End-to-End Password Protection Across Your Data Environment

Simply by authenticating through your existing IdP, your employees gain access to all of the capabilities of the top-rated Keeper password management platform, including:

• Secure digital vault that can be accessed from any device, running any OS

• Automatic password generation & autofill on all devices

• Compatibility on any system, browser or app

• Zero-knowledge encryption of vault data

This service does not require any on-premises or customer cloud-hosted services and there are no Master Passwords. Configuration is done directly between the IdP and Keeper's Admin Console.

To preserve Zero Knowledge, an Elliptic Curve public/private key pair is generated for each device. The private key on the device encrypts and decrypts the user's vault. Signing into a new device requires a key exchange that is processed by our Keeper Push feature or approved by a designated Admin. Automated admin approvals can be configured in several different ways.

Setup Steps

Important: SSO users and provisioning must exist in a dedicated node that you will create (not in the root node). Before completing these steps, create a new node as shown in the image below.

Keeper SSO Connect Cloud can be rolled out in 3 easy steps:

1. Create a SSO Connect Cloud instance on the Keeper Admin Console under Provisioning

2. Exchange metadata with your SAML identity provider

3. Set up automated provisioning and/or manually provision users to Keeper

Device Approvals

An Administrative Permission called "Approve Devices" allows an Administrator to perform device approvals. Admin Approvals can also be automated. See the Device Approval section for details.

Benefits

From an administrator's perspective, the cost, risk & labor saving benefits of Keeper SSO Connect Cloud are significant:

• Easy setup, all in one place in Keeper’s existing Admin Console.

• No hosted software to integrate with the IdP

• No additional server costs

• No patching software

• Eliminates a potential single point of failure

• Available 24/7/365 on Keeper’s high availability systems

Keeper SSO Connect is a Cloud-based SAML 2.0 service that seamlessly and quickly integrates with your existing Single Sign-On and Passwordless solution - enhancing and extending it with zero-knowledge password management and encryption. Keeper supports all popular SSO IdP platforms such as Microsoft Entra ID / Azure, Okta, Google Workspace, Centrify, Duo, OneLogin, Ping Identity, JumpCloud and many more.

Product Page

https://www.keepersecurity.com/keeper-sso-connect.html

IdP Compatibility

Keeper SSO Connect, included with Keeper Enterprise, seamlessly integrates with all popular SSO IdP platforms.

In addition to SSO providers, Keeper also seamlessly integrates with all popular Passwordless authentication platforms that support SAML 2.0 including Duo, HYPR, Trusona, Octopus, Traitware and Veridium.

Why Keeper SSO Connect

Pairing your SSO solution with Keeper's secure password manager solves several major functional and security gaps.

Keeper Security is RSA SecurID Access Certified.

RSA SecurID Access integrates RSA Authentication Manager and their Cloud Authentication Service. In this setup Cloud Authentication Service can be used as an identity provider in conjunction with Keeper SSO Connect. Detailed documentation is provided on the RSA website via the links below.

RSA SecurID Access Overview

Keeper Password Manager Integration Guides

Overview

Device Approvals are a required component of the SSO Connect Cloud platform. Approvals can be performed by users, admins, or automatically using the Keeper Automator service.

For customers who authenticate with Keeper SSO Connect Cloud, device approval performs a key transfer, in which the user's encrypted data key is delivered to the device, which is then decrypted locally using their elliptic curve private key.

Technical Details

Keeper SSO Connect Cloud provides Zero-Knowledge encryption while retaining a seamless login experience with any SAML 2.0 identity provider.

When a user attempts to login on a device that has never been used prior, an Elliptic Curve private/public key pair is generated on the new device. After the user authenticates successfully from their identity provider, a key exchange must take place in order for the user to decrypt the vault on their new device. We call this "Device Approval".

To preserve Zero Knowledge and ensure that Keeper's servers do not have access to any encryption keys, we developed a Push-based approval system that can be performed by the user or the designated Administrator. Keeper also allows customer to host a service which performs the device approvals and key exchange automatically, without any user interaction.

Approval Methods

Device approval methods include the following:

• Keeper Push (using push notifications) to existing user devices

• Admin Approval via the Keeper Admin Console

• Automatic approval via Keeper Automator service (preferred)

• Semi-automated Admin Approval via Commander CLI

See the below instructions:

F5

On the F5 BIG-IP APM, configure a new SAML IdP service for your Keeper platform: Go to Access Policy -> SAML -> BIG-IP as IdP -> Local IdP services

Navigate to: Access Policy > SAML : BIG-IP as IdP - Local IdP Services. Select your applicable IdP connection point and "Export Metadata".

Import the Metadata file extracted from F5 BIG-IP APM into SSO Connect Cloud instance and select F5 as the IDP Type.

Select Save to save the configuration and verify all settings look correct. Export the Keeper SSO Connect Cloud Metadata file for configuration of F5 BIG-IP APM from the Export Metadata link.

Your Keeper SSO Connect setup is now complete!

SecureAuth can be configured using the same instructions in the section. Please follow that guide in order to set up the SecureAuth environment.

For reference, use the SecureAuth guide located here:

A few additional important items to note regarding SecureAuth:

• Ensure that "By Post" is selected in the Connection Type section:

• Ensure to select "Sign SAML Assertion" and "Sign SAML Message".

• Ensure the Entity ID of the IdP metadata matches the SAML response from SecureAuth.

Move existing users/initial admin to SSO authentication

Users created in the root node (top level) will need to be migrated to the sub node that the SSO integration was configured on. If users remain in the root node, they will be prompted for the master password when accessing the vault and/or admin console.

After the user is moved to the SSO enabled node, they need to log into the Keeper vault initially by selecting the "Enterprise SSO" pull down and inputting in the Enterprise Domain configured on the SSO integration. The user may get prompted to confirm by entering in the master password.

Once the user has authenticated with SSO, they only need to use their email address moving forward to initiate SSO authentication.

If typing in the email address and clicking Next does not route the user to the desired SSO, ensure that just-in-time provisioning is enabled in the Keeper SSO configuration and ensure that your email domain is reserved by Keeper. More information regarding routing and domain reservation .

The previous section of Admin Console Configuration applies to every SAML 2.0 compatible passwordless provider. To help with configuration of common passwordless providers, we have added some helpful screens in this next section.

Keeper is compatible with all SAML 2.0 SSO passwordless authentication products. You can just follow the step by step instructions of a similar provider in the list above, and it will be generally the same setup flow.

(If you create a setup guide for your identity provider, please share it with us and we'll post it here!)

(1) Add a new service provider

From the Veridium interface, click on Add Service Provider.

(2) Download Keeper metadata

On the Keeper Admin Console, export the SAML Metadata file.

Go to View -> Export Metadata

(3) Upload Metadata to Veridium

In the service provider name box enter “Keeper”, upload the metadata file from Keeper and select “Email” as the NameID format.

(4) Map Attributes

Map the firstname, lastname and mail attributes and click “Save”.

Integration is now complete. A video demo of the Veridium login flow can be seen below:

Overview

Users can approve their additional devices by using a previously approved device. For example, if you are logged into your web vault on your computer already, and logging into your phone app for the first time, you will get a device approval prompt on your web vault with the mobile device's information which you can approve or deny. Device Approvals perform an encryption key exchange that allow a user on a new device to decrypt their vault.

Keeper Push Method

Keeper Push is a method of approval that the user handles for themselves. Selecting "Keeper Push" will send a notification to the user's approved devices. For mobile and desktop apps, the push will show as a pop-up, and the user can simply accept the device approval.

Here's an example of Keeper Push approval using mobile as the approver device:

Steps to Using Keeper Push

(1) Select Keeper Push

(2) User waits for the push approval to appear on the device in which they are already logged in.

(3) User must be already logged into a different, previously approved device in order to receive the notification.

Admin Approval Method via Admin Console

Selecting "Admin Approval" will send the request to the Keeper Administrator with the "Approve Devices" permission. The Admin can perform the approval through the Admin Console "Approval Queue" screen or by being logged into the Admin Console at the time of the request.

(1) User selects "Admin Approval"

(2) User waits for approval or comes back later

(3) Administrator logs into the Admin Console and visits the Approval Queue

(4) Admin reviews the information and approves the device

Select the device to approve and then click "Approve". If the user is waiting, they will be instantly permitted to login. Otherwise, the user can login at a later time without any approval (as long as they don't clear out their web browser cache or reset the app).

Approve Devices Role Permission

A special role permission called "Approve Devices" provides a Keeper Administrator the ability to approve a device.

(1) Go to Roles within the root node or the SSO node

(2) Select the gear icon to control the Admin Permissions for the selected role.

(3) Assign "Approve Devices" permission

Now, any user added to this role is able to login to the Admin Console to perform device approvals.

Keeper Automator can be deployed many different ways - on prem, cloud or serverless.

