Getting started with 1Password for your growing team, or refining your setup? Our Secured Success quickstart guide is for you.
Forum Discussion
P4sca1
13 days agoOccasional Contributor
1Password shell plugins not working when configuration is stored in git
Scenario:
Multiple developers work on the same git project. When working within the project, it is common to invoke shell commands, such as `hcloud` that need authentication. There are different git projects all using the `hcloud` CLI, that require different permissions (project-scoped API tokens).
The idea is to share the `.op/plugins/hcloud.json` file across the team using git. The filte itself does not contain any sensitive information, as it only references the credential by account id, vault id and item id. Because the item is in a shared vault, the ids are the same for all developers.
Setup:
- project-a/.op/plugins/hcloud.json -> reference project-a hcloud token
- project-b/.op/plugins/hcloud.json -> reference project-b hcloud token
Expected outcome:
```
cd project-a
hcloud server list # should only show servers from project-a, because project-a API token is used
cd ../project-b
hcloud server list # should only show servers form project-b
```
This works fine on the machine that sets this up using `hcloud plugin init`. However, as soon as the file gets pulled through git, the credentials are no longer detected.
The reason seems to be that the `op` CLI ignores files that are group- or world-readable. When I manually run `chmod 600 .op/plugins/hcloud.json` the shell plugin starts to work again. The problem is that git creates files using 0644 permission.
What is the reason for this limitation? I can imagine that this limitation is in place, so that other system users cant create shell plugins to force certain credentials to be used.
What do you think about the setup? Is this something that op could support?
1 Reply
- 1P_Phil
Moderator