Passwordstate

Overview

The Passwordstate integration connects your self-hosted Passwordstate website to Oneleet and syncs your Passwordstate users as user account assets, so Oneleet can monitor who has access to your passwords and whether they sign in with a second factor.

What does Oneleet monitor?

• Passwordstate users (user accounts), including whether each user is a Security Administrator and whether the account is disabled
• Whether each enabled user signs in with an authentication option that includes a second factor, such as Manual Login and One-Time Password or AD Single Sign-On and Duo Authentication

Users who sign in with SAML2 Authentication count as compliant, because your identity provider handles MFA. Disabled users aren’t checked.

Setup

To set up the Passwordstate integration, navigate to Integrations > Add integration > Passwordstate.

Oneleet connects to your website with a Reporting API key, which can only run reports. A Passwordstate Security Administrator with access to System Settings creates it:

1. In Passwordstate, open Administration > System Settings and select the API tab.
2. Under Standard API Keys, click Reporting.
3. Click Generate New Key, then Save. Click Save at the bottom of the System Settings page to keep the key.
4. Copy the key and paste it into Reporting API Key in the Oneleet setup form.
5. Enter the hostname of your Passwordstate website, without https://, as Passwordstate URL.

Oneleet connects to your website over HTTPS from the internet, so it must be publicly reachable on a fully qualified hostname with a certificate from a trusted certificate authority. If you restrict API access by IP address, allow Oneleet’s IP addresses. Oneleet can’t connect if the Standard API requires One-Time Password codes.