News for hackers. Stuff that matters.
Re:Ask HN: What's the best corporate password manager? by gchamonlive on Tuesday March 10, 2020 @10:17AM (#22535609)
Shameless self-endorsement here.

I have built an API to interact with 1password through its CLI: https://github.com/lettdigital/onepassword-api

The repo also includes an example of how to call the API using AWS Lambda.

The logic to interact with the 1password CLI is wrapped in an SDK, that can be used independently: https://github.com/lettdigital/onepassword-python

Re:Ask HN: What's the best corporate password manager? by wheelerwj on Tuesday March 10, 2020 @06:31PM (#22540563)
what use cases do you image for this?
Re:Ask HN: What's the best corporate password manager? by gchamonlive on Tuesday March 10, 2020 @10:01PM (#22542219)
I currently have a stack of pem file management using terraform, lambda and this api.

When creating an ec2, we call a module that creates a tls key, a keypair and an object in a bucket.

This object creating triggers a lambda that downloads the objects contents, namely the pem key and calls the api to save it to 1password as a document.

This newly created document is available to every member that has access to the vault without having direct access to the bucket itself.

Another use I had was to create credentials for sonarqube automatically. We have a relatively large team on github and wanted to add sonarqube to the stack. What I did was just read every members name, email and username from github, create the respective users using sonarqube api and register their credentials using the sdk. It was trivial then to send them a copy of their credentials, a lot easier and less error prone than doing it by hand.

Many other use cases can be thought. You could implement iam key rotation using this. You could share support credentials for your team using 1password and have automated tools read from the same source.

It really just make everything easier to replicate, integrate and manage using this api or the python sdk. The last thing you want is to screw someones credentials because of a human error (typo, forgot to save the password etc...)