See:

Keeper Commander will log on to CyberArk Privilege Cloud Web Portal or the self-hosted Password Vault Web Access (PVWA), retrieve accounts and their passwords, and automatically create corresponding Server records in Keeper.

If the server is a CyberArk Privilege Cloud Web Portal, i.e., it ends in ".cyberark.cloud," then it will prompt for the CyberArk Identity Tenant ID and CyberArk Service User credentials:

ℹ️ The Identity Tenant ID is the first part of the login URL, e.g., https://abc12345.id.cyberark.cloud/...

If the server is any other hostname or IP address, then it will prompt for the authentication method, username, and password for PVWA:

ℹ️ Use LDAP (not Windows) to log in with an Active Directory account

CyberArk Accounts based on Platforms in the Windows and *NIX groups will be imported as Server records. Accounts based on the Business Website platform, i.e., CyberArk Workforce Password Management Accounts, will import as Login records.

Importing Accounts

The process will list the Accounts to be imported, including the ID, Name, and Safe. It will also show a progress meter with a timer and ETA. If password retrieval fails for an Account, a Retry, Skip, or Skip All dialog is presented. The process can retry the request, skip the Account, or skip all Accounts that trigger the same HTTP status.

Skipped Accounts

The skipped Accounts will be listed after processing is complete. The list includes the ID, Name, Safe, and the Error code and message.

Using a search string to limit the imported Accounts

The process will import all Accounts by default; however, appending a question mark (?) followed by the search string will limit processing to Accounts that match the search.

Using a custom query string

Alternatively, if the search string contains '=', the process will pass it to the CyberArk Get Accounts endpoint as a query string. E.g.,

passes the limit and offset parameters to the Accounts endpoint, causing it to page the accounts 10 at a time, starting at the 20th account.

PowerShell Method

The includes a process to import data into Keeper from Cyberark using a PowerShell script. Note, however, that it accesses the Vault server directly, so it only works on self-hosted servers.

Keepass Import

Keeper Commander supports importing the record and folder structure directly from an encrypted Keepass file. File attachments are also supported. Make sure to first follow these instructions to install the necessary keepass modules.

$ keeper import --format=keepass test.kdbx

You can optionally make all top level folders as shared folder object with default permissions.

$ keeper import --format=keepass --shared --permissions=URES test.kdbx

For more options, see the help screen:

Keeper Commander will log on to the CyberArk User Portal, retrieve Applications and Secured items, including Password items, and automatically create corresponding login records in Keeper.

Authentication

The import process will prompt for a username, which will be used to start the authentication process with the Cyberark Identity API. If the user is associated with another tenant, it will abort with the correct tenant in the output:

Using the correct tenant name will allow authentication to proceed.

CyberArk Identity Users

If the user is a CyberArk user, then it will prompt for a password:

The authentication process after that is dynamic, and in most cases will require additional factors or challenges, e.g., an OATH OTP Client code:

The import process will start once all the challenges have been completed successfully.

Federated login (SSO)

If the user is federated, i.e., login uses an identity provider integrated with CyberArk using SAML or OpenID Connect (OIDC), then a CyberArk user with administrative privileges will need to create an OAuth2 Client Application for Keeper Commander in the Identity Administration portal for the import process to work.

Create the CyberArk OAuth2 Client Application

1. Log in to the CyberArk Identity Administration portal

2. Click Web Apps under Apps & Widgets on the left menu

3. Click the Add Web Apps button in the top-right

The Status of the Keeper Commander Application should now show as "Deployed" in green.

If it is not deployed correctly, users will receive an error response after successfully authenticating via the browser, and the import process will be aborted.

Logging via the browser

The CyberArk Identity API will send a "redirect" when the import process starts authentication with a federated user. This redirect will be followed in the user's local browser to authenticate the user and authorize the OAuth2 Client Application.

After the user authenticates successfully, the import process will use the OAuth2 authorization code that the CyberArk Identity API sends back to request an "access token," at which point the authentication (and authorization) process is complete.

If the user is not permitted to use the Keeper Commander OAuth2 Client application (per step 16 above), they will get an access_denied error response, and the process will be aborted.

Importing Items

The import process will list the Applications and iterate through them to create Keeper login records for each one. It will then do the same with Secured items, which include Passwords. Passwords will import as login records, and secured items will become Secure Notes.

Secret Server Import

This document outlines the process for automatically and seamlessly migrating Secret Server (Delinea/Thycotic) data into Keeper which includes private folders, shared folders, permissions, file attachments, TOTP codes. This process utilizes the Secret Server API to automate the process.

Note: A basic import capability is available on the Keeper Web Vault and Desktop App which supports Thycotic XML format. Visit the vault Settings > Import > Thycotic screen. The XML format does not include attachments or permissions. Therefore, we recommend using the automated method as described in this document.

Pre-requisites

In Secret Server admin settings, ensure Webservices are enabled

Settings -> Configuration -> Edit -> Enable Webservices

Adjust Session Timeout

In Secret Server admin settings, ensure that "Session Timeout for Webservices" is set to a high enough value.

Settings -> Application -> Session Timeout for Webservices

Step 1. Download Team and Shared Folder Structure

Prior to running the above code snippet, make sure to:

• Verify the base Thycotic URL in your browser

• The Username is in the correct format:

  • If it's a AD user, the format is DOMAIN\username otherwise username

In Keeper Commander, the Keeper/Thycotic Administrator will run the following:

You will then be prompted with the following:

Executing the above code snippet will perform the following 3 functions:

• Download all Shared Folder information

• Download Team Membership

• Download Shared Folder permissions

This step downloads a file locally called "shared_folder_membership.json" which contains the team and shared folder structure. The file location should be under your user folder

Step 2. Import Shared Folders

Before importing records, we will first create the shared folder structure on the Keeper side. Run the below command:

Step 3. Export TOTP Codes

The TOTP codes stored in Thycotic/Delinea Secret Server can only be retrieved by manually downloading a CSV file. The admin of Secret Server needs to go to Secret Server > Export Secrets and select the following options:

• Export Type: Export All

• Export Folder Path: Checked

• Export TOTP Settings: Checked

Export the file and save it to your home folder or the folder where Keeper Commander is running. By default, the file will be called "secrets-export.csv."

Step 4. Import the Secret Server Vault

In Keeper Commander, the Keeper/Thycotic Administrator will run the following command to perform the import of data using the Secret Server API:

This command will take several minutes (or more) to complete, depending on the number of vault records and users. A large Secret Server instance could take 20 minutes or more.

Commander will attempt to build the same folder structure as Secret Server in the admin's Keeper vault.

Commander will also look for the file "secrets-export.csv" in the user's home folder or current Commander folder to import TOTP codes.

Note 1: This command will import and populate regular folders, shared folders and records within the folders. This will NOT import the private folders of other users within Secret Server. This step will only import the information available to the admin.

Note 2: If a Shared Folder is found within another shared folder with different permissions, the shared folder will be moved to the root folder (since Keeper does not support subfolder permissions).

Note 3: Commander may not be able to import secrets with certain security policies applied. For instance, if a secret has the require comment security policy applied (directly or by inheritance), Commander will not be able to import it.

Step 5. Applying Memberships

Note: All Thycotic teams must exist in Keeper with exact matching names before execution. This way, existing users will be applied to the corresponding teams. You can create missing teams through:

• Keeper Admin Console (Teams > Create New Team)

• Commander's create-team command

In Keeper Commander, the Keeper/Thycotic Administrator will run the following:

This will read the file called "shared_folder_membership.json" from Step 1 and apply the shared folder permissions for any users and teams in the Keeper enterprise environment. This command is safe to run repeatedly and will not generate duplicates.

Explanation: When users are invited/created through SSO or your invitation process, their public keys are created. Therefore, Keeper cannot apply membership until the users exist.

For this reason, the Keeper Admin must run the "apply-membership" command daily, hourly, or on demand when users are created in Keeper.

Step 6. End-Users are invited to Keeper

The Keeper Admin will invite users through one of the following methods:

• Just-in-time provisioning through SSO login

• Invite through the Admin Console

• SCIM

When the user registers to create their vault, they will generate a public/private key pair. At this point, they will be able to receive shared folders, as outlined in the next step.

Receiving Shared Folders

The next time that the Admin runs the apply-membership command, any new Keeper users will receive access to their Shared Folders.

Due to the number of steps, we recommend performing a pilot test with a few users before rolling out to the entire organization.

If you have any questions, please email [email protected].

Overview

This document outlines the process for automatically and seamlessly migrating LastPass data into Keeper. Keeper supports automatic import of your LastPass vault with Master Password and MFA. Keeper also supports federated logins to LastPass from Okta/Azure/Google, and this is explained in detail below.

LastPass > Keeper Transfer Supported Data:

ManageEngine Import

Keeper supports importing the resources and connected accounts directly from a ManageEngine Password Manager Pro server. Importing file attachments from a File Store resource is also supported. You will need a ManageEngine user with API access and a generated token to use this import functionality.

Substitute https://localhost:7272 with your server URL and port. You will then need to enter your ManageEngine API token.

Myki Import

Keeper supports importing the records from a Myki CSV file.

$ keeper import --format=myki myki.csv

Overview

This document outlines the steps required to seamlessly migrate your Proton Pass Vault data into Keeper.

Commands

Keeper Command Reference

Whether using the interactive shell, CLI or JSON config file, Keeper supports the following commands, each command supports additional parameters and options.

To get help on a particular command, run:

help <command>

Import and Export Commands

import command

Command: import

Detail: Import data to Keeper from a local file or other password managers.

Parameters:

Path of file to import from.

*note: in file paths, backslash "\" needs to be escaped by using two in a row "\\"

Switches:

--format <FORMAT> file format (required)

FORMAT options:

--folder <FOLDER PATH OR UID> import into a specified folder

--filter-folder <FOLDER NAME> only import the specific folder from the source vault

-s, --shared import folders from file as shared folders

-p, --permissions <PERMISSIONS> default shared folder permissions if importing as shared folders

• U - manage users permission granted

• R - manage records permission granted

• E - edit records permission granted

-dc, --display-csv show instructions for importing using the CSV format

-dj, --display-json show instruction for importing using JSON format

--record-type <RECORD TYPE NAME> import all records as the specified type

--dry-run display records to be imported without importing them

--show-skipped display skipped records

--update update records with common login, url or title

--users apply shared folder permissions for users and teams (similar to )

-l, --login-type import records as login type

-od, --old-domain OLD_DOMAIN old domain for swapping the user emails in permissions

-nd, --new-domain NEW_DOMAIN new domain for swapping the user emails in permissions

--file-cache TMPDIR temp directory used to cache the encrypted attachments

Examples:

1. Import records from a "records" CSV file into the vault

2. Import records from a "records" CSV file into the "social" folder

3. Import records from a "shared-records" json file, importing and folders as shared folders with all permissions granted

Detailed Import Instructions

Additional instructions are documented for migrating data and importing into Keeper from the following sources:

export command

Command: export

Detail: Export vault data to a file or the console

Parameters:

File name to export to, or nothing to export to console stdout

Switches:

--format <{json, csv, keepass}> file format

--max-size <SIZE> maximum size of file attachment to export

• format: number followed by "K","M","G" (Kilobyte, Megabyte, Gigabyte respectively)

• e.g. "100k" , "10M" , "2G"

-kp, --keepass-file-password <PASSWORD> if exporting in keepass format, set the file's password

--zip Create ZIP archive for file attachments. JSON only

--folder <FOLDER NAME OR UID> select a folder as the export source

--store-in-vault Stores exports file as a record attachment. Keepass only

Examples:

1. Export the vault in CSV format to a file named "my-vault"

2. Export the vault in JSON format to the console, ignoring any file attachments over 10 KB

3. Export the vault in keepass format to a file named "keeper" and set the file's password

download-membership command

Command: download-membership

Detail: Download shared folder membership to a local JSON file.

Switches:

--source <{keeper, lastpass, thycotic}> (required)

--folders-only Unload shared folder membership only. Skip team membership.

--sub-folder <{ignore, flatten}> (optional, default ignore) Thycotic/Delinea Secret Server allows shared folder permission to be overwritten by the subfolders. This option controls how these folders are imported.

• ignore Subfolder permissions are ignored. Folder structure is preserved.

• flatten Such subfolders are moved to the root of the vault. Folder permissions are preserved.

This command will reach out to the source password vault (either the current Keeper vault, remote LastPass vault or remote Thycotic/Delinea Secret Server), retrieve Team and Shared Folder file structure, and then create a local JSON file containing this structure. The filename generated locally will be called shared_folder_membership.json.

This file can then be used for subsequently sharing folders with Keeper users and teams. The sharing operation is performed by executing the apply-membership command.

Examples:

or

or

Sample Permission File

After executing download-membership, the resulting JSON file contains information about the teams, user-team assignments and shared folder permissions. An example file is below. This example file contains 3 teams, and 3 shared folders. The 3rd shared folder exists within a regular folder.

apply-membership command

Command: apply-membership

Detail: Apply shared folder membership changes from a local JSON file. This command is used alongside the download-membership command.

Switches:

--full-sync force full sync of shared folder permissions. Permissions are only added by default

The apply-membership command will look for a JSON file (defaults to shared_folder_membership.json) that contains sharing permissions.

The reason for separating the downloading and applying of membership, is so that you can apply the membership changes as new Keeper users or teams are onboarded. The apply-membership command can be run over and over, or whenever a new Keeper user account or team is created. Shared folder membership will be applied to any new corresponding user accounts and teams.

Examples:

or

download-record-types command

Command: download-record-types

Detail: Download custom record types to a JSON file.

Switches:

--source <{keeper, thycotic}> (required)

This command will reach out to the source password vault (either Keeper or Thycotic/Delinea Secret Server), retrieve custom record types (Secret Server calls it secret templates), and then create a local JSON file containing this information. The filename generated locally will be called record_types.json.

This file can then be used for subsequently loading custom record types to Keeper. The record types loading operation is performed by executing the command.

--ssh-key-as-file

Thycotic/Delinea Secret Server stores SSH keys as file attachments. Keeper stores SSH keys on a record. If you would like to preserve Thycotic/Delinea Secret Server behavior (imported SSH keys from Secret Server will be stores as file attachments) use this option.

Examples:

or

load_record_types command

Command: load-record-types

Detail: Load custom record types from a JSON file into Keeper.

Detail: Load custom record types from a local JSON file. This command is used alongside the command.

The load_record_types command will look for a JSON file (defaults to record_types.json) that contains custom record types and loads missing record types into Keeper.

Examples:

or

Exporting Records from Keeper

To export records from your vault, use the export command. Supported export formats:

• JSON

• CSV

• Keepass (see additional )

JSON export files contain records, folders, subfolders, shared folders, default folder permissions and user/team permissions. CSV import files contain records, folders, subfolders, shared folders and default shared folder permissions. Keepass files contain records, file attachments, folders and subfolders.

Keepass Export

You can optionally provide the keepass encrypted file password through command line option --keepass-file-password

This flag will only apply when --format=keepass is set. The Master Password is required for Keepass export - if none provided you will be asked during export, and your input will be masked.

JSON Record Import

JSON import files can contain records, folders, subfolders, shared folders, default folder permissions and user/team permissions. JSON can also be used to structure KeeperPAM resources.

Below is a JSON import file with 2 records. The first record is added to a folder called "My Websites\\Online". The second record is added to "Social Media" and also added to a shared folder called "Shared Social".

The import file example below is an array of record objects which can import into private folders and shared folders. Note in the example that the Facebook record contains a TOTP seed which will render on the Vault user interface and Commander CLI.

Another example below first creates shared folders that are shared to users and teams, then imports records into the shared folders. The format of the file is slightly different and allows you to separate the creation of shared folder objects and records:

The format must be strict JSON or it will fail parsing. To import this file:

To apply the suggested user and team permissions, run the command a second time using the --users flag:

There are more complex import file examples that supports shared folders, folder permissions, user permissions and team permissions located in the sample_data/ folder. To import the sample JSON file into your vault, type this command:

• Example 1:

• Example 2:

• Example 3:

The sample file contains "permissions" objects that contain email address or team names. If the email or team name exists in your Keeper enterprise account, they will be added to the shared folder, otherwise the information is ignored.

JSON PAM Resource Import

Keeper Commander's pam project import feature helps customers to automate the creation of PAM resources: folders, gateways, machines, users, connections, tunnels and (optionally) rotations.

See: command.

Import JSON Documentation

• A step-by-step guide to importing Windows Servers as PAM Resources from a basic list of server hostnames can be found at this page: ​

• A more detailed specification for "pam project import" templates can be found at this ​

• If you require assistance, contact the Commander team ([email protected]).

Commander CSV Record Import

Keeper Commander supports .csv text file import using comma separated values. CSV import files can contain data for certain fields, folders, subfolders, shared folders and default shared folder permissions.

Use this order of fields shown below with commas separating each value (and no spaces around the commas). Not all fields are required; some can be left blank.

• To specify subfolders, use backslash "\" between folder names

• To set shared folder permission on the record, use the #edit or #reshare tags as seen below

• Enclose fields in quotes for multi-line or special characters

Below is an example csv file that showcases several import features including personal folders, shared folders, subfolders, special characters and multi-line fields.

To import this file as "login" records:

The resulting vault will look like this:

Here is a list of some record types (you may have more if you have custom record types, or less if you are restricting some record types):

Below is a list of all possible field types (including custom fields). You can use these as a custom field names such as $oneTimeCode as shown below.

More advanced import options are available using the format described in the next section.