Skip to main content

Integrate with 1Password

Support level: Community

What is 1Password?​

1Password is a password management tool that simplifies the process of creating, storing, and sharing passwords. It allows you to create strong, unique passwords, securely store them in a vault, and automatically fill them in when needed.

-- https://1password.com/

Preparation​

The following placeholders are used in this guide:

  • authentik.company is the FQDN of the authentik installation.
  • your-domain.1password.com is your 1Password sign-in address. If your account uses another region or the enterprise region, replace it with your full sign-in address, such as your-domain.1password.ca, your-domain.1password.eu, or your-domain.ent.1password.com.
  • scim-bridge.company is the FQDN of the 1Password SCIM Bridge (optional).
info

This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application.

authentik configuration​

To support the integration of 1Password with authentik, you need to create an application/provider pair in authentik.

Create an application and provider in authentik​

  1. Log in to authentik as an administrator and open the authentik Admin interface.

  2. Navigate to Applications > Applications and click New Application to open the application wizard.

    • Application: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings.
    • Choose a Provider type: select OAuth2/OpenID Connect as the provider type.
    • Configure the Provider: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations.
      • Set Client Type to Public.
      • Note the Client ID and slug values because they will be required later.
      • Add two Strict redirect URIs and set them to https://your-domain.1password.com/sso/oidc/redirect/ and onepassword://sso/oidc/redirect.
      • Select any available Signing Key.
    • Configure Bindings (optional): you can create a binding (policy, group, or user) to manage the listing and access to applications on a user's Application Dashboard page. If you add a SCIM provider as a backchannel provider later, only users who can view this application are synchronized.

  3. Click Submit to save the new application and provider.

1Password configuration​

  1. Log in to the 1Password dashboard as an administrator.
  2. In the sidebar, click Policies.
  3. Under Single sign-on, click Manage policies.
  4. Select Other as the identity provider.
  5. Set the following values:
    • Client ID: paste the Client ID from authentik.
    • Well-known URL: https://authentik.company/application/o/<application_slug>/.well-known/openid-configuration
  6. Click Next, then click Next again. The redirect URIs were already configured in authentik.
  7. Click Test connection to validate the configuration.
  8. After the test completes successfully, click Save.

Configuration verification​

To verify that authentik is properly integrated with 1Password, first sign out of your account. Then, open 1Password, enter an email address that's configured to unlock with SSO in 1Password, and click Sign in with authentik. You will be redirected to authentik for authentication before being sent back to 1Password.

Automated user provisioning (optional)​

You can optionally configure automated user provisioning from authentik to 1Password. This allows you to create users and groups, manage access, and suspend users in 1Password with authentik.

To support automated user provisioning, you need to deploy the 1Password SCIM Bridge, create a group and SCIM provider in authentik, and add the SCIM provider as a backchannel provider for the 1Password application. For more information, see the 1Password SCIM Bridge Documentation.

Set up automated user provisioning in authentik​

Create a user group​

  1. Log in to authentik as an administrator and open the authentik Admin interface.
  2. Navigate to Directory > Groups and click Create.
  3. Set a name for the group (e.g. 1Password Users), and click Create.
  4. Click the name of the newly created group and navigate to the Users tab.
  5. Click Add existing user, select the users that need 1Password access, and click Add.

Create a SCIM provider​

  1. Log in to authentik as an admin and open the authentik Admin interface.

  2. Navigate to Applications > Providers and click Create.

    • Choose a Provider type: select SCIM Provider as the provider type.
    • Configure the Provider: provide a name (e.g. 1password-scim), and the following required configurations.
      • URL: https://scim-bridge.company/scim
      • Token: paste the bearer token from your 1Password SCIM Bridge deployment.
      • Group Filter: select the groups that should be provisioned to 1Password.

  3. Click Finish to save the new provider.

Add the SCIM provider to the 1Password application​

  1. Navigate to Applications > Applications and click the Edit icon of the 1Password application.
  2. In the Backchannel Providers field, select the SCIM provider that you created.
  3. Click Update.
  4. Ensure that the users who should be provisioned to 1Password can access the application. If you created the 1Password Users group above, add it as a binding for the application.

Set up automated user provisioning in 1Password​

  1. Log in to the 1Password dashboard as an administrator.
  2. Click Integrations in the sidebar.
  3. Choose your identity provider from the User Provisioning section, then follow the 1Password setup flow to deploy the SCIM Bridge and generate the bearer token.
  4. After the SCIM Bridge is deployed, select the groups you want to sync in the Managed Groups section.

Verify automated user provisioning​

Open the SCIM provider in authentik. In the Schedules section, click the play icon for the SCIM sync schedule. After the sync completes, confirm that the user is provisioned in 1Password.

Provisioning setup scope

1Password requires the SCIM Bridge to be reachable from authentik and the 1Password service. DNS and hosting setup for the SCIM Bridge are outside the scope of this guide.

Resources​