> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/connector-configuration/lastpass.md).

# LastPass connector

Configure the LastPass connector to import users and groups from LastPass Enterprise using the provisioning API (account ID and provisioning hash).

The **LastPass connector** (`lastpass-connector-rabbitmq`) integrates OpenIAM with **LastPass Enterprise** through the LastPass provisioning API. Every call is a POST to the API endpoint carrying your **account ID (`cid`)** and **provisioning hash (`provhash`)**.

| Operation                                                    | Supported                                  |
| ------------------------------------------------------------ | ------------------------------------------ |
| Search users                                                 | ✅                                          |
| Search groups                                                | ✅                                          |
| Test connection                                              | ✅                                          |
| Create/update, delete, suspend/resume, reset password, login | ❌ Not implemented in the current connector |
| Group create/delete                                          | ❌ Not implemented in the current connector |

{% hint style="warning" %}
In its current state the LastPass connector is effectively **read-only**: it can import users and groups from LastPass (for synchronization and visibility) and test the connection, but the write operations — including create/update — are empty stubs. Do not plan on provisioning accounts *to* LastPass with this connector.
{% endhint %}

## Use cases

* **Importing LastPass Enterprise users and groups** into OpenIAM for visibility, correlation, and access review.
* Feeding **certification campaigns** with who holds a LastPass account and which groups they belong to.
* **Not** a fit for provisioning accounts to LastPass — the write operations are not implemented.

## Versions and compatibility

The end application is **LastPass Enterprise**, reached over the LastPass Enterprise API. That API is not resource-oriented: every call is a POST to a single endpoint carrying a `cmd` value, so there is no API version to select.

<table><thead><tr><th width="194">Property</th><th>Value</th></tr></thead><tbody><tr><td><strong>Platform</strong></td><td>LastPass Enterprise</td></tr><tr><td><strong>Interface</strong></td><td>LastPass Enterprise API, a single command endpoint over HTTPS</td></tr><tr><td><strong>Host</strong></td><td>The managed system's URL</td></tr><tr><td><strong>Commands used</strong></td><td><code>getuserdata</code>, <code>getsfdata</code>, <code>getdetailedsfdata</code>, <code>deluser</code></td></tr></tbody></table>

{% hint style="info" %}
The set of commands above is the whole of what the connector calls, so what it can do is bounded by them: it reads users and shared-folder data, and it can delete a user. There is no command here that creates or updates a LastPass user.
{% endhint %}

## Prerequisites

From the LastPass Enterprise admin console:

* Your **account ID** (`cid`).
* Your **provisioning hash** (`provhash`) — the API secret generated in the admin console for API access.
* Network access from the connector host to the LastPass Enterprise API endpoint (HTTPS).

{% hint style="warning" %}
The provisioning hash grants API access to your LastPass enterprise — treat it as a secret.
{% endhint %}

## Installing the connector

### Kubernetes

In Kubernetes deployments, the connector is deployed as part of OpenIAM — enable it in your deployment configuration; no separate installation is required.

### RPM

Run the connector JAR directly:

{% code overflow="wrap" %}

```bash
java -Dlogging.level.root=INFO -Dconfpath=/data/openiam/ -jar lastpass-connector-rabbitmq.jar > lastpass.out &
```

{% endcode %}

Or, when managed by systemd, use the connector service unit (`openiam-connector@lastpass-connector-rabbitmq`). To deploy on a separate host, see [Connectors via RPM](/installation/rpm/rpm-single-node/add-a-connector.md).

## Starting, stopping, and restarting

<table><thead><tr><th width="160">Deployment</th><th>Commands</th></tr></thead><tbody><tr><td>RPM (systemd)</td><td><code>systemctl start|stop|restart openiam-connector@lastpass-connector-rabbitmq</code></td></tr><tr><td>RPM (manual)</td><td>Start with the <code>java -jar</code> command above; stop by killing the process.</td></tr><tr><td>Kubernetes</td><td><code>kubectl rollout restart</code> the connector deployment.</td></tr></tbody></table>

## Command-line parameters and properties

The connector is a Spring Boot application. Its defaults ship inside the jar, and you override them in either of two places:

* **An external property file**, read at `${confpath}/conf/properties/lastpass-connector-rabbitmq.properties`. The file is optional, and `confpath` is itself a system property, set with `-Dconfpath=/data/openiam/`.
* **Directly on the command line**, as `-D` arguments, which win over the file.