Data Flow Diagram

Network Firewall Setup

In your firewall inbound traffic rules, set one of following rulesets:

For US Data Center Customers:

• Inbound TCP port 443 from 54.208.20.102/32

• Inbound TCP port 443 from 34.203.159.189/32

US / GovCloud Data Center Customers:

• Inbound TCP port 443 from 18.252.135.74/32

• Inbound TCP port 443 from 18.253.212.59/32

For EU / Dublin Data Center Customers:

• Inbound TCP port 443 from 52.210.163.45/32

• Inbound TCP port 443 from 54.246.185.95/32

For AU / Sydney Data Center Customers:

• Inbound TCP port 443 from 3.106.40.41/32

• Inbound TCP port 443 from 54.206.208.132/32

For CA / Canada Data Center Customers:

• Inbound TCP port 443 from 35.182.216.11/32

• Inbound TCP port 443 from 15.223.136.134/32

For JP / Tokyo Data Center Customers:

• Inbound TCP port 443 from 54.150.11.204/32

• Inbound TCP port 443 from 52.68.53.105/32

Make sure to create a rule for each IP address listed based on your Keeper geographic data center region.

This page contains various graphic assets of Keeper icons and logos for use in your identity provider, if required.

Zip file with various sizes:

512x512 PNG Square Icon:

256x256 PNG Square Icon:

128x128 PNG Square Icon:

Keeper Logo - JPG white background:

Keeper Logo - PNG transparent background:

Keeper Logo - JPG White on black background:

Unable to communicate with the Automator service

There are several reasons why Keeper Commander is unable to communicate with your Automator service:

• Ensure that the automator service is open to Keeper’s IP addresses. The list of IPs that must be open are found at this Ingress Requirements page. We recommend also adding your own IP address so that you can troubleshoot the connection.

• If you are using a custom SSL certificate, ensure that the SSL certificate is loaded. Check the Automator log files which will indicate if the certificate is loaded by the service restart. If the IP address is open to you, you can run a health check on the command line using curl, for example: curl https://automator.mycompany.com/health

• Check that the subject name of the certificate matches the FQDN.

• Check that your SSL certificate includes the CA intermediate certificate chain. This is the most common issue that causes a problem. Keeper will refuse to connect to Automator if the intermediate certificate chain is missing. You can do this using openssl like the following:

openssl s_client -showcerts -servername automator.company.com -connect automator.company.com

This command will clearly show you the number of certificates in the chain. If there's only a single cert, this means you did not load the full chain. To resolve this, see Step 4 of the Custom SSL Certificate step by step instructions page.

400 Error in Health Checks

This may occur if the healthcheck request URI does not match the SSL certificate domain. To allow the healthcheck to complete, you need to disable SNI checks on the service. This can be accomplished by setting the disable_sni_check=true in the Automator configuration or passing in the environmental variable DISABLE_SNI_CHECK with the value of "true".

• Migration from On-Prem to SSO Cloud

• SSO Certificate Renewal

• Keeper Security Website

• Keeper Enterprise Guide

• SSO Connect Product Page

• ​Release Notes

Different customers may have different desired behavior when a user clicks on "Logout" from their Keeper vault. There are two choices:

Option 1: Don't logout from IdP

• Clicking "Logout" from the Keeper Vault will just close the vault but stay logged into the Identity Provider.

• Logging into the Keeper Vault again will defer to the Identity Provider's login logic. For example, Okta has configurable Sign-On rules which allow you to prompt the user for their MFA code before entering the application. See your identity provider sign-on logic to determine the best experience for your users.

Option 2: Logout from IdP

• Clicking "Logout" from the Keeper Vault will also logout the user from the Identity Provider.

• This may create some frustration with users because they will also logout from any IdP-connected services.

• Users would need to be directed to simply close the vault and not click "Logout" if they don't like this behavior.

How to Enable Single Logout (SLO)

• If your identity provider has a "Single Logout" option, then you can turn this feature ON from the identity provider configuration screen. For example, Okta has a "Single Logout" checkbox and they require that the "Keeper SP Certificate" is uploaded. After changing this setting, you will need to export the metadata from the IdP and import it back into the Keeper SSO configuration screen.

How to Disable Single Logout (SLO)

• If your identity provider has a "Single Logout" option, then you can turn this feature OFF from the identity provider configuration screen and upload the new metadata file into Keeper.

• If the IdP does not have a configuration screen on their user interface, you can just manually edit the IdP metadata file (screenshot below). In a text editor or vim, remove the lines highlighted below that represent the SLO values. Then save the file and upload the metadata into the Keeper SSO configuration screen.

The previous section of Admin Console Configuration applies to every SAML 2.0 compatible identity provider. To help with any IdP-specific configuration of common identity providers, we have added some helpful screens in this next section.

If your Identity Provider is not listed here, don't worry. Keeper is 100% compatible with all SAML 2.0 SSO identity providers and Passwordless authentication products. You can just follow the step by step instructions of a similar provider in the list above, and it will be generally the same setup flow.

(If you create a setup guide for your identity provider, please share it with us and we'll post it here!)

Overview

The Keeper Automator is a self-hosted service which performs cryptographic operations including device approvals, team approvals and team user assignments.

Once Automator is running, users can seamlessly access Keeper on a new (not previously approved) device after a successful authentication with your identity provider, without any further approval steps. Without the Automator service, users and admins can still perform manual device approvals through Push Approval methods.

Keeper Automator is a lightweight service that can be deployed in your cloud or on-prem environment.

Why is this needed?

Keeper SSO Connect provides seamless authentication into the Keeper vault using your identity provider. Normally a user must a approve their new device, or an Admin can approve a new device for a user. The Automator service is totally optional, created for Admins who want to remove any friction associated with device approvals.

To preserve Zero Knowledge and automate the transfer of the Encrypted Data Key (EDK) to the user's device, a service must be run which is operated by the Enterprise (instead of hosted by Keeper). The service can be run several different ways, either in the cloud or self-hosted.

An in-depth explanation of SSO Connect encryption model is

Installation Options

Depending on your environment, select from one of the following installation methods. The , , and Google are the best choices if you use one of these cloud services.

Installation Method: Azure Container App

Installation Method: Azure App Services

Installation Method: Azure App Gateway

Installation Method: AWS Elastic Container Service

Installation Method: AWS Elastic Container Service with KSM

Installation Method: Google Cloud with GCP Cloud Run

Installation Method: Standalone Java

Installation Method: Docker

Installation Method: Docker Compose

Installation Method: Kubernetes

Installation Method: Windows Service

Automator Security

Using the Automator service creates a frictionless experience for users, however it requires that you have fully secured your identity provider.

Please refer to our guide to securing your Keeper environment.

Overview

Version v17.0+ incorporated several new features:

• Team Approvals (Team Creation)

• Team User Approvals (Assigning Users to Teams)

• All settings can be configured as environment variables

• Support for simplified deployment

• Support for simplified deployment

• HSTS is enabled for improved HTTPS security

• IP address filtering for device approval and team approval

• Optional rate limiting for all APIs

• Optional filtering by email domain

• Optional binding to specific network IPs

Team User approvals

Teams and users who are provisioned through SCIM can be immediately processed by the Automator service (instead of waiting for the admin to login to the console).

To activate this new feature:

• Update your Automator container or .zip file to the latest version

• Use the automator edit command in Keeper Commander to instruct the service to perform device approvals and also perform Team User approvals:

Example:

Team Approvals

When team creation is requested by the identity provider via SCIM messaging, the request is not fully processed until someone can generate an encryption key (to preserve Zero Knowledge). This is normally processed when an admin logs into the Keeper Admin Console.

When team approvals is activated on the Keeper Automator service, teams are now created automatically when any assigned user from the team logs in successfully to the Keeper Vault. Therefore, teams will not appear in the environment until at least one user from that team logs into their vault.

All settings can be configured as environment variables

This makes configuration easier when installing Automator in Azure Containers or other Docker-like containers where access to the settings file is difficult.

In Docker, Azure Containers, or other environments that use the docker-compose.yml file, you can set environment variables in the docker compose file, for example:

After editing the docker-compose.yml file, you will need to rebuild the container if the environment variables have changed. Just restarting the container will not incorporate the changes.

Advanced Features

for all of the new and advanced features / settings for the Automator service.

Auth0 SSO Configuration

Login to the Admin section of the Auth0 portal.

Select the Applications tab and click Create Application. Choose Regular Web Applications.

Next, go to the Addons tab and click SAML2 WEB APP.

On the Settings page that comes up next, you will need the “Assertion Consumer Service (ACS) Endpoint” that comes from the Keeper Admin Console.

Example Assertion Consumer Service (ACS) Endpoint: https://keepersecurity.com/api/rest/sso/saml/XXXXXXXX

This value can be found under the SSO Connect Cloud configuration as part of the Service Provider information, as seen below:

Paste the Assertion Consumer Service (ACS) Endpoint into the Application Callback URL field in the Auth0 screen.

Next, remove the sample JSON in the SAML2 Web App editor window, and replace with the following:

{
  "audience": "https://keepersecurity.eu/api/rest/sso/saml/XXXXX",
  "mappings": {
    "email": "Email",
    "given_name": "First",
    "family_name": "Last"
  },
  "createUpnClaim": false,
  "passthroughClaimsWithNoMapping": false,
  "mapUnknownClaimsAsIs": false,
  "mapIdentities": false,
  "nameIdentifierFormat": "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
  "nameIdentifierProbes": [
    "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"
  ]
}

The value for “audience” is the Entity ID. This can also be found under the SSO Connect Cloud configuration as part of the Service Provider information:

Once you've added the Entity ID, you can click the Debug button to verify there are no formatting issues.

Next, scroll down to the bottom of the SAML2 Web App window and click Save.

Next, click on the Usage tab and download the Identity Provider Metadata file.

