Skip to main content

How are credential stores used in C1?

When you use C1 to provision new application accounts through connectors that support automatic account provisioning, these new accounts are often created with a starter password. Credential stores provide a secure location to collect these initial passwords. This allows credential store owners to easily distribute them to the owners of the new accounts, whether through email, Slack, or your preferred communication method. For added convenience, the new account password is also included in the entry for the new account on the user’s Requests page. The account recipient can always decrypt their own password. Credential store owners can decrypt passwords on behalf of other users.

Set up a new credential store

This task requires the Super Administrator role in C1.
1
Navigate to Vaults > Provisioned credentials and click Add credential store.
2
Give the new credential store a name and description.
3
Choose who can access the credentials:
  • Owners limits access to the credential store’s owners and each credential’s account recipient.
  • Anyone with the link allows anyone who has the credential link to access it.
4
Add one or more Owners. Store owners can view and decrypt all credentials in the credential store. Super admins can create credential stores, but cannot decrypt passwords for others unless they are also an owner.
5
Click Save.
Done. The new credential store is added to the Provisioned credentials page.

Set the default password expiration

If needed, you can set the length of time newly created passwords will last before they expire.
1
On a credential store’s details page, click the settings icon (it looks like a gear).
2
Use the dropdown to select how long passwords created in this credential store will last. Preset options range from one hour to one year. Choose Custom to select a password duration if your preferred length isn’t on the list.
3
Click Save.
Done. New passwords created in this credential store will expire after the timeframe you set elapses.

Configure a connector to save new account passwords to a credential store

1
Navigate to the Apps page.
2
On the Managed apps tab, locate and click on the application you want to configure.
3
On the app’s Overview page, locate the Accounts management section. Click Edit next to Provisioning. The provisioning configuration drawer opens.
4
Select Connector from the dropdown, then select the connector for this app. The Mappings panel is shown. (See the automatic account provisioning docs for more on configuring the connector, if you haven’t already done so.)
5
In the Password storage area of the page, select Save to credential store and select the credential store you want to use.
6
Click Save.
Done. Now when a user requests a new account in this app, the new account’s password will be saved to the credential store you specified and included on the Accounts tab on the user’s Requests page. The account recipient and credential store owners can decrypt the new account password.