Skip to content

Commit 4e7dab5

Browse files
authored
Merge pull request #62 from 1Password/sl/add-create-vault-from-input-script
adding script that creates vaults based on a list of vault names provided as a text file to the script
2 parents c503b37 + 7cd8487 commit 4e7dab5

File tree

2 files changed

+150
-5
lines changed

2 files changed

+150
-5
lines changed

account-management/README.md

Lines changed: 26 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,29 +6,50 @@ These examples are intended to demonstrate how the 1Password command line tool c
66

77
## Script Descriptions
88

9-
### [vault-details.sh](vault-details.sh)
9+
### [`create_vaults_from_input.py`](./create_vaults_from_input.py)
10+
This script will create a vault for each vault name in a file passed to the script with the `--file=` flag. Optionally remove your own access to the vault after creating it by running the script with the `--remove-me` flag.
11+
12+
#### Usage
13+
1. Install 1Password's CLI tool folowing the directions for your operating system here: https://developer.1password.com/docs/cli/get-started
14+
2. In the 1Password desktop application enable the integration with the CLI, as documented here: https://developer.1password.com/docs/cli/get-started#step-2-turn-on-the-1password-desktop-app-integration
15+
3. Open a terminal window and confirm:
16+
4. the 1Password CLI (called `op`) is installed and working, and the desktop application integration is enabled, by trying `op signin` and signing into the desired 1Password account.
17+
5. Ensure that you have a version of python installed by running `python --version` or `python3 --version` (ideally you have at least python 3.7).
18+
6. Download this script to a folder on your computer (e.g., `~/Downloads`).
19+
7. In your terminal, move to that folder (e.g., `cd ~/Downloads`)
20+
8. Run the script by executing `python3 create_vaults_from_input.py --file=path/to/input/list`
21+
22+
23+
#### Options
24+
By default, when a person creates a vault, they are the "vault creator" and have full permissions for each vault they create. More than likely this will be desirable in your situation.
25+
26+
However, if you'd like to have your access revoked so that you are not directly assigned to the vault after it's created, run the script using the `--remove-me` flag.
27+
* Note that even if you remove yourself from the vaults, members of the Owners and Administrators groups will still have "Manage Vault" permissions on these vaults, and will be able to manage their own or others' access to them.
28+
* To work around some current rate limiting issues related to permissions commands in the CLI, using the `--remove-me` flag will result in the script taking considerably longer to run (the script has an 11 second delay for each vault when modifying permissions to avoid rate limiting).
29+
30+
### [`vault-details.sh`](vault-details.sh)
1031

1132
When run by a member of the Owners group, this script provides the vault name, the number of items in the vault, the last time the vault contents were updated, and list which users and groups have access to that vault along with their permissions.
1233

1334
When run by a non-Owner, it will provide these details for all vaults the user running the script has access to.
1435

15-
### [remove-export-all-groups-and-vaults.sh](remove-export-all-groups-and-vault.sh)
36+
### [`remove-export-all-groups-and-vaults.sh`](remove-export-all-groups-and-vault.sh)
1637

1738
When run by a member of the Owners group, this script will remove the `export items` permission for every vault that every group has access to without exception.
1839

1940
When run by a non-Owner, this script will remove the `export` permission on vaults that the person running the script also has the `manage vault` permissions for.
2041

21-
### [vault-permission-change.sh](vault-permission-change.sh)
42+
### [`vault-permission-change.sh`](vault-permission-change.sh)
2243

2344
This script, when run by an a user with the `manage vault` (manage access) permission, will remove or add the specified vault permission(s) for the specified group(s) from all vaults (excluding Private vaults). This could be useful if you are looking to systematically remove the Administrators `manage vault` (manage access) permission from all created shared vaults, this leaving this permission to the default owners group.
2445

25-
### [bulk-group-prefix-update.sh](bulk-group-prefix-update.sh)
46+
### [`bulk-group-prefix-update.sh`](bulk-group-prefix-update.sh)
2647

2748
This script, when run by an Owner or Administrator, will change the prefix of all group names according to your specifications. This is particularly helpful if you are needing to change an existing naming scheme.
2849
If you want to add prefixes where one doesn't already exist, then you can modify the `sed` substitution to: `sed 's/^/PREFIX/g'` to add a prefix to all groups.
2950
This does not change the name of any built in groups (e.g., "Administrators", "Owners", "Team Members").
3051

31-
### [compliance-export.sh](compliance-export.sh)
52+
### [`compliance-export.sh`](compliance-export.sh)
3253

