Set up a Sigma Computing connector

C1 provides identity governance and just-in-time provisioning for Sigma Computing. Integrate Sigma Computing with C1 to review and provision access.

Capabilities

Resource	Sync	Provision
Accounts
Teams
Account Types

Additional functionality:

The Sigma Computing connector supports automatic account provisioning and deprovisioning.

Notes:

• Team Admin access is sync-only. You can review Team Admin access in C1, but Sigma’s API does not support granting or revoking it.
• The connector syncs your organization’s Sigma account types, including any custom account type you created, and shows each account type name exactly as Sigma stores it. Each account type offers Assigned access that your users can request and that C1 can provision.
• A Sigma member holds one account type at a time, so account types are mutually exclusive: granting one replaces the account type the member currently holds. Granting the account type the member already holds changes nothing.
• Sigma has no unassigned state for account types, so C1 cannot revoke a member’s current account type. To change a member’s access, grant the replacement account type instead. Revoking an account type the member no longer holds succeeds without any change.
• New accounts default to the account type value view when Account Type is empty. Account type grants do not change that default.
• The account creation form retains User Kind and Send Invitation for compatibility, but changing these fields has no effect. Sigma’s defaults apply, including sending an invitation email to non-embed users.
• Account sync excludes archived and inactive members. Deleting an account archives it, reassigns its documents to the credential owner, and removes it from later syncs.
• Revoke Team Member access before deleting or deactivating an account because Sigma does not allow team membership changes for inactive members.

Gather Sigma Computing credentials

Sigma free trials do not support API keys or API actions. The API credentials must be owned by a user with the Admin account type because Sigma restricts the account-type list API to Admin-owned credentials. The credential owner also needs permissions to read and manage members, teams, and team membership.

Create API client credentials

1. Sign in to your Sigma organization.

2. Select your user avatar and then select Administration.

3. In the side panel, select Developer access. From the displayed API base URL, copy only the host, without https:// or a path (for example, aws-api.sigmacomputing.com).

4. Click Create new to open the Create client credentials dialog.

5. For Select scopes, select REST API.

6. Select a credential owner with the Admin account type and permission to read and manage members, teams, and team membership, and then click Create.

7. Copy and securely store the Client ID and Client Secret. Sigma does not display the secret again after you close the dialog.

For more information, see Generate Sigma API client credentials.

Configure the Sigma Computing connector

To complete this task, you need:

• The Connector Administrator or Super Administrator role in C1
• Your Sigma API base URL, Client ID, and Client Secret

Cloud-hosted

Follow these instructions to use a built-in, no-code connector hosted by C1.

1. In C1, navigate to Apps > Connectors and click Add connector.

2. Search for Sigma Computing and click Add.

3. Choose where to add the connector: Create a new app, or Add to an existing app (then select the app).

   If you’re creating a new app, choose whether to link it to an application discovered from your identity provider: select Yes and pick the IdP application, or No to continue with just the connector.

4. Set the connector’s Name and, optionally, a Description.

5. Click the pencil icon next to Owners to choose who can configure and manage this connector.

6. Click Add. The connector is created and its configuration page opens.

7. In the Settings area, click Edit.

8. Enter the required configuration:

   • Domain (required): Domain of your Sigma instance (e.g. aws-api.sigmacomputing.com) See: https://help.sigmacomputing.com/reference/get-started-sigma-api#identify-your-api-request-url
   • Client ID (required): Client ID for your Sigma Computing instance
   • Client Secret (required): Client Secret for your Sigma Computing instance
9. Click Save.

10. The connector’s label changes to Syncing, followed by Connected. View the logs to confirm that information is syncing.

Done. Your Sigma Computing connector is now pulling access data into C1.

Self-hosted

Follow these instructions to host and run the Sigma Computing connector in your environment.

When running in service mode on Kubernetes, a self-hosted connector maintains an ongoing connection with C1 and uploads data at regular intervals.

Resources

• Official download center: Download stable binaries for Windows, Linux, and macOS and access container images.
• GitHub repository: Access the source code, report issues, or contribute.

Step 1: Set up a new Sigma Computing connector

1. In C1, navigate to Apps > Connectors > Add connector.

2. Search for Baton and click Add.

3. Choose where to add the connector: Create a new app, or Add to an existing app (then select the app).

   If you’re creating a new app, choose whether to link it to an application discovered from your identity provider: select Yes and pick the IdP application, or No to continue with just the connector.

4. Set the connector’s Name and, optionally, a Description.

5. Click the pencil icon next to Owners to choose who can configure and manage this connector.

6. Click Add. The connector is created and its configuration page opens.

7. In the Settings area, click Edit.

8. Click Rotate to generate a new C1 Client ID and Secret. Copy and securely store both values for Step 2.

Step 2: Create Kubernetes configuration files

Create two Kubernetes manifest files for your Sigma Computing connector deployment.

Secrets configuration

# baton-sigmacomputing-secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: baton-sigmacomputing-secrets
type: Opaque
stringData:
  # C1 credentials
  BATON_CLIENT_ID: <C1 client ID>
  BATON_CLIENT_SECRET: <C1 client secret>

  # Sigma Computing credentials
  BATON_SIGMA_COMPUTING_DOMAIN: <Sigma API domain>
  BATON_SIGMA_COMPUTING_CLIENT_ID: <Sigma client ID>
  BATON_SIGMA_COMPUTING_CLIENT_SECRET: <Sigma client secret>

  # Optional: include to enable account, account type, and Team Member provisioning
  BATON_PROVISIONING: "true"

See the connector’s README or run --help for all available configuration flags and environment variables.

Deployment configuration

# baton-sigmacomputing.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: baton-sigmacomputing
  labels:
    app: baton-sigmacomputing
spec:
  selector:
    matchLabels:
      app: baton-sigmacomputing
  template:
    metadata:
      labels:
        app: baton-sigmacomputing
        baton: true
        baton-app: sigmacomputing
    spec:
      containers:
      - name: baton-sigmacomputing
        image: public.ecr.aws/conductorone/baton-sigmacomputing:latest
        imagePullPolicy: IfNotPresent
        env:
        - name: BATON_HOST_ID
          value: baton-sigmacomputing
        envFrom:
        - secretRef:
            name: baton-sigmacomputing-secrets

Step 3: Deploy the connector

1. Create a namespace for C1 connectors if desired, and apply the secret and deployment configuration files.

2. In C1, click Applications. On the Managed apps tab, open the application with the Sigma Computing connector and confirm that Sigma data appears on the Entitlements and Accounts tabs.

Done. Your Sigma Computing connector is now pulling access data into C1.

Download the latest Sigma Computing connector binaries and container information from the official download center.