On the Keeper side, edit the SSO configuration and select GENERIC as the IDP Type. You can upload the metadata.xml file into the Keeper SSO Connect interface by browsing to or dragging and dropping the file into the Setup screen:

Move existing users/initial admin to SSO authentication

Users created in the root node (top level) will need to be migrated to the sub node that the SSO integration was configured on. If users remain in the root node, they will be prompted for the master password when accessing the vault and/or admin console.

After the user is moved to the SSO enabled node, they need to log into the Keeper vault initially by selecting the "Enterprise SSO" pull down and inputting in the Enterprise Domain configured on the SSO integration. The user may get prompted to confirm by entering in the master password.

Once the user has authenticated with SSO, they only need to use their email address moving forward to initiate SSO authentication. They won't have to enter the Enterprise Domain.

If typing in the email address and clicking Next does not route the user to the desired SSO, ensure that just-in-time provisioning is enabled in the Keeper SSO configuration and ensure that your email domain is reserved by Keeper. More information regarding routing and domain reservation can be found here.

Duo Setup

These instructions assume Duo has already been successfully enabled and configured with an authentication source (Active Directory or IdP). To activate Duo SSO, visit your Duo Admin Panel and visit the "Single Sign-On" section.

Step 1: DUO SSO Configuration

Log in to the Duo Admin Panel and click Protect an Application. Search for Keeper and choose Keeper Security with type "2FA with SSO hosted by Duo (Single Sign-On)" in the applications list then click "Protect" (shown below as Configure).

Step 2: Metadata

The Download section is where you can download the SAML metadata file to upload into your SSO provisioning method.

Back on the Keeper Admin console, locate your DUO SSO Connect Cloud Provisioning method and select Edit.

Scroll down to the Identity Provider section, set IDP Type to DUO SSO, select Browse Files and select the DUO Metadata file previously downloaded.

Still within the Keeper Admin Console, exit Edit View and select View on your DUO SSO Connect Cloud Provisioning method. Within the Service Provider section you will find the metadata values for the Entity ID, IDP Initiated Login Endpoint and Assertion Consumer Service (ACS) Endpoint.

Return to the application page in your Duo Admin Panel, copy and Paste the Entity ID, Login Endpoint and ACS Endpoint into the Service Provider section.

Step 3: Map User Attributes

Within the SAML Response section, scroll down to Map attributes and map the following attributes.

Step 4: Policy (optional)

Within the Policy section, defines when and how users will authenticate when accessing this application. Your global policy always applies, but you can override its rules with custom policies.

Step 5: Global Policy

Within the Global Policy section, Review / Edit / Verify any Global Policy as seen by your DUO and or Keeper administrator.

Troubleshooting

If you need assistance implementing the Keeper Security EPM - Single Sign-On application within your DUO environment, please contact the Keeper support team.

Moving Existing Users to Duo SSO

Users created in the root node (top level) in the Keeper Admin Console will need to be moved to the SSO node if you want the users to login with Duo. An admin cannot move themselves to the SSO enabled node, another admin must perform this action.

After the user is moved to the SSO enabled node, they can login to the Keeper vault by simply typing their email address and clicking "Next". If this does not work, please ensure that your email domain (e.g. company.com) has been reserved to your enterprise and ensure that Just-In-Time provisioning is enabled.

To onboard with the Enterprise Domain, the user can select the "Enterprise SSO" pull down and type in the Enterprise Domain configured in the Keeper Admin Console.

Once the user has authenticated with SSO for the first time, they only need to use their email address next time to initiate SSO authentication.

If typing in the email address and clicking Next does not route the user to the desired SSO, ensure that just-in-time provisioning is enabled in the Keeper SSO configuration and ensure that your email domain is reserved by Keeper. More information regarding routing and domain reservation can be found here.

OneLogin Setup:

1. Login to the OneLogin portal.

2. Select Administration to enter the admin section.

3. From the onelogin menu select Applications then Add App.

In the Search field, do a search for Keeper Password Manager and select it from the search result.

4. On the Add Keeper Manager screen click Save.

5. The next step is to download the SAML Metadata from OneLogin. Select the down arrow on the MORE ACTIONS button and select SAML Metadata.

Drag and drop or browse to this saved file on the SAML Metadata Section of the Single Sign-On with SSO Connect™ Cloud section on the Keeper Admin Console.

6. On the Keeper Admin Console, copy the Assertion Consumer Service (ACS) Endpoint field.

7. Back on the OneLogin Configuration tab, paste in the Keeper SSO Connect Assertion Consumer Service (ACS) Endpoint field and then click Save.

8. If SCIM is desired then go back on the Keeper Provisioning tab, click on "Add Method" and select SCIM. If not skip to step to step 12.

9. Click Generate then copy the URL and Token.

10. Paste the "URL" into the SCIM Base URL, and paste the "Token" into the SCIM Bearer Token.

11. On the Keeper Admin Console make sure to Save the SCIM token.

12. Click Save and the integration is complete.

Move existing users/initial admin to SSO authentication

Users created in the root node (top level) will need to be migrated to the sub node that the SSO integration was configured on. If users remain in the root node, they will be prompted for the master password when accessing the vault and/or admin console.

After the user is moved to the SSO enabled node, they need to log into the Keeper vault initially by selecting the "Enterprise SSO" pull down and inputting in the Enterprise Domain configured on the SSO integration. The user may get prompted to confirm by entering in the master password.

Once the user has authenticated with SSO, they only need to use their email address moving forward to initiate SSO authentication.

They won't have to enter the Enterprise Domain. If typing in the email address and clicking Next does not route the user to the desired SSO, ensure that just-in-time provisioning is enabled in the Keeper SSO configuration and ensure that your email domain is reserved by Keeper. More information regarding routing and domain reservation can be found here.

Ping Identity Configuration

Login to the Ping Identity portal.

In your existing Environment click Manage Environment.

On the left, click Applications > Application Catalog > Search "Keeper" and select "Keeper Password Manager"

On the Application Details page, add the following data:

• Keeper Security Domain: keepersecurity.com

• Keeper Security Identifier: Can be found in the admin console under Entity ID https://keepersecurity.com/api/rest/sso/saml/<Identifier>

  • Log in to the Keeper Admin Console at https://keepersecurity.com/console/.

  • In the left panel, go to Admin and select a sub-node (not the root).

  • Navigate to Provisioning → Add Method → Single Sign-On with SSO Connect® Cloud.

  • Enter a configuration name, add your domain, and click Save.

  • After the SSO configuration is created, click the three-dot menu (⋮) next to it and select View to display the Entity ID.

• Once that is complete we can save and move on to the next steps.

Next, we can add the Groups who will be accessing the Keeper Application and click Save.

Click Download Metadata as we will upload this to Keeper in the next step.

On the Edit screen of the Keeper SSO Connect Cloud provisioning select "Generic" as the IDP Type and upload the saml2-metadata-idp xml file into the Keeper SSO Connect interface by browsing to or dragging and dropping the file into the Setup screen:

The Keeper Application should be added and enabled.

Your Keeper SSO Connect setup is now complete!

Move existing users/initial admin to SSO authentication

Users created in the root node (top level) will need to be migrated to the sub node that the SSO integration was configured on. If users remain in the root node, they will be prompted for the master password when accessing the vault and/or admin console.

After the user is moved to the SSO enabled node, they need to log into the Keeper vault initially by selecting the "Enterprise SSO" pull down and inputting in the Enterprise Domain configured on the SSO integration. The user may get prompted to confirm by entering in the master password.

Once the user has authenticated with SSO, they only need to use their email address moving forward to initiate SSO authentication.

They won't have to enter the Enterprise Domain. If typing in the email address and clicking Next does not route the user to the desired SSO, ensure that just-in-time provisioning is enabled in the Keeper SSO configuration and ensure that your email domain is reserved by Keeper. More information regarding routing and domain reservation can be found here.

PingOne

Login to the PingOne portal at https://admin.pingone.com/.

From the PingOne console menu, select Applications > Application Catalog

Search "Keeper" and click on the "Keeper Password Manager - Cloud SSO" link to add the Keeper Password Manager application

Click Setup to proceed to the next step

Click "Continue to Next Step"

From the Keeper Admin Console, view the PingOne SSO Connect Cloud entry and click Export Metadata and save it in a safe location for future use. Also click Export SP Cert and save it in a safe location for future use.

From the PingOne Admin Console, click Select File next to "Upload Metadata" and browse to the saved metadata file from the Keeper Admin Console. This should populate the "ACS URL" and "Entity ID" fields with the proper datapoints.

Click on Choose File next to "Primary Verification Certificate" and browse to the saved .crt file from the Keeper Admin Console. Click on the checkbox next to "Encrypt Assertion" and then click Choose File next to "Encryption Certificate". Browse to the same saved .crt file from the Keeper Admin Console.

Validate the certificate and click "Continue to Next Step".

Enter the appropriate values associated with each attribute (see below image) and click Continue to Next Step

Modify the Name to appropriately match the Configuration Name of the SSO node from the Keeper Admin Console. Click Continue to Next Step

You may choose to add PingOne user groups to your application. Click Add next to the group or groups you would like to add and click Continue to Next Step.

Click Download next to "SAML Metadata" and save the .xml file to a safe location.

Click Finish to complete the application setup wizard.

On the Edit Configuration screen of the Keeper SSO Connect Cloud provisioning in the Keeper Admin Console, select PingOne as the IDP Type.