3354
This script, when run by an adminstrator, will output all items within the specified scope (e.g., with a specific tag) as a long-formatted CSV. The export excludes any concealed fields such as password fields.
3455
This script may be helpful if you need to have someone verify the accuracy of the details of a 1Password item without revealing any secret values stored in that item.
Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
#!/usr/bin/python3
2+
import argparse
3+
import csv
4+
import json
5+
import subprocess
6+
import sys
7+
import time
8+
9+
parser = argparse.ArgumentParser(
10+
"Create a 1Password vault for each name in a list of vault names provided as a plaintext file using the --file flag.",
11+
"By default, you will have full permissions on each vault created by this script."
12+
"User the --remove-me flag if you'd like to revoke your own access to the vault after it is created. Members of the Owners and Administrators groups will still be able to manage this vault.",
13+
)
14+
parser.add_argument(
15+
"--file",
16+
action="store",
17+
dest="filepath",
18+
help="Specify the path to a CSV file containing the required input data.",
19+
required=True,
20+
)
21+
22+
parser.add_argument(
23+
"--remove-me",
24+
action="store_true",
25+
dest="removeMe",
26+
help="Remove yourself from the vaults created by this script. To avoid rate limiting, this aggressively throttles the script and each vault will take 11 seconds to process.",
27+
)
28+
29+
args = parser.parse_args()
30+
31+
32+
# Get the User UUID of the person running the script. This is required for other parts of the script.
33+
def getMyUUID() -> str:
34+
print("Ensuring you're signed into 1Password and obtaining your User ID.\n")
35+
r = subprocess.run(["op", "whoami", "--format=json"], capture_output=True)
36+
37+
# Catch error and kill process
38+
if r.returncode != 0:
39+
sys.exit(
40+
f"🔴 Unable to get your user UUID. Make sure you are are signed into the 1Password CLI. Error: {r.stderr.decode('utf-8')}"
41+
)
42+
print(f"🟢 Obtained your User ID: {json.loads(r.stdout)['user_uuid']} \n")
43+
return json.loads(r.stdout)["user_uuid"]
44+
45+
46+
# Grants the group access to the corrosponding vault with defined permissions.
47+
def createVaultWithName(vault: str):
48+
retries = 0
49+
maxRetries = 3
50+
print(f"\t⌛ Attempting to create vault called {vault}.")
51+
while retries < maxRetries:
52+
r = subprocess.run(
53+
[
54+
"op",
55+
"vault",
56+
"create",
57+
vault,
58+
],
59+
capture_output=True,
60+
)
61+
# time.sleep(11)
62+
# Handle rate limit error
63+
if "rate-limited" in r.stderr.decode("utf-8"):
64+
# Retry after waiting for 60 seconds
65+
print(r.stderr.decode("utf-8"))
66+
print("💤 Sleeping for 10 minutes, go grab a coffee.")
67+
time.sleep(600)
68+
retries += 1
69+
# Catch error but continue
70+
elif r.returncode != 0 and "rate-limited" not in r.stderr.decode("utf-8"):
71+
print(
72+
f"\t🔴 Unable to create vault named '{vault}'. Error: ",
73+
r.stderr.decode("utf-8"),
74+
)
75+
break
76+
else:
77+
print(f"\t🟢 Successfully created '{vault}'")
78+
break
79+
80+
81+
# Revokes vault access for the person running the script.
82+
def removeCreatorPermissionsFor(vault: str, userID: str):
83+
retries = 0
84+
maxRetries = 3
85+
print(f"\t⌛ Attempting to remove your access to the newly created vault {vault}.")
86+
while retries < maxRetries:
87+
r = subprocess.run(
88+
["op", "vault", "user", "revoke", f"--user={userID}", f"--vault={vault}"],
89+
capture_output=True,
90+
)
91+
time.sleep(11)
92+
# Handle rate limit error
93+
if "rate-limited" in r.stderr.decode("utf-8"):
94+
# Retry after waiting for 60 seconds
95+
print(r.stderr.decode("utf-8"))
96+
print("💤 Sleeping for 10 minutes, go grab a coffee.")
97+
time.sleep(600)
98+
retries += 1
99+
# Catch error but continue
100+
elif r.returncode != 0 and "rate-limited" not in r.stderr.decode("utf-8"):
101+
print(
102+
f"\t🔴 There was an issue removing your access to the vault {vault}. Error: ",
103+
r.stderr.decode("utf-8"),
104+
)
105+
return
106+
print(f"\t🟢 Succeeded in removing your access to vault {vault}.\n\n")
107+
return
108+
109+
110+
def main():
111+
myUUID: str = getMyUUID()
112+
# Open the csv passed via the --file flag
113+
with open(args.filepath, "r", newline="", encoding="utf-8") as inputFile:
114+
csvReader = csv.reader(inputFile, skipinitialspace=True)
115+
for row in csvReader:
116+
vault: str = row[0].strip()
117+
createVaultWithName(vault)
118+
119+
# If --remove-me flag was used, remove the script-runner's permission
120+
if args.removeMe:
121+
removeCreatorPermissionsFor(vault, myUUID)
122+
123+
124+
main()

0 commit comments

Comments
 (0)