Multiple Vaults Integration
Integrate with multiple Keeper Vaults or multiple Shared Folders using Keeper Secrets Manager
Last updated
Was this helpful?
Integrate with multiple Keeper Vaults or multiple Shared Folders using Keeper Secrets Manager
Last updated
Was this helpful?
Keeper Connection Manager can pull secrets from different vaults or different shared folders of the Keeper Vault, via the Keeper Secrets Manager integration. There are two main ways which KCM can connect to multiple Keeper Vaults for retreiving secrets:
Connection Groups can be assigned to different secrets manager configurations. Any connection defined within a Connection Group will retrieve secrets from the group assignment.
Users can be assigned Secrets Manager configurations, and connections can retrieve secrets from configurations defined by each individual user profiles. This allows different users to connect to the same set of connections with their own set of secrets.
Each Keeper Connection Manager "Connection Group" can use a Keeper Secrets Manager configuration for the connections in the group. When this is activated, each connection group will look for records in the corresponding Secrets Manager configuration to retrieve secrets and replace tokens in the connection settings.
In order to use a Keeper Secrets Manager with a Connection Group, enter a Keeper Secrets Manager One-Time Access Token, or Configuration into the "KSM Service Configuration" field of the connection group form.
All connections created within this Connection Group will then use the Secrets Manager configuration defined to retrieve secrets when establishing connections, instead of using the root level Secrets Manager configuration.
The Secrets Manager configuration can come from the same vault, or any other vault.
See the Dynamic Tokens documentation for more information on the available tokens and how to use them.
Note: A Secrets Manager configuration must be established in the baseline configuration as a default to use connection group Secrets Manager configurations. See the documentation for information on setting up a Secrets Manager configuration.
Each Keeper Connection Manager User profile can be assigned to a Keeper Secrets Manager configuration for any connection. When the connection is updated to allow user-specific vaults, Keeper Connection Manager will pull the secret from the user's corresponding configuration. This feature allows multiple users to share the same set of connections, using secrets that originate from the user's own vault.
In order to use user-specific secrets manager connections, the Keeper Connection Manager installation needs to have the feature enabled. It is disabled by default.
An additional environmental variable must be added to the keeper/guacamole Docker image in your docker-compose.yml file.
KSM_ALLOW_USER_CONFIG
For example:
In the Edit User screen, fill in the KSM Service Configuration that has been set up for that user. This is also available to each user to set up the KSM Service Configuration for themselves.
When creating or editing a connection, there is a field which appears called "Allow user-provided KSM configuration".
When this option is selected, Keeper Connection Manager will look for corresponding secrets in the user's vault corresponding to the Keeper Secrets Manager configuration.
Keeper Connection Manager will always use the base (or Connection Group) secrets if any are applicable. It will only use user-provided secrets if there isn't an admin-provided secret for the same, to ensure that users cannot override the intent of the admin.
