Skip to content

1Password Connect provider does not support native item IDs in remoteRef.key #6070

@chadxz

Description

@chadxz

Problem

The 1Password Connect provider only resolves remoteRef.key by
item title or by RFC 4122 UUIDs (the Connect server's own ID
format). It does not support 1Password's native 26-character
item IDs (e.g., gdpvdudxrico74msloimk7qjna).

The root cause is in findItem() at
providers/v1/onepassword/onepassword.go:513. The method uses
strfmt.IsUUID(name) to decide whether to look up by ID or by
title. This check only matches RFC 4122 UUIDs
(687adbe7-e6d2-4059-9a62-dbb95d291143), which are the format
the Connect server generates internally. 1Password's native
item IDs are 26-character base32 strings, so IsUUID returns
false and the code falls through to GetItemsByTitle(), which
treats the ID as a title search and fails with:

key not found in 1Password Vaults: gdpvdudxrico74msloimk7qjna
in: map[My Vault:1]

The item exists and is accessible via the 1Password Connect API
when queried directly by ID. The Connect API's GetItem method
accepts both formats, but the code never reaches that call for
native IDs because strfmt.IsUUID gates it.

Two ID systems

1Password uses two distinct ID formats:

  • Connect server UUIDs -- standard RFC 4122 format (e.g.,
    687adbe7-e6d2-4059-9a62-dbb95d291143), generated by the
    Connect server. The existing IsUUID check handles these
    correctly.
  • Native item IDs -- 26-character base32 strings (e.g.,
    gdpvdudxrico74msloimk7qjna), used by the 1Password app UI,
    op:// references, and the "Copy Secret Reference" feature.
    These are not recognized by the current code.

Real-world impact

1Password's "Copy Secret Reference" feature generates op://
references like:

op://My Vault/gdpvdudxrico74msloimk7qjna/private key

It uses the native item ID instead of the title whenever the
title contains special characters (e.g., parentheses). Teams
that follow a workflow of copying secret references from
1Password will hit this for a subset of their items, with no
obvious indication of why some work and others don't.

Steps to reproduce

  1. Create a 1Password item with special characters in the title
    (e.g., My App (Production))
  2. Use "Copy Secret Reference" in 1Password -- it produces a
    reference using the native item ID rather than the title
  3. Use that ID as remoteRef.key in an ExternalSecret with the
    1Password Connect provider
  4. The sync fails with key not found

Expected behavior

remoteRef.key should accept item titles, Connect server UUIDs,
and 1Password native item IDs, consistent with how the 1Password
Connect API and op:// references work.

Environment

  • external-secrets v1.2.0
  • 1Password Connect provider
  • SecretStore with 1Password Connect backend

Happy to submit a PR with a fix if this is something the project is interested in supporting.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    Status

    Done

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions