Set up a Veeam connector

C1 provides identity governance and just-in-time provisioning for Veeam. Integrate your Veeam instance with C1 to run user access reviews (UARs), enable just-in-time access requests, and automatically provision and deprovision access.

Capabilities

The Veeam connector syncs the following resources from Veeam Backup Enterprise Manager (REST API on port 9398):

Resource	Sync	Provision
Accounts
Roles

• Accounts: Users and groups in Enterprise Manager. Provisioning: create accounts, delete accounts.
• Roles: Security roles (Portal Administrator, Portal User, VM/File/Exchange/Oracle/SQL Restore Operator). Provisioning: grant and revoke role assignments to accounts.

Gather Veeam credentials

To configure the Veeam connector, you need an account with the Portal Administrator role in Veeam Backup Enterprise Manager.

1. Ensure Veeam Backup Enterprise Manager is installed and the REST API service is running (default port 9398).

2. Obtain credentials for C1:

   1. Veeam URL: The base URL of your Enterprise Manager instance (e.g., https://veeam-server:9398).
   2. Username: A Windows domain or local account that has been added to Enterprise Manager (e.g., DOMAIN\Administrator or hostname\username).
   3. Password: The password for that account.
   4. The account must have the Portal Administrator role in Enterprise Manager (required for both sync and provisioning).
   5. Save the URL, username, and password securely for use in the connector configuration.

Configure the Veeam connector

Cloud-hosted

Follow these instructions to use a built-in, no-code connector hosted by C1.

1. In C1, navigate to Integrations > Connectors and click Add connector.

2. Search for Veeam and click Add.

3. Choose how to set up the new Veeam connector:

   • Add the connector to a currently unmanaged app
   • Add the connector to a managed app
   • Create a new managed app
4. Set the owner for this connector.

5. Click Next.

6. Find the Settings area of the page and click Edit.

7. Enter the required configuration:

   • Veeam URL: Base URL of your Veeam Backup Enterprise Manager instance (e.g., https://veeam-server:9398).
   • Veeam Username: Username for authentication (e.g., DOMAIN\Administrator).
   • Veeam Password: Password for that account.
8. Click Save.

9. The connector’s label changes to Syncing, followed by Connected. You can view the logs to ensure that information is syncing.

Done. Your Veeam connector is now pulling access data into C1.

Self-hosted

Follow these instructions to use the Veeam connector, hosted and run in your own environment.

When running in service mode on Kubernetes, a self-hosted connector maintains an ongoing connection with C1, automatically syncing and uploading data at regular intervals.

Step 1: Set up a new Veeam connector

1. In C1, navigate to Integrations > Connectors > Add connector.

2. Search for Baton and click Add.

3. Choose how to set up the new Veeam connector:

   • Add the connector to a currently unmanaged app
   • Add the connector to a managed app
   • Create a new managed app
4. Set the owner for this connector.

5. Click Next.

6. In the Settings area of the page, click Edit.

7. Click Rotate to generate a new Client ID and Secret.

   Carefully copy and save these credentials.

Step 2: Create Kubernetes configuration files

Create two Kubernetes manifest files for your Veeam connector deployment:

Secrets configuration

# baton-veeam-secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: baton-veeam-secrets
type: Opaque
stringData:
  # C1 credentials
  BATON_CLIENT_ID: <C1 client ID>
  BATON_CLIENT_SECRET: <C1 client secret>

  # Veeam Backup Enterprise Manager credentials
  VEEAM_URL: <Veeam Enterprise Manager base URL, e.g. https://veeam-server:9398>
  VEEAM_USERNAME: <Username, e.g. DOMAIN\Administrator>
  VEEAM_PASSWORD: <Password>

  # Optional: include if you want C1 to provision access using this connector
  BATON_PROVISIONING: true

See the connector’s README or run ./baton-veeam --help to confirm environment variable names (they may be derived from the config schema).

Deployment configuration

# baton-veeam.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: baton-veeam
  labels:
    app: baton-veeam
spec:
  selector:
    matchLabels:
      app: baton-veeam
  template:
    metadata:
      labels:
        app: baton-veeam
        baton: "true"
        baton-app: veeam
    spec:
      containers:
      - name: baton-veeam
        image: public.ecr.aws/conductorone/baton-veeam:latest
        imagePullPolicy: IfNotPresent
        env:
        - name: BATON_HOST_ID
          value: baton-veeam
        envFrom:
        - secretRef:
            name: baton-veeam-secrets

Step 3: Deploy the connector

1. Create a namespace in which to run C1 connectors (if desired), then apply the secret config and deployment config files.

2. Check that the connector data uploaded correctly. In C1, click Apps. On the Managed apps tab, locate and click the name of the application you added the Veeam connector to. Veeam data should be found on the Entitlements and Accounts tabs.

Done. Your Veeam connector is now pulling access data into C1.

---

All versions of this connector are available at dist.conductorone.com.