploy connectors

Upload connector data

Configurable connectors

Pre-built connectors

Set up a Veeam connector

Capabilities

Gather Veeam credentials

Configure the Veeam connector

Step 1: Set up a new Veeam connector

Step 2: Create Kubernetes configuration files

Secrets configuration

Deployment configuration

Step 3: Deploy the connector

​Capabilities

​Gather Veeam credentials

​Configure the Veeam connector

​Step 1: Set up a new Veeam connector

​Step 2: Create Kubernetes configuration files

​Secrets configuration

​Deployment configuration

​Step 3: Deploy the connector

Capabilities

Gather Veeam credentials

Configure the Veeam connector

Step 1: Set up a new Veeam connector

Step 2: Create Kubernetes configuration files

Secrets configuration

Deployment configuration

Step 3: Deploy the connector