Skip to main content
This is the 1Password (Groups Only) connector: it authenticates with a 1Password service account and provides read-only sync of 1Password users and groups. For full sync plus provisioning of users, groups, and roles, use 1Password (Admin) instead. Both connectors run through the Lumos On-Premise Agent using the 1Password CLI.

​
After this article

You will be able to connect 1Password to Lumos via the On-Premise Agent to sync 1Password users and their group memberships for visibility and Access Reviews.

​
Capabilities

This method is read-only. It doesn’t provision users, groups, or roles, and it doesn’t deprovision. For provisioning and role visibility, use the 1Password (Admin) connector.

​
Required plan and roles

  • 1Password plan: a 1Password Business or Enterprise account.
  • 1Password role: administrative access to 1Password is required to create the service account.
  • Host prerequisites: a Lumos On-Premise Agent (see the On-Premise Agent guide in the Lumos Developer Docs at app.lumosidentity.com/docs), Python 3.6+, and the 1Password CLI (op) version 2.18+ installed and on PATH for the service account that runs the agent, with outbound network access to 1Password’s API.
  • Credentials and scope: read-only. This method uses a 1Password Service Account token. The connector receives the token from the Lumos UI and sets OP_SERVICE_ACCOUNT_TOKEN in the CLI subprocess automatically. You don’t set it as a host environment variable.

​
Instructions

Phase 1: Prepare the On-Premise Agent host
  1. Set up the Lumos On-Premise Agent following the Lumos Developer Docs.
  2. Install the 1Password CLI (op) on the agent host and verify it’s on PATH for the service account that runs the Lumos agent service, not just your interactive shell.
Phase 2: Create a Service Account in 1Password
  1. Create a Service Account at https://[DomainName].1password.com/developer-tools/infrastructure-secrets/serviceaccount.
  2. Save the generated service account token.
Phase 3: Connect in Lumos
  1. Click the 1Password card in your Lumos integrations (reconnect an existing card or add a new one) and choose the Groups (service account) method.
  2. Enter the service account token in the Lumos UI. You don’t need to set it as an environment variable on the agent host. Lumos passes it to the agent, which sets it in the CLI subprocess automatically.
  3. Follow the on-screen instructions to enable 1Password on-premise and click Connect.

​
API Endpoints Used

​
Troubleshooting

Clicking Connect appears to do nothing. Check that the on-prem agent is running and healthy. Connection errors from the agent are surfaced in the UI, and a crashed agent (stale heartbeat) will prevent the connection from completing. op CLI not found even though it’s installed. The Lumos agent service runs with its own PATH, which differs from your interactive shell. Install the CLI so it’s on PATH for the service account that runs the agent service. Vault provisioning isn’t available. This connector is read-only and neither 1Password connector supports direct vault provisioning. Pre-assign vaults to 1Password groups, then use the 1Password (Admin) connector to provision users into those groups.