How are credential stores used in C1?
When you use C1 to provision new application accounts through connectors that support automatic account provisioning, these new accounts are often created with a starter password. Credential stores provide a secure location to collect these initial passwords. This allows credential store owners to easily distribute them to the owners of the new accounts, whether through email, Slack, or your preferred communication method. For added convenience, the new account password is also included in the entry for the new account on the user’s Requests page. The account recipient can always decrypt their own password. Credential store owners can decrypt passwords on behalf of other users.Set up a new credential store
1
Navigate to Vaults > Provisioned credentials and click Add credential store.
2
Give the new credential store a name and description.
3
Choose who can access the credentials:
- Owners limits access to the credential store’s owners and each credential’s account recipient.
- Anyone with the link allows anyone who has the credential link to access it.
4
Add one or more Owners. Store owners can view and decrypt all credentials in the credential store. Super admins can create credential stores, but cannot decrypt passwords for others unless they are also an owner.
5
Click Save.
Set the default password expiration
If needed, you can set the length of time newly created passwords will last before they expire.1
On a credential store’s details page, click the settings icon (it looks like a gear).
2
Use the dropdown to select how long passwords created in this credential store will last. Preset options range from one hour to one year. Choose Custom to select a password duration if your preferred length isn’t on the list.
3
Click Save.
Configure a connector to save new account passwords to a credential store
1
Navigate to the Apps page.
2
On the Managed apps tab, locate and click on the application you want to configure.
3
On the app’s Overview page, locate the Accounts management section. Click Edit next to Provisioning. The provisioning configuration drawer opens.
4
Select Connector from the dropdown, then select the connector for this app. The Mappings panel is shown. (See the automatic account provisioning docs for more on configuring the connector, if you haven’t already done so.)
5
In the Password storage area of the page, select Save to credential store and select the credential store you want to use.
6
Click Save.