Upload the SAML Metadata file downloaded in the previous step into the Keeper SSO Connect interface by browsing to or dragging and dropping the file into the SAML Metadata section.

The PingOne Keeper SSO Connect Cloud™ entry will now show as Active.

Your PingOne Keeper SSO Connect Cloud™ setup is complete!

Move existing users/initial admin to SSO authentication

Users created in the root node (top level) will need to be migrated to the sub node that the SSO integration was configured on. If users remain in the root node, they will be prompted for the master password when accessing the vault and/or admin console.

After the user is moved to the SSO enabled node, they need to log into the Keeper vault initially by selecting the "Enterprise SSO" pull down and inputting in the Enterprise Domain configured on the SSO integration. The user may get prompted to confirm by entering in the master password.

Once the user has authenticated with SSO, they only need to use their email address moving forward to initiate SSO authentication.

They won't have to enter the Enterprise Domain. If typing in the email address and clicking Next does not route the user to the desired SSO, ensure that just-in-time provisioning is enabled in the Keeper SSO configuration and ensure that your email domain is reserved by Keeper. More information regarding routing and domain reservation can be found here.

Rippling Setup

1. Login to the Rippling admin account.

2. After logging in, on the left side hover over Home and click App Shop in the bottom left.

3. In the App Shop, search for Keeper in the upper left corner and select it from the search result.

4. After selecting clicking on the Keeper app, click Connect Account to get started with SSO.

5. Rippling has it's own SSO set up walkthrough, continue the walkthrough to set up SSO.

6. Once you have reached this page, the SSO setup is complete, however there is also an option for SCIM provisioning. If you would like SCIM provisioning, select Continue with API and follow the SCIM provisioning walkthrough. Otherwise, click Skip for now, visit app.

You can assign users to the application and designate who has access to keeper in your Rippling environment here.

Move existing users/initial admin to SSO authentication

Users created in the root node (top level) will need to be migrated to the sub node that the SSO integration was configured on. If users remain in the root node, they will be prompted for the master password when accessing the vault and/or admin console.

After the user is moved to the SSO enabled node, they need to log into the Keeper vault initially by selecting the "Enterprise SSO" pull down and inputting in the Enterprise Domain configured on the SSO integration. The user may get prompted to confirm by entering in the master password.

Once the user has authenticated with SSO, they only need to use their email address moving forward to initiate SSO authentication.

They won't have to enter the Enterprise Domain. If typing in the email address and clicking Next does not route the user to the desired SSO, ensure that just-in-time provisioning is enabled in the Keeper SSO configuration and ensure that your email domain is reserved by Keeper. More information regarding routing and domain reservation can be found here.

Overview

Keeper Automator supports a multi-tenant configuration, so that a single deployment can perform automations for multiple Keeper Enterprise environments.

• For MSP environments, a single Keeper Automator instance can be used to run multiple Managed Companies.

• For Enterprise customers, a single instance can process approvals for any number of identity providers.

Once the server is running, you can use it for multiple SSO nodes, even in different enterprises.

MSP with Multiple Managed Companies

The steps for activating one Automator instance for multiple Managed Companies is below:

(1) Login to Commander as the MSP Admin

My Vault> login [email protected]

(2) Switch context to the Managed Company

My Vault> msp-info

MSP Plans and Licenses
-----------------------
  #  Plan Id           Available Licenses    Total Licenses    Stash
---  --------------  --------------------  ----------------  -------
  1  business                          83               100        0
  2  businessPlus                      50               100        0
  3  enterprise                        80               100        0
  4  enterprisePlus                    85               100        0

  #      ID  Name                     Plan              Allocated    Active
---  ------  -----------------------  --------------  -----------  --------
  1   81386  Demo Managed Co. LLC     enterprisePlus            5         0
  2   81344  Elite Auto Works         business                  5         4
  3  114391  John's Garage            enterprisePlus            5         0
  4  114392  John's Garages           enterprisePlus            5         0
  5   81345  Perfect Teeth Dental     businessPlus             50         4
  6  114281  Test                     business                 12         0
  7   81346  Troy Financial Services  enterprise               20         0

Find the MC you want to set up, select the ID and then type:

switch-to-mc <ID>

(3) Create an Automator instance

Use the common Automator URL in the "edit" step

For example:

My Vault> automator create --name="Tenant1" --node="SSO Node"
My Vault> automator edit --url=https://my.company.com:8089 --skill=team_for_user --skill=device <Automator ID>
My Vault> automator setup <Automator ID>
My Vault> automator init <Automator ID>
My Vault> automator enable <Automator ID>

(4) Switch back to MSP

Switch back to the MSP Admin context

My Vault> switch-to-msp

For each Managed Company, repeat the above 4 steps.

Multi-Tenant Enterprise

The steps for activating one Automator instance for multiple Nodes in the same Enterprise tenant is below:

(1) Login to Commander as Admin

My Vault> login [email protected]

(2) Create the Automator Instance

For each Node, use the same "edit" URL. For example:

My Vault> automator create --name="Tenant A" --node="<node_name>"
My Vault> automator edit --url=https://my.company.com:8089 --skill=team --skill=team_for_user --skill=device <Automator ID>
My Vault> automator setup <Automator ID>
My Vault> automator init <Automator ID>
My Vault> automator enable <Automator ID>

Then, simply set up another instance with the same URL endpoint:

My Vault> automator create --name="Tenant B" --node="Azure"
My Vault> automator edit --url=https://my.company.com:8089 --skill=team --skill=team_for_user --skill=device <Automator ID>
My Vault> automator setup <Automator ID>
My Vault> automator init <Automator ID>
My Vault> automator enable <Automator ID>

Note that they have different names and IDs and are assigned to different nodes but they use the same URL.

Repeat step (2) for every node to set up multiple tenants on the same Automator instance.

Configuration of Keeper SSO Connect Cloud™ is very simple and should only take a few minutes if you've previously configured other service providers with your IdP. Please follow the general steps in this document.

Step 1. Visit the Keeper Admin Console and login as the Keeper Administrator. US: EU: AU: CA: JP: US GovCloud:

Step 2. After logging in, click on the Admin menu and select Add Node. This new node is where your SSO users will be provisioned.

Step 3. On the new node, select the Provisioning tab and click Add Method

Step 4. Select Single Sign-On with SSO Connect Cloud™ and click Next

Step 5. Enter the Configuration Name and Enterprise Domain. The Configuration Name will not be seen by your end users and allows you to manage multiple configurations. The Enterprise Domain will be used for logging in, therefore we recommend selecting a name that is unique and easy to remember.

• Configuration Name: Internal use only, your users will not see this.

• Enterprise Domain: Users will type in this name when authenticating in certain flows. It can be your domain name or any unique string.

• Enable Just-In-Time Provisioning: To allow users the ability to self-onboard to your Keeper enterprise tenant, enable the Just-in-Time provisioning feature. This is enabled by default. Just-In-Time Provisioning also allows new users with your domain name to automatically route to the SSO provider if the domain has been . If you are planning to use the Keeper Bridge for provisioning users instead of Just-In-Time SSO provisioning, please leave this option OFF.

Step 6. Click Save to proceed to the next step. Keeper will automatically open the "Edit Configuration" screen next.

Step 7. From the Edit Configuration screen, select your IdP (or "Generic"), upload the metadata file from your identity provider into Keeper and set up the 3 required attribute mappings. Note that Keeper works with any SAML 2.0 compatible identity provider.

There are a couple of additional options available here:

• Enable IsPassive: We recommend leaving this off unless required by your IdP.

• ForceAuthn: For customers who want to force a new SSO login session on every Keeper Vault login, turn this on.

• Identity Provider: To assist you with the configuration of common identity providers, there is a drop-down "IDP Type" which allows you to select pre-defined setups. If your identity provider is not listed, please select "GENERIC".

• SAML Metadata: Drag and drop the IdP Metadata file provided by your IdP into the Keeper configuration screen. This critical file provides Keeper with the URL endpoint and digital certificate to validate signed assertions.

• Identity Provider Attribute Mappings: Keeper expects First Name, Last Name and Email to be called "First", "Last" and "Email" by default, but this can be changed. Make sure your identity provider is mapping to the field names on this screen exactly as written (case sensitive!).

• Single Sign On Endpoint Preferences: This is advanced configuration and defaults to "Prefer HTTP post".

Step 8. At some point during your configuration with the IdP, you'll need to enter a few parameters from Keeper such as "Entity ID" and "ACS URL". This information is available on the "View Configuration" screen. You can get here by going back then clicking on "View".

Make note of the URLs that are provided on this screen that you may need to set within your identity provider.

• Entity ID: This can be referred to as "SP Entity ID", or "Issuer". It's basically a unique identifier that must be known by both sides. Often times, the Entity ID is the same as the ACS URL endpoint.

• Assertion Consumer Service Endpoint ("ACS URL"): This is the URL endpoint at Keeper to which your identity provider will send users after they authenticate. The data sent to Keeper will include a signed assertion that indicates if the user has successfully signed into the identity provider. The assertion is signed with the identity provider's private key. Keeper validates the signature with the identity provider's public key, which is provided in the IdP metadata file.

• Single Logout Service Endpoint ("SLO"): This is the URL endpoint at Keeper to which your identity provider will send logout requests. Single Logout is optional and this is something you configure at your identity provider.