{% code overflow="wrap" %}

```bash
java -Dconfpath=/data/openiam/ -Dlogging.level.root=INFO -Dorg.openiam.connector.queue=LASTPASS_Connector_1_Request -jar lastpass-connector-rabbitmq.jar
```

{% endcode %}

| Property                                  | Default                                                                   |
| ----------------------------------------- | ------------------------------------------------------------------------- |
| `org.openiam.connector.queue`             | `LASTPASS_Connector_1_Request`                                            |
| `org.openiam.connector.queueResponseName` | `LASTPASS_Connector_1_Response`                                           |
| `org.openiam.connector.name` / `.type`    | `LastPass` / `LastPass Connector`                                         |
| `lastpass.property.date.format`           | `yyyy-MM-dd hh:mm:ss` (date format used to parse LastPass API timestamps) |

| Property                        | Default               | Purpose                                        |
| ------------------------------- | --------------------- | ---------------------------------------------- |
| `lastpass.property.date.format` | `yyyy-MM-dd hh:mm:ss` | Date format used when reading LastPass records |

{% hint style="warning" %}
**The date-format property this connector ships is named after LastPass, and the Kronos connector ships the same key.** If you run both, be aware that the two read a key with the same name; set the value you need on each connector's own property file rather than relying on a shared default.
{% endhint %}

The connection details themselves are **not** set here — they are managed system parameters, covered under [Configuring the managed system](#configuring-the-managed-system).

## Verifying the connector is running

{% stepper %}
{% step %}
In the Webconsole, open the managed system — the **Running connector status** indicator must be green.
{% endstep %}

{% step %}
Click **Test Connection** — it must return success.
{% endstep %}

{% step %}
In the RabbitMQ management console, confirm the `LASTPASS_Connector_1_Request` queue exists and has a consumer.
{% endstep %}

{% step %}
Check the connector log for startup errors.
{% endstep %}
{% endstepper %}

## Troubleshooting

| Symptom                                                                 | Likely cause                                                     | Resolution                                                                                                                                                          |
| ----------------------------------------------------------------------- | ---------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Connector never receives messages                                       | Queue-name mismatch                                              | The connector record's queue must equal `LASTPASS_Connector_1_Request` exactly.                                                                                     |
| API calls rejected by LastPass                                          | Wrong `cid`/`provhash`, or the provisioning hash was regenerated | Re-check Login (`cid`) and Password (`provhash`) on the managed system.                                                                                             |
| Provisioning to LastPass "appears to succeed" but no account is created | Create/update operations are unimplemented stubs                 | Expected — the connector is read-only; see the operations table above.                                                                                              |
| Timestamps parse incorrectly during sync                                | Date-format mismatch                                             | Align `lastpass.property.date.format` with the API's timestamp format.                                                                                              |
| A provisioning request reports success but LastPass is unchanged        | Every write operation is a stub                                  | Create, update, delete, suspend, resume, password reset and group create/delete each return `SUCCESS` without calling LastPass. Use the connector as a read source. |

See also: [general connector troubleshooting](/connector-configuration/4-troubleshootingconnector.md) and the [connector error-code reference](/connector-configuration/4-troubleshootingconnector.md#connector-error-codes).

## Registering the connector in OpenIAM

Register the connector under **Provisioning → Connectors** and attach it to the managed system — see [Registering the connector](/administration-guide/lifecycle/connectors-and-managed-systems.md).

## Configuring the managed system

<table><thead><tr><th width="181">Managed-system field</th><th>Value</th></tr></thead><tbody><tr><td><strong>URL</strong></td><td>The LastPass Enterprise API endpoint for your account.</td></tr><tr><td><strong>Login</strong></td><td>Your LastPass <strong>account ID</strong> (<code>cid</code>).</td></tr><tr><td><strong>Password</strong></td><td>Your <strong>provisioning hash</strong> (<code>provhash</code>).</td></tr></tbody></table>

## Attribute mapping and policy map

Because the connector is read-only, no outbound policy map is needed. Imported users/groups are mapped to OpenIAM objects by the synchronization transformation script.

## Reconciliation and synchronization

Synchronization is the connector's primary purpose: the user and group searches supply LastPass records as source data. Configure a sync against the managed system as described in [Configuring synchronization](/administration-guide/lifecycle/synchronize-and-import-data.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.openiam.com/connector-configuration/lastpass.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.