1Password mit Auth0 zu entsperren

With 1Password Business, you can bring single sign-on (SSO) authentication to your team members by connecting Auth0 with 1Password using Unlock with SSO.

Unlock with SSO doesn’t include automated provisioning. If you want to create users and groups, manage access, and suspend 1Password users with your identity provider, learn how to automate provisioning using SCIM.

Before you begin

Before you begin, review the considerations and requirements for Unlock with SSO.

These steps were recorded in March 2024 and may have changed since. Refer to the Auth0 documentation  for the most up-to-date steps.

Schritt 1: Füge die 1Password SSO-Anwendung zu Auth0 hinzu

To get started, sign in to the Auth0 Dashboard  then follow these steps:

1. In the sidebar, choose Applications > Applications and click Create Application.
2. Enter a name for your application, choose Native, and click Create. You’ll be taken to the application page.
3. Click Settings, then keep this page open and continue to the next step.

Schritt 2: Entsperren mit SSO konfigurieren

2.1: Richte Unlock mit SSO ein

1. Open a new browser tab or window and sign in to your account on 1Password.com.
2. Click Policies in the sidebar, then click Manage under Configure Identity Provider.
3. Choose Other from the list of identity providers and click Next.
4. Wähle Auth0 aus der Liste und fülle die Informationen aus:
   • Copy and paste the Client ID from your Auth0 application page.
   • Gib deine bekannte URL im folgenden Format ein und ersetze domain durch die Domain auf deiner Anwendungsseite. Zum Beispiel: https://DOMAIN.auth0.com/.well-known/openid-configuration
5. Click Next and continue to step 2.2.

2.2: Konfiguriere die Auth0-Anwendung

From the app overview page you’re taken to after completing step 1:

1. Fülle die folgenden Felder aus:
   • Allowed Callback URLs: Paste the Browser Redirect URI and Native App Redirect URI from the “Set up redirects” page, separated by a comma.
   • Allowed Web Origins: Enter your sign-in address. For example, https://example.1password.com.
2. Scroll down and click Save Changes.

2.3: Teste die Verbindung

Once you’ve configured your settings, go back to the Configure Identity Provider page and test the connection. You’ll be directed to Auth0 to sign in, then returned to 1Password. This verifies connectivity between 1Password and Auth0.

Schritt 3: Bestimme, welche Teammitglieder 1Password mit Auth0 entsperren werden, und setze eine Kulanzfrist

After you configure Unlock with SSO, you’ll be redirected to the settings page in your 1Password account. Before you configure your settings, you’ll need to create groups for the team members who will unlock 1Password with Auth0:

1. Create a custom group.

   Give the group a descriptive name, like "Auth0 SSO", for clarity.

2. Add team members to the group.

   If you plan to invite additional team members to test Unlock with Auth0 at a later date, create a new custom group for each additional set of testers.

The group(s) you create don’t have to be permanent, and you can eventually set your whole team to unlock with SSO once some groups have successfully migrated.

3.1: Wähle, wer mit Auth0 entsperren wird

By default, “People unlocking 1Password with an identity provider” is set to “No one”. This allows you to gradually migrate your team to unlock with Auth0. To specify which team members will unlock 1Password with Auth0, select one of the options:

• No one: To turn off Unlock with Auth0, select No one.
• Only groups you select: Only the team members in groups you choose will sign in with Auth0. Learn how to use custom groups in 1Password Business.
• Everyone except: groups you exclude: All team members, except owners and groups you choose to exclude, will sign in with Auth0. Existing users in this scope will be prompted to switch to Unlock with Auth0. New users, except those in excluded groups, will use their Auth0 username and password when joining 1Password. Owners will sign in with an account password and Secret Key.
• Everyone except: guests: All team members, except owners and guests, will sign in with Auth0. All existing users will be prompted to switch to Unlock with Auth0, and all new users will use their Auth0 username and password when joining 1Password. Guests and owners will sign in with an account password and Secret Key.
• Everyone: Guests and all team members, except owners, will sign in with Auth0. All existing users will be prompted to switch to Unlock with Auth0, and all new users will use their Auth0 username and password when joining 1Password.

3.2: Eine Nachfrist festlegen

Team members who already have 1Password accounts will need to switch to unlock with Auth0. Specify the number of days before team members must switch. Consider the following when you set the grace period:

• By default, the grace period is set to 5 days. It can be set to 1 to 30 days.
• The grace period begins when an administrator adds a group after they choose the Only groups you select option or when an administrator configures Unlock with Auth0 for everyone on the team. You’ll see the grace period listed next to each group configured to unlock with Auth0.
• If a team member belongs to more than one group, their grace period is determined by the first group set up with SSO, even if the grace periods are different for those groups.
• If you add a team member who hasn’t set up unlock with SSO to a group with an expired grace period, you or another administrator will need to recover their account so they can sign in again using SSO.
• If you edit the length of the grace period, it’ll be prolonged or shortened from the original date you configured the group to unlock with SSO.
• If you need to configure more team members to unlock with Auth0 after the initial setup, create a new custom group with an active grace period. This will make sure newly assigned team members won’t need their accounts recovered.

Manage settings

To manage your settings, sign in to your account on 1Password.com, then select Policies in the sidebar and select Manage under Configure Identity Provider.

Konfiguration

To change your configuration with Auth0, select Edit Configuration, then follow the onscreen instructions to set up Unlock with SSO. You can only set up one identity provider to unlock with SSO.

You can only save an identity provider configuration after you've successfully tested the connection. Changes won't be saved if you can't successfully authenticate with Auth0. This prevents you from losing access to 1Password.

Personenzuweisungen und Biometrie

Select Edit at the bottom of the settings page to change which users are assigned to unlock 1Password with Auth0.

• To specify which team members will unlock 1Password with Auth0, choose an option in the Who can unlock 1Password with an identity provider section.

  "Only groups you select" is recommended. Learn how to use custom groups in 1Password Business. To turn off Unlock with SSO, select No one.

• Specify the number of days before team members must switch to unlocking with Auth0.

  The default grace period is 5 days. If a team member doesn't migrate to Unlock with Auth0 before the end of the grace period, they must contact their administrator to recover their account.

• To allow team members to unlock with Touch ID, Face ID, Windows Hello, and other biometrics, select Allow people to unlock 1Password using biometrics. Specify the number of days or weeks before they’ll be asked to sign in to Auth0 again.

  When biometric unlock is turned on, your team members can access 1Password while offline, until the time period specified. Vault access will be online-only after the elapsed period.

Select Review Changes to verify your choices, then select Save.

Next steps

To use Unlock with Auth0 yourself, get started with Unlock 1Password with Auth0 as a team member.

Learn how to unlock 1Password with Auth0 on all of your devices and link additional apps and browsers to your account.

Get help

You can find your Application ID and OpenID configuration document URL on the overview page of the application you created in step 1.

If a team member is moved from a group that unlocks with Auth0 to one that doesn’t, they’ll be prompted to create an account password and download their Emergency Kit.

Get help if you need to switch to a new identity provider after you set up Unlock with SSO.

Learn more

• Über 1Password Unlock mit SSO
• Understanding Unlock with SSO security
• Teammitglieder hinzufügen und entfernen
• Anwenderspezifische Gruppen in 1Password Business verwenden
• Wenn du Probleme beim Entsperren von 1Password mit SSO hast

Glad to hear it! If you have anything you'd like to add, feel free to contact us.

Sorry to hear that. Please contact us if you'd like to provide more details.