This information is also available in the Keeper XML metadata file which can be optionally downloaded by clicking "Export Metadata". Upload the metadata file to your identity provider if required.

Domain Reservation and Just-In-Time provisioning

If Just In Time provisioning is enabled, you can automatically route users to the identity provider when the user types in their email and clicks "Next" from the Vault login screen. This applies to all devices including Web Vault, Desktop App, Browser Extensions, iOS and Android apps.

Keeper maintains a list of "personal" domains, for example gmail.com and yahoo.com which cannot be reserved and allow the general public to create Keeper accounts with those domains, with a verified email.

If you would like to allow end-users to create personal or Enterprise accounts with your reserved domain outside of your enterprise tenant, please contact the Keeper support team and we can unlock this domain for you.

HENNGE SSO Configuration

(1) Log into the HENNGE Administrator console.

Click the Administration tile on the menu.

(2) Next, Select the Connected Services menu item and click Add Service.

On the "Add New Service" page, Click the Add Service Manually at "Add Service for SSO" menu.

(3) Set the Service name to “Keeper Password Manager and Digital Vault” or whatever you prefer, and Add the Attributes Email claim with the value "UsePrincipleName (UPN)", then Click the Submit button.

Now you can see all values required for Keeper side configuration at Step (5). Click X at the right up and Leave this page for now.

On the Connected Services menu area, Click the Service Name you created and then click the "Upload Using Metadata" button.

(4) After the metadata has been uploaded, head back to the HENNGE Connected Service configuration page and input the Login URL as such https://keepersecurity.com/api/rest/sso/ext_login/<YourSSOIdHere>.

Complete the configuration by scrolling to the bottom of the page and select the Save Changes button.

(5) Last step is to export the metadata from this connector to import it into the Keeper SSO Connect Cloud™.

Set the IDP Type to GENERIC and upload this file into the Keeper SSO Connect Cloud™ provisioning interface by dragging and dropping the file into the edit screen:

Assign Users

From HENNGE, you can now add users at Access Policy section on the User list page, or groups at Allowed services section on Access Policy Groups page.

Move existing users/initial admin to SSO authentication

Users created in the root node (top level) will need to be migrated to the sub node that the SSO integration was configured on. If users remain in the root node, they will be prompted for the master password when accessing the vault and/or admin console.

After the user is moved to the SSO enabled node, they need to log into the Keeper vault initially by selecting the "Enterprise SSO" pull down and inputting in the Enterprise Domain configured on the SSO integration. The user may get prompted to confirm by entering in the master password.

Once the user has authenticated with SSO, they only need to use their email address moving forward to initiate SSO authentication.

They won't have to enter the Enterprise Domain. If typing in the email address and clicking Next does not route the user to the desired SSO, ensure that just-in-time provisioning is enabled in the Keeper SSO configuration and ensure that your email domain is reserved by Keeper. More information regarding routing and domain reservation .

JumpCloud

(1) Log into the JumpCloud Administrator console.

Select the SSO tab on the side menu.

(2) Next, select the + icon in the upper left corner.

On the "Get Started with SSO Application page, search for Keeper in the search bar. Select Configure on the Keeper Application.

(3) Next, on Keeper Application connector page, General Info section set the Display Label: Keeper Security Password Manager

On the Single Sign-On Configuration area, click the "Upload Metadata" button.

(4) After the metadata has been uploaded, head back to the JumpCloud SSO configuration page and input the Login URL as such https://keepersecurity.com/api/rest/sso/ext_login/<YourSSOIdHere>.

Complete the configuration by scrolling to the bottom of the page and select the activate button.

(5) Last step is to export the metadata from this connector to import it into the Keeper SSO Connect Cloud™.

Set the IDP Type to GENERIC and upload this file into the Keeper SSO Connect Cloud™ provisioning interface by dragging and dropping the file into the edit screen:

Move existing users/initial admin to SSO authentication

Users created in the root node (top level) will need to be migrated to the sub node that the SSO integration was configured on. If users remain in the root node, they will be prompted for the master password when accessing the vault and/or admin console.

After the user is moved to the SSO enabled node, they need to log into the Keeper vault initially by selecting the "Enterprise SSO" pull down and inputting in the Enterprise Domain configured on the SSO integration. The user may get prompted to confirm by entering in the master password.

Once the user has authenticated with SSO, they only need to use their email address moving forward to initiate SSO authentication.

They won't have to enter the Enterprise Domain. If typing in the email address and clicking Next does not route the user to the desired SSO, ensure that just-in-time provisioning is enabled in the Keeper SSO configuration and ensure that your email domain is reserved by Keeper. More information regarding routing and domain reservation .

Okta SSO Configuration

Login to the Admin section of the Okta portal.

Select the Applications menu item and click Browse App Catalog.

Search for “Keeper Password Manager”, and then select the Add button for the Keeper Password Manager and Digital Vault application.

On the General Settings page that comes up next, you need the "Entity ID" that comes from the Keeper Admin Console.

Example Server Base URL: https://keepersecurity.com/api/rest/sso/saml/XXXXXXXX

The value for XXXXXXXX represents the specific SSO Connect instance associated with your enterprise and can be found on the Admin Console SSO configuration as part of the Service Provider information, as seen below:

Paste the Entity ID into the Server Base URL field in the Okta screen.

Select the Sign On tab.

Scroll down to the SAML Signing Certificates configuration section, and select Actions > View IdP metadata.

Save the resulting XML file to your computer. In Chrome, Edge and Firefox, select File > Save Page As... and save the metadata.xml file.

In the Keeper Admin Console, Edit the SSO configuration then Select OKTA as the IDP Type and upload the metadata.xml file into the Keeper SSO Connect interface by browsing to or dragging and dropping the file into the Setup screen:

(Optional) Enable Single Logout

If you would like to enable the Single Logout feature in Okta, go to the Sign On tab and click Edit. Click the Enable Single Logout checkbox and then upload the SP Cert which comes from the Keeper Admin Console.

To first download the SP Cert, view the SSO configuration on Keeper and click the Export SP Cert button.

Upload the SP cert file and be sure to click Save to save the Sign On settings in Okta.

From the Actions menu, select View IdP metadata.

Save the resulting XML file to your computer. In Chrome, Edge and Firefox, select File > Save Page As... and save the metadata.xml file.

In the Keeper Admin Console, Edit the SSO configuration then upload the new metadata.xml file into the Keeper SSO Connect interface by browsing to or dragging and dropping the file into the Setup screen.

Okta SCIM Provisioning

To enable Okta SCIM user and group provisioning please follow the instructions found within the Keeper Enterprise Guide:

Assign Users

From Okta, you can now add users or groups on the Assignments page. If you have activated SCIM provisioning per the instructions then the user will be instantly provisioned to Keeper.

Move existing users/initial admin to SSO authentication

Users created in the root node (top level) will need to be migrated to the sub node that the SSO integration was configured on. If users remain in the root node, they will be prompted for the master password when accessing the vault and/or admin console.

After the user is moved to the SSO enabled node, they need to log into the Keeper vault initially by selecting the "Enterprise SSO" pull down and inputting in the Enterprise Domain configured on the SSO integration. The user may get prompted to confirm by entering in the master password.

Once the user has authenticated with SSO, they only need to use their email address moving forward to initiate SSO authentication.

If typing in the email address and clicking Next does not route the user to the desired SSO, ensure that just-in-time provisioning is enabled in the Keeper SSO configuration and ensure that your email domain is reserved by Keeper. More information regarding routing and domain reservation .

Onboarding Users

There are several options for onboarding users who inside an SSO-provisioned node:

Option 1: Using SCIM Automated Provisioning

• If your identity provider supports Automated Provisioning (using the SCIM protocol), users will be automatically provisioned with a Keeper Vault.

• Follow our guide for instructions on setting up SCIM with your identity provider, if you haven't done this.

• Users who are provisioned through SCIM can simply type in their Email Address on the Vault Login screen and they will be automatically directed to the IdP login screen to complete the sign-in. Please makes sure that your email domain is reserved with Keeper so that we route your users to the IdP. to learn about domain reservation.

• After authentication to the IdP, the user will instantly be logged into their Vault on their first device. Subsequent devices will require Device Approval.

Option 2: Using Just-In-Time (JIT) Provisioning

If Just-In-Time (JIT) provisioning is activated on your SSO configuration, there are a few ways that users can access their vault:

(1) Direct your users to the identity provider dashboard to click on the Keeper icon (IdP-initiated Login).

(2) Provide users with a hyperlink to the Keeper application within the identity provider (see your IdP Application configuration screen for the correct URL).

(3) Send users to the Keeper Vault to simply enter their email address and click "Next".

(4) If using the email address is not desired, users can also click on "Enterprise SSO Login" using the "Enterprise Domain" that you configured in the Admin Console for the SSO connection.

(5) Hyperlink users directly to the Enterprise Domain login screen on Keeper using the below format:

• Replace <domain> with the endpoint of the data center where your Keeper tenant is hosted. This can be one of the following:

  • keepersecurity.com

  • keepersecurity.eu

  • keepersecurity.com.au

  • govcloud.keepersecurity.us

  • keepersecurity.jp

  • keepersecurity.ca

• Replace <name> with the name of the Enterprise Domain that has been assigned in the Admin Console.

