Vault Structure
Understanding the Keeper Vault structure and organization for KeeperPAM
Overview
In a customer's environment, the Keeper Vault is deployed to all users within the organization across all devices. The Vault is accessible through any web browser, and also available as a native desktop application for Windows, macOS and Linux. Accessing the Keeper vault is the foundation of the KeeperPAM platform, since the vault is deployed to all users, enforces MFA, SSO and implements a zero-knowledge encryption model.
When the Role-based Enforcement Policies are activated from the Keeper Admin Console, those designated users can work with KeeperPAM functionality directly with the vault.
Records, Record Types and Resources
In Keeper, a record can be a password, file, passkey, or any number of possible record type templates. A record is always encrypted locally on the user's device with a record-level encryption key. All information held within a record is encrypted in the vault.
When working with Secrets Management and Privileged Access Management functionality, records can also represent Applications, Machines, Directories, Databases, Domain Controllers, Users and other infrastructure being managed.
Like any password record, these new record types can also be placed into private or shared folders, managed directly in the vault and controlled through policy enforcements.
Folders and Shared Folders
In the vault, records are placed into folders and shared folders. A typical and recommended setup looks something like this:
Private Folder
Shared Folder containing Resources
Shared Folder containing User accounts
The reason that we recommend splitting up Resources and User accounts is based on least privilege. In this configuration, the resources can be provisioned to a user without sharing access to the underlying credentials. The user accounts are in a separate folder and can remain private in this vault or shared to other privileged users as required.
A resource such as a Linux machine can be seen inside the resource folder below. The Administrative Credentials used for connecting to that resource are linked, but not directly embedded in the resource. This way, you can provide access to the resource without sharing the credential.
In this example, the linked Administrative Credential lives in the Users folder with separate permissions and folder privileges.
At the Shared Folder level, both human users and applications can be assigned with access rights. This allows least privilege enforcement across employees and machines.
The fastest way to understand the relationship between records, folders, applications and configurations is using the Quick Start Wizard. This wizard instantly creates a sandbox environment where you can work with the different resources and vault records.
Application
A Secrets Manager Application is assigned to specific shared folders. Applications are associated to devices and Gateways for accessing the assigned records.
An Application and the associated devices and Gateways can only decrypt the records assigned to the folder. Keeper recommends implementing the principle of least privilege, ensuring applications are limited in their ability to access records from the vault.
Management of Applications is found in the Keeper Secrets Manager section of the vault. An example of an Application might be "Azure DevOps Pipeline" or "Azure AD Rotations" as seen in the screenshot below.
For more information on Applications:
Device
A Device is any endpoint that needs to access secrets associated with an Application. This can be a physical device, virtual device, or cloud-based device. Each Client device has a unique key to read and access the secrets.
A device can be initialized through the Applications section of the vault user interface.
For more information on Devices:
Gateway
The Keeper Gateway is a service that is installed on any Docker, Linux or Windows machine in order to execute password rotation, discovery, connection, tunneling or other privileged automation. The Gateway service can be installed in any remote or on-prem environment, powering a secure zero-trust connection.
Typically, a Keeper Gateway is deployed to each environment that is being managed. For example, if you are an MSP managing 500 client environments, you may deploy 500 Keeper Gateways.
The architecture of the Keeper Gateway deployments is based on your use case and can be reviewed with our implementation team.
Configuration
A PAM Configuration defines the target environment where a Keeper Gateway has been installed. This configuration supplies important secrets to the Gateway that can be used to manage the target infrastructure. For example, it can contain Azure client secrets or Tenant IDs.
The PAM Configuration data is stored as a record in the vault inside the specified "Application Folder". This way, the Gateway has the necessary permission to retrieve this information.
We recommend defining only one Configuration for each Gateway.
More information about PAM Configuration records:
PAM Resources
Inside the vault, records define the type of resources being managed. We call these "PAM Resources". Several new Record Types available in the vault are associated with a resource.
When creating a resource, you can select from various targets, such as Machine, Database, Directory, etc.
Visit the pages linked below to learn more about each PAM Resource:
Windows, Linux, macOS devices, VMs, EC2 instances, Azure VMs, Network devices and other operating systems.
MySQL, PostgreSQL, SQL Server, MongoDB, MariaDB, Oracle
Active Directory, Azure AD, OpenLDAP
Web-based Applications, self-hosted apps, cloud apps, any http or https target.
PAM Users
A special record type in the Keeper Vault called PAM User can be directly associated to any PAM Resource. The PAM User is used by the Keeper Gateway for establishing a connection, rotating a password, discovering accounts or running other privilege automation on a target resource.
A PAM User is linked to the PAM Resource in the "Credentials" section of the record. This linkage ensures that access to the resource does not directly allow access to the credential.
A PAM User record can be configured for on-demand and automatic rotation.
More information on PAM Users is found here:
Activating PAM Features
Now that you understand the basic structure of the vault, activating and utilizing PAM features is described in the below sections.
Last updated
Was this helpful?