How are vaults used in ConductorOne?
When you use ConductorOne to provision new application accounts through connectors that support automatic account provisioning, these new accounts are often created with a starter password. Vaults provide a secure location to collect all these initial passwords. This allows the vault owner to easily distribute them to the owners of the new accounts, whether through email, Slack, or your preferred communication method.
Set up a new vault
1
Navigate to Admin > Settings > Vaults and click Add vault.
2
Give the new vault a name and description.
3
Set a vault owner or owners. The vault owner is the only user who can view and decrypt all the credentials within the vault. Super admins can create vaults, but cannot decrypt passwords for others without the vault owner permission.
4
Click Save.
Set the default password expiration for the vault
If needed, you can set the length of time newly created passwords will last before they expire.1
On a vault’s details page, click the settings icon (it looks like a gear).
2
Use the dropdown to select how long passwords created in this vault will last. Preset options range from one hour to one year. Choose Custom to select a password duration if your preferred length isn’t on the list.
3
Click Save.
Configure a connector to save new account passwords to a vault
1
Navigate to Admin > Applications.
2
On the Managed apps tab, locate and click on the application you want to configure.
3
On the app’s Controls tab, locate the Access management section of the page and click Edit. The provisioning configuration drawer opens.
4
Select Connector from the dropdown, then select the connector for this app. The Mappings panel is shown. (See the automatic account provisioning docs for more on configuring the connector, if you haven’t already done so.)
5
In the Password storage area of the page, select Save to vault and select the vault you want to use.
6
Click Save.