Option 3: Manually Inviting Users

If you prefer to manually invite users from the Admin Console instead of using Just-In-Time provisioning, follow these steps:

• Login to the Keeper Admin Console

• Open the node which is configured with your identity provider

• Click on "Add Users" to invite the user manually

• User can then simply type in their email from the Vault login screen to sign in

Note: Additional customization of the Email Invitation including graphics and content can be made by visiting the "Configuration" screen of the Admin Console.

Move existing users/initial admin to SSO authentication

Users created in the root node (top level) will need to be migrated to the sub node that the SSO integration was configured on. If users remain in the root node, they will be prompted for the master password when accessing the vault and/or admin console.

Keeper SSO Connect Certificate Renewal Process

It is critical to ensure that your IdP SAML Signing Certificates are renewed and activated. Typically, this occurs once per year.

If you receive the below error when logging into the Keeper vault, this usually indicates that the SAML Signing Certificate has expired.

"Sorry! There was an unexpected error logging you into Keeper via your company account. We are unable to parse the SAML Response from the IDP"

Resolution

To resolve this issue, please follow the basic steps below:

1. Update the SAML signing certificate from your identity provider related to the Keeper application

2. Download the new SAML signing certificate and/or IdP metadata file

3. Update the IdP metadata in the Keeper Admin Console

Entra ID / Azure AD Instructions

Since Microsoft Azure is the most widely used identity provider, the step by step update guide is documented below. If Azure is not your provider, the process is very similar.

(1) Login to the Azure Portal () and go to Enterprise Applications > Keeper > Set up Single sign on

(2) Under the SAML Certificates section, note that the certificate has expired. Click Edit.

(3) Click on New Certificate to generate a new cert.

(4) Click the overflow menu and then click "Make certificate active" the Save and apply the changes.

(5) From the SAML Certificates section, download the new Federation Metadata XML file. Save this to your computer.

(6) Update the SAML Metadata in the Keeper Admin Console

From the Keeper Admin Console, login to the Keeper tenant and visit the SSO configuration.

• Select the SSO node then select the "Provisioning" tab.

• Click on "Single Sign-On with SSO Connect Cloud

• Click "Edit Configuration"

• Click out the existing SAML Metadata

• Upload the new XML metadata file from your desktop

At this point, the SAML certificate should be updated with success.

(7) Confirm that SSO is functioning properly

Now that the metadata XML file with the latest certificate is uploaded to Keeper, your users should be able to login with SSO without error.

(8) Delete the metadata XML file from your local computer or store this in your Vault

(9) Make yourself a calendar reminder to update the SAML certificate next year prior to the expiration date.

Unable to Access the Keeper Admin Console?

If you are unable to login to the Keeper Admin Console due to the SSO certificate issue, please select one of the following options to regain access:

Option 1: Use a service account that logs into the Admin Console with a Master Password

Option 2: Contact a secondary admin to login and update the cert for you

If neither option is available, contact Keeper

Commander Method for Automated Approvals

Keeper Commander, our CLI and SDK platform is capable of performing Admin Device Approvals for automated approval without having to login to the Admin Console. Admin approvals can be configured on any computer that is able to run Keeper Commander (Mac, PC or Linux).

This method does not require inbound connections from the Keeper cloud, so it could be preferred for environments where ingress ports cannot be opened. This method uses a polling mechanism (outbound connections only).

Install Keeper Commander

Please see the Installation Instructions here: https://docs.keeper.io/secrets-manager/commander-cli/commander-installation-setup You can install the binary versions for Mac/PC/Linux or use pip3.

Use CLI for Device Approvals

Enter the Commander CLI using the "keeper shell" command. Or if you installed the Commander binary, just run it from your computer.

$ keeper shell
  _  __
 | |/ /___ ___ _ __  ___ _ _
 | ' </ -_) -_) '_ \/ -_) '_|
 |_|\_\___\___| .__/\___|_|
              |_|

 password manager & digital vault   

Use the "login" command to login as the Keeper Admin with the permission to approve devices. Commander supports SSO, Master Password and 2FA. For the purpose of automation, we recommend creating a dedicated Keeper Admin service account that is specifically used for device approvals. This ensures that any changes made to the user account (such as policy enforcements) don't break the Commander process.

My Vault> login [email protected]
Password: *******

Type "device-approve" to list all devices:

My Vault> device-approve
Email               Device ID           Device Name       Client Version
------------------  ------------------  ----------------  ----------------
[email protected]  f68de375aacdff3846  Web Vault Chrome  w15.0.4
[email protected]  41sffcb44187222bcc  Web Vault Chrome  w15.0.4

To manually approve a specific device, use this command:

My Vault> device-approve --approve <device ID>

To approve all devices that come from IPs that are recognized as successfully logged in for the user previously, use this command:

My Vault> device-approve --approve --trusted-ip

To approve all devices regardless of IP address, use this command:

My Vault> device-approve --approve

To deny a specific device request, use the "deny" command:

My Vault> device-approve --deny <device ID>

To deny all approvals, remove the Device ID parameter:

My Vault> device-approve --deny

To reload the latest device approvals without having to exit the shell, use the "reload" command:

My Vault> device-approve --reload

Automatically Approving Devices every X seconds

Commander supports an automation mode that will run approvals every X number of seconds. To set this up, modify the config.json file that is auto-created. This file is located in the OS User's folder under the .keeper folder. For example: C:\Users\Administrator\.keeper\config.json on Windows or /home/user/.keeper/config.json on Mac/Linux.

Leave the existing data in the file and add the following lines :

"commands":["enterprise-down","device-approve --approve"],
"timedelay":30

Now when you open Commander (or run "keeper shell"), Commander will run the commands every time period specified. Example:

$ keeper shell
Executing [enterprise-down]...
Password: 
Logging in...
Syncing...

Executing [enterprise-down]...

Email               Device ID           Device Name       Client Version
------------------  ------------------  ----------------  ----------------
[email protected]  f68de375aacdff3846  Web Vault Chrome  w15.0.4

Executing [device-approve --approve]...
2020/09/20 21:59:47 Waiting for 30 seconds
Executing [enterprise-down]...
There are no pending devices to approve
.
.
.

Automatically Approving Teams and Users

Similar to the example above, Commander can automatically approve Team and User assignments that are created from SCIM providers such as Azure, Okta and JumpCloud.

To set this up, simply add one more command team-approve to the JSON config file. For example:

{
    "user": "[email protected]",
    "commands": [
        "enterprise-down",
        "device-approve --approve",
        "team-approve"
    ],
    "timedelay": 60
}

Persistent Sessions

Keeper Commander supports "persistent login" sessions which can run without having to login with a Master Password or hard-code the Master Password into the configuration file.

Commands to enable persistent login on a device for 30 days (max):

My Vault> this-device register
My Vault> this-device persistent-login on
My Vault> this-device ip-auto-approve on
My Vault> this-device timeout 30d
My Vault> quit

Once persistent login is set up on a device, the config.json in the local folder will look something like this:

{
    "private_key": "8n0OqFi9o80xGh06bPzxTV1yLeKa5BdWc7f7CffZRQ",
    "device_token": "R2O5wkajo5UjVmbTmvWnwzf7DK1g_Yf-zZ3dWIbKPOng",
    "clone_code": "retObD9F0-WDABaUUGhP0Q",
    "user": "[email protected]",
    "server": "keepersecurity.com"
}

Additional information about persistent login sessions and various options is available at this link.

There are many ways to customize, automate and process automated commands with Keeper Commander. To explore the full capabilities see the Commander documentation.

Overview

The settings in this document control the features and security of the Automator service.

Setting: automator_debug

Env Variable: AUTOMATOR_DEBUG

Description: This is an easier way to turn on/off debug logging in Automator.

Setting: automator_config_key

Env Variable: AUTOMATOR_CONFIG_KEY

Default: Empty

Description: Base64-url-encoded 256-bit AES key. This is normally only used as an environment variable. (since v3.1.0). This setting is required to load the encrypted configuration from the Keeper cloud if there is no shared /usr/mybin/config file storage between container instances.

Setting: automator_host

Env Variable: AUTOMATOR_HOST

Default: localhost

Description: The hostname or IP address where the Automator service is listening locally. If SSL is enabled (ssl_mode parameter), the automator_host value needs to match the SSL certificate subject name. The setting disable_sni_check can be set to false if the subject name does not match.

If the service is running on a machine with multiple network IPs, this setting will bind the Automator service to the specified IP.

If you encounter binding errors in the service startup, it is recommended to use the local network IP address in the host setting instead of localhost.

Setting: automator_port

Env Variable: AUTOMATOR_PORT

Default: 8089

Description: The port where the Automator listens. If running in Docker, use the default 8089.

Setting: disable_sni_check

Env Variable: DISABLE_SNI_CHECK

Default: false

Description: Disable the SNI check against the certificate subject name, if SSL is being used.

Setting: email_domains

Env Variable: EMAIL_DOMAINS

Default: null

Description: A comma-separated list of user email domains for which Automator will approve devices or teams. Example: "example.com, test.com, mydomain.com". This depends on the filter_by_email_domains setting to be enabled as well.

Setting: filter_by_email_domains

Env Variable: FILTER_BY_EMAIL_DOMAINS

Description: If true, Keeper will consult the email_domains list. If false, the email_domains list will be ignored.

Setting: enabled

Env Variable: N/A

Default: false

Description: This determines if Automator is enabled or disabled.

