Skip to main content
This is the 1Password – Admin connector: it authenticates with a 1Password admin user account and provides full sync of users, groups, and roles plus provisioning and deprovisioning. For read-only visibility of users and groups only, use 1Password – Groups instead. Both connectors run through the Lumos On-Premise Agent using the 1Password CLI.

​
After this article

You will be able to connect 1Password to Lumos via the On-Premise Agent to sync users, groups, and roles, and to provision, deprovision, and manage access, including group membership assignment and account deactivation.

​
Capabilities

Provisioning workflow: assign the user to the app, then assign the entitlement (group membership).

​
Required plan and roles

  • 1Password plan: a 1Password Business or Enterprise account.
  • 1Password role: administrative access to 1Password is required to supply the admin account credentials.
  • Host prerequisites: a Lumos On-Premise Agent (see the On-Premise Agent guide in the Lumos Developer Docs at app.lumosidentity.com/docs), Python 3.6+, and the 1Password CLI (op) version 2.18+ installed and on PATH for the service account that runs the agent, with outbound network access to 1Password’s API.
  • Credentials and scope: read/write. The Admin method uses the admin account’s username, password, and Secret Key (some 1Password docs call this the master key), and 2FA must be disabled on that account. This grants Lumos full visibility (users, groups, and roles) and the ability to provision and deprovision.
Note: this connector is deliberately on-prem. Most companies do not allow access to their 1Password instance from outside their network, so the agent keeps 1Password traffic inside your infrastructure. A cloud-only variant does not exist today. Lumos uses the 1Password CLI through the agent for a complete integration. Unlike the SCIM Bridge (which only returns partial data such as SCIM-provisioned users and groups), the CLI retrieves all users including native groups and permissions.

​
Instructions

Phase 1: Prepare the On-Premise Agent host
  1. Set up the Lumos On-Premise Agent following the Lumos Developer Docs.
  2. Install the 1Password CLI (op) on the agent host and verify it is on PATH for the service account that runs the Lumos agent service (not just your interactive shell).
Phase 2: Gather admin credentials in 1Password
  1. Gather the admin account credentials: username, password, and Secret Key.
  2. Confirm that 2FA is disabled on that admin account.
Phase 3: Connect in Lumos
  1. Click the 1Password card in your Lumos integrations (reconnect an existing card or add a new one) and choose the Admin method.
  2. Enter the admin credentials (username, password, Secret Key) in the Lumos UI. You do not need to set any credential as an environment variable on the agent host. Lumos passes the credential to the agent, which sets it in the CLI subprocess environment automatically.
  3. Follow the on-screen instructions to enable 1Password on-premise and click Connect.

​
API Endpoints Used

​
Troubleshooting

Clicking Connect appears to do nothing. Check that the on-prem agent is running and healthy. Connection errors from the agent are surfaced in the UI, and a crashed agent (stale heartbeat) will prevent the connection from completing. op CLI not found even though it’s installed. The Lumos agent service runs with its own PATH, which differs from your interactive shell. Install the CLI so it is on PATH for the service account that runs the agent service. Deactivating a user fails for accounts in “Invited” status. 1Password rejects the standard deactivate call (HTTP 400) for users who have not yet accepted their invite. The connector handles Invited-status users separately, so retry the action on a current connector version. Provisioning fails at the Assign Entitlement step. The AppStore workflow assigns the user to the app and then assigns the entitlement (group membership). This is handled by a current connector version. Retry on the latest connector. Do I need to disable 2FA? Yes. The Admin method authenticates as an admin user account, and 2FA must be disabled on that account for the CLI to authenticate non-interactively. Why can’t this run from the Lumos cloud? The connector was built as an on-prem integration because most customers block access to their 1Password instance from outside their network.