Setting: enable_rate_limits

Env Variable: ENABLE_RATE_LIMITS

Default: false

Description: If true, Automator will rate limit incoming calls per the following schedule:

approve_device: 100 calls/minute with bursts to 200

approve_teams_for_user: 100 calls/minute with bursts to 200

full_reset: 4 per minute, with bursts to 6

health: 4 per minute

initialize: 4 per minute, with bursts to 6

setup: 4 per minute, with bursts to 6

status: 5 per minute

Setting: ip_allow and ip_deny

Env Variable: IP_ALLOW and IP_DENY

Default: ""

Description: This restriction allows users to be eligible for automatic approval. Users accepted by the IP restriction filter still need to be approved in the usual way by Automator. Users denied by the IP restriction filter will not be automatically approved.

If "ip_allow" is empty, all IP addresses are allowed except those listed in the "ip_deny" list. If used, devices at IP addresses outside the allowed range are not approved by Automator. The values are a comma-separated list of single IP addresses or IP ranges. The "ip_allow" list is checked first, then the "ip_deny" list is checked.

Example 1: ip_allow=

ip_deny=

Example 2:

ip_allow=10.10.1.1-10.10.1.255, 172.58.31.3, 175.200.1.10-175.200.1.20

ip_deny=10.10.1.25

Setting: name

Env Variable: N/A

Default: Automator-1

Description: The name of the Automator. It should be unique inside an Enterprise. An automator can be referenced by its name or by its ID.

Setting: persist_state

Env Variable: N/A

Default: true

Description: If true, the Automator state will be preserved across shutdowns. Leave this on.

Setting: skill

Env Variable: N/A

Default: device_approval

Description: “device_approval” means device approval. “team_for_user_approval” means team approvals. An Automator can have multiple skills. “device_approval” is the default.

Setting: ssl_certificate

Env Variable: SSL_CERTIFICATE

Default: null

Description: A Base64-encoded string containing the contents of the PFX file used for the SSL certificate. For example, on UNIX base64 -i my-certificate.pfx will produce the required value.

Using this environment variable will override the ssl_certificate_filename setting.

Setting: ssl_certificate_file_password

Env Variable: SSL_CERTIFICATE_PASSWORD

Default: ""

Description: The password on the SSL file. If used, the key password should be empty, or should be the same. The library we use does not allow different passwords.

Setting: ssl_certificate_key_password

Env Variable: SSL_CERTIFICATE_KEY_PASSWORD

Default: ""

Description: The password on the private key inside the SSL file. This should be empty or the same as the file password.

Setting: ssl_mode

Env Variable: SSL_MODE

Default: certificate

Description: The method of communication on the Automator service. This can be: certificate, self_signed, or none. If none, the Automator server will use HTTP instead of HTTPS. This may be acceptable when Automator is hosted under a load balancer that decrypts SSL traffic.

Setting: url

Env Variable: N/A

Default: ""

Description: The URL where the Automator can be contacted.

Centrify

Login to the Centrify Admin portal via the cloud login.

Switch to the Admin Portal from the pull down menu.

Close the Quick Start Wizard if it pops up. Select Apps from the menu then Add Web Apps.

On the Add Web Apps window, select the Custom tab and then scroll down and choose Add for SAML.

Select Yes to “Do you want to add this application?”.

Close the Add Web Apps Window.

The next step is to upload Keeper’s SSO Metadata to Centrify. On the Keeper Admin Console, export the SAML Metadata file

Go to View -> Export Metadata

In the SAML Application Settings section in Centrify, select Upload SP Metadata.

Select Upload SP Metadata from a file and browse for the KeeperSSOMetadata.xml file. Select Ok.

Download the Identity Provider SAML Metadata. This will be uploaded to Keeper SSO Connect.

On the Description section enter Keeper SSO Connect in the Application Name field and select Security in the Category field.

Download the Keeper logo. Select Select Logo and upload the Keeper logo (keeper60x60.png).

On the User Access section select the roles that can access the Keeper App:

Under the Account Mapping section, select "Use the following..." and input mail.

On the Advanced section, append the script to include the following lines of code:

setAttribute("Email", LoginUser.Get("mail"));
setAttribute("First", LoginUser.FirstName);
setAttribute("Last", LoginUser.LastName);
setSignatureType("Response");

• The above script reads the display name from the User Account section. The FirstName attribute is parsed from the first string of DisplayName and the LastName attribute is parsed from the second string of DisplayName.

Select Save to finish the setup.

Upload the Identity Provider SAML Metadata file into the Keeper SSO Connect Cloud instance interface by dragging and dropping the file into the edit screen:

When upload is complete, revert back one screen. The SSO integration is ready to test.

CloudGate SSO Configuration

(1) Log into the CloudGate Administrator console.

Click the Administration tile on the menu.

(2) Next, Select the Service Provider menu item and click Add Service Provider.

On the "Add Service Provider" page, search for Keeper in the search bar. Select and click the "Keeper SSO Connect Cloud" icon.

(3) Set the Display name at General Settings tab to “Keeper_SSO_Cloud_Connet” or whatever you prefer.

(4) Next, at the SSO Settings tab, you need the "Entity ID" and Other information that comes from the Keeper Admin Console.

Copy and Paste the Entity ID and Other information into the SSO Settings page in the CloudGate screen.

(5) Click Add the Additional Attributes, and set Field Name to "Email" and the Value to "${MAIL_ADDRESS}". Now you can save the configuration.

(Optional) Enable Single Logout

If you would like to enable the Single Logout feature in CloudGate, go to the SSO Settings tab and enter Logout URL and then upload the SP Cert which comes from the Keeper Admin Console.

To first download the SP Cert, view the SSO configuration on Keeper and click the Export SP Cert button.

Next, Copy and Paste the SLO Endpoint information into the SSO Settings page in the CloudGate screen.

(6) Last step is to export the metadata from "IDP Information for SMAL2.0" at SSO Settings tab to import it into the Keeper SSO Connect Cloud™.

Set the IDP Type to GENERIC and upload this file into the Keeper SSO Connect Cloud™ provisioning interface by dragging and dropping the file into the edit screen:

Assign Users

From CloudGate, you can now add users at User Settings tab on User Management page.

Please make sure if there is "Email address" value at at User Settings tab on User Management page.

Click "Save" to complete the configuration of Keeper SSO Connect Cloud with CloudGate.

CloudGate SCIM Provisioning

To enable CloudGate SCIM user and group provisioning please follow the instructions found in within the Keeper Enterprise Guides.

Move existing users/initial admin to SSO authentication

Users created in the root node (top level) will need to be migrated to the sub node that the SSO integration was configured on. If users remain in the root node, they will be prompted for the master password when accessing the vault and/or admin console.

After the user is moved to the SSO enabled node, they need to log into the Keeper vault initially by selecting the "Enterprise SSO" pull down and inputting in the Enterprise Domain configured on the SSO integration. The user may get prompted to confirm by entering in the master password.

Once the user has authenticated with SSO, they only need to use their email address moving forward to initiate SSO authentication.

They won't have to enter the Enterprise Domain. If typing in the email address and clicking Next does not route the user to the desired SSO, ensure that just-in-time provisioning is enabled in the Keeper SSO configuration and ensure that your email domain is reserved by Keeper. More information regarding routing and domain reservation can be found here.

Overview

User Provisioning provides several features for lifecycle management:

• New users added to Google Workspace will get an email invitation to set up their Keeper vault

• Users can be assigned to Keeper on a user or team basis

• When a user is de-provisioned, their Keeper account will be automatically locked

From the Keeper Admin Console, go to the Provisioning tab for the Google Workspace node and click "Add Method".

Select SCIM and click Next.

Click on "Create Provisioning Token"

The URL and Token displayed on the next screen will be provided to Google in the Google Workspace Admin Console. Save the URL and Token in a file somewhere temporarily and then click Save.

Back on the Google Workspace admin console, go to Home > Apps > SAML Apps and click on the "Provisioning Available" text of the Keeper app you set up.

Select Configure auto-provisioning towards the bottom of the page.

STEP 1: App authorization

Paste the Access Token previously saved when you created your SCIM Provisioning Method in the Keeper Admin Console and select CONTINUE.

STEP 2: Endpoint URL

Paste the Endpoint URL previously saved when you created your SCIM Provisioning Method in the Keeper Admin Console and select CONTINUE.

STEP 3: Default Attribute Mappings

Leave the default Attribute mappings as they are and click CONTINUE.

STEP 4: Provisioning Scope

If you will be provisioning all users assigned to the Keeper SSO Connect app, you can simply select CONTINUE.

STEP 5: Deprovisioning

At the Deprovisioning Screen, you can simply select FINISH to automate the deprovisioning of your users.

Activate Auto-provisioning

Once Auto-provisioning setup is finished, you will be taken back to the details screen of the Keeper App. You will find the Auto-Provisioning is inactive. Toggle this to Active

Once toggled, a Pop-Out window will appear Confirming that you are ready to turn on Auto-Provisioning. Select TURN ON.

You will be taken back to the details screen of the Keeper App. You now see Auto-Provisioning is Active.

Auto-provisioning is complete. Moving forward, new users who have been configured to use Keeper, in Google Workspace and are within the provisioning scope definitions, will receive invites to utilize the Keeper Vault and be under the control of Google Workspace.

User Provisioning / SCIM without SSO

If you would like to provision users to Keeper via Google Workspace SCIM provisioning, but you do NOT want to authenticate users via SSO, please follow the below instructions:

1. Following the same steps, as above to setup SSO, during the Service Provider Details Screen, you will replace the ACS URL and the Entity ID with the values that point to a domain in your control but is a "NULL" value in which has no communicable source. Ex: Entity ID= ACS URL=

2. Once Keeper application is set up in Google Workspace, turn on the automated provisioning method as described, above, in this document.

Troubleshooting

If you receive the error "not_a_saml_app" please ensure that you have turned "Auto-provisioning" to "ON" in the SAML application.

Google Certificate Updates

Google's IdP x.509 certificates for signing SAML assertions are set to expire after 5 years. In the Google Workspace "Manage Certificates" section, you should make note of the expiration and ensure to set a calendar alert in the future to prevent an outage.

When the certificate is expiring soon, or if the certificate has expired, you can follow the instructions below.

1. Login to Google Workspace Admin Console:

2. Click on Apps then select Web and Mobile Apps.

3. Select Keeper app

4. Expand service provider

5. Click “Manage Certificates”

6. Click “ADD CERTIFICATE”

7. Click “DOWNLOAD METADATA”

8. Save the metadata file. This is the IdP metadata.

9. Login to the Keeper Admin Console

10. Navigate to Admin > SSO Node > Provisioning > Edit SSO Cloud provisioning method

11. Upload the Google IdP metadata into Keeper

For more information on this topic, see Google's support page:

Move existing users/initial admin to SSO authentication

Users created in the root node (top level) will need to be migrated to the sub node that the SSO integration was configured on. If users remain in the root node, they will be prompted for the master password when accessing the vault and/or admin console.

After the user is moved to the SSO enabled node, they need to log into the Keeper vault initially by selecting the "Enterprise SSO" pull down and inputting in the Enterprise Domain configured on the SSO integration. The user may get prompted to confirm by entering in the master password.

Once the user has authenticated with SSO, they only need to use their email address moving forward to initiate SSO authentication.

If typing in the email address and clicking Next does not route the user to the desired SSO, ensure that just-in-time provisioning is enabled in the Keeper SSO configuration and ensure that your email domain is reserved by Keeper. More information regarding routing and domain reservation .

Step 1: Configure Imprivata

You'll need to provide some information about Keeper SSO Connect Cloud to your Identity Provider application such as:

• Entity ID

• IDP Initiated Login

• Assertion Consumer Service (ACS) Endpoint

• Single Logout Service (SLO) Endpoint

• SP Metadata file or the Keeper SP Certificate file.

To obtain this information, locate your SSO Connect Cloud Provisioning method within the Keeper Admin Console, and select View. From there you have access to download the Keeper metadata file, service provider (SP) certificate file as well as the direct URLs and configuration information (if your identity provider application does not support uploading of the metadata file).

Refer to your identity provider application configuration guide for instructions on how to upload service provider metadata and or manually inputting the required SAML response configuration fields.

Step 2: Obtain your IdP Metadata

To import your IdP Metadata into Keeper, you will need to have a properly formatted metadata file. If your SSO Identity Provider Application has the ability to export its metadata file, this would be the most expedient and preferred method to import your metadata into your Keeper SSO Connect Cloud Provisioning method.

If you do not have the ability to export / download your metadata file from your identity provider, please create a properly formatted metadata file. Refer to your SSO application's configuration guide for instructions.

Below is an example / template of what a simple identity provider metadata.xml file, against Keeper SSO Connect Cloud should look like. If you need to use this example / template to get you started, please Copy, Paste, Modify and add any other fields, in accordance to your IdP information, in your preferred .xml or .txt editor.

Step 3: Map User Attributes

Keeper requires that you map specific User Attributes to be sent during authentication. Default Keeper SSO Connect Cloud User Attributes are Email, First and Last, as outlined in the table below. Ensure your identity provider's User Attributes are lined up with Keeper's attributes. Refer to your Identity Provider's configuration guide for instructions.

Step 4: Upload IdP Metadata to Keeper

Once you have completed creating your identity provider metadata file, or if you have downloaded the identity provider metadata file, head back to the Keeper Admin console, locate your SSO Connect Cloud Provisioning method and select Edit.

Scroll down to the Identity Provider section, set IDP Type to GENERIC, select Browse Files and select the Metadata file you created.

Still within the Keeper Admin Console, exit the Edit View and select View on your SSO Connect Cloud Provisioning method. Within the Identity Provider section you will find the metadata values for the Entity ID, Single Sign On Service and Single Logout Service Endpoint that are now populated.

Graphic Assets

If your identity provider requires an icon or logo file for the application, please see the .

If you find that your application is not functional, please review your identity provider application settings and review your metadata file and user attributes for any errors.

Once complete, repeat Step 4.

If you need assistance, please email [email protected].

Move existing users/initial admin to SSO authentication

Users created in the root node (top level) will need to be migrated to the sub node that the SSO integration was configured on. If users remain in the root node, they will be prompted for the master password when accessing the vault and/or admin console.

After the user is moved to the SSO enabled node, they need to log into the Keeper vault initially by selecting the "Enterprise SSO" pull down and inputting in the Enterprise Domain configured on the SSO integration. The user may get prompted to confirm by entering in the master password.

Once the user has authenticated with SSO, they only need to use their email address moving forward to initiate SSO authentication.

They won't have to enter the Enterprise Domain. If typing in the email address and clicking Next does not route the user to the desired SSO, ensure that just-in-time provisioning is enabled in the Keeper SSO configuration and ensure that your email domain is reserved by Keeper. More information regarding routing and domain reservation .

Configure Keeper for Traitware Integration

Visit the and login as the Keeper Administrator. (US / Global) (EU-hosted customers) (AU-hosted customers) (GovCloud customers)

Click on the Admin tab and click Add Node.

From the Provisioning tab, click Add Method

Select Single Sign-On with SSO Connect™ Cloud and click Next

Enter your Configuration Name and Enterprise Domain, then click Save. Take note of the Enterprise Domain. This will be used later for Enterprise SSO login.

The newly-created SAML 2.0 with Cloud SSO Connect provisioning method will be visible. Select View from the menu.

Configure TraitWare

Log into the TraitWare Admin Console (TCC)

Generate Application Key

Select the Signing Keys from the left menu. Click Generate new Key Pair button. Enter the application name for the key pair. Select desired Lifetime in Years, Product Key Type and Product Key Size. Click Generate Key.

Create Traitware Application

1. Select Applications from the left menu and click Add Application.

2. Select SAML 2.0.

3. Click Use a Template and select Keeper

4. Insert your Keeper Entity ID and Assertion Consumer Service (ACS) Endpoint noted previously in the walkthrough and click Submit.

Configure SAML 2.0 Integration

1. From the Traitware Admin Console Applications tab, select Keeper

2. Select the Provider Credentials tab and click the download icon for Traitware IdP SAML Metadata (XML)

3. Click Save Application

4. Return to the Keeper Admin Console

5. Edit the SAML 2.0 with Cloud SSO Connect™ provisioning method

6. Upload the file from step 2 to the SAML Metadata field

Create and Enable Users to Login to Keeper Vault through Traitware

1. From the Traitware Admin Console Users tab, select Create User

2. Complete the form and click Save Changes

3. Click on the newly created user and select the Applications tab

4. Toggle Application Access on for Keeper

Enable All Traitware Users to Login to Keeper Vault through Traitware

1. From the Traitware Admin Console Applications tab, select Keeper

2. Click Enable All User Access

3. Confirm the action and click Enable Access

End User Login

Users may login either using their enterprise domain or email address.

Login Using Email Address

1. Navigate to the Keeper Vault

2. Enter your email address and click Next

3. From your Traitware app on your smart device, scan the QR code on your desktop browser

4. You will now be logged in to your Keeper vault

Login Using Enterprise Domain

1. Navigate to the Keeper Vault

2. Click the Enterprise SSO Login dropdown and select Enterprise Domain

3. Enter the Enterprise Domain name you specified in the Keeper portion of this walkthrough and click Connect

4. From your Traitware app on your smart device, scan the QR code dispalyed on your desktop browser

5. You will now be logged in to your Keeper vault

Overview

Keeper Automator encrypts the communication between the Keeper backend and the Automator service running in the customer's environment.

If a custom certificate is not used, Keeper Automator will generate a self-signed certificate by default.

You can obtain a quick, easy, and free SSL certificate at . Or if you prefer to have more control over each step of the process, you can proceed with the following instructions.

Generate and Prepare the SSL Certificate

Keeper Automator requires a valid signed SSL certificate that has been signed by a public certificate authority. The process of generating an SSL certificate varies depending on the provider, but the general flow is documented here.

Follow these steps to create the two certificate files needed for automator to run, which must be named ssl-certificate.pfx and ssl-certificate-password.txt

(1) Using the openssl command prompt, generate a private key

(2) Generate a CSR, making sure to use the hostname which you plan to use for Automator. In this case, we will be using automator.lurey.com. The important item here is that the Common Name matches exactly to the domain.

(3) Purchase an SSL certificate (or grab a free 90 day cert) and Submit the CSR to your SSL certificate provider.

If you don't have a provider already, you can use is: . The least expensive SSL cert for one domain is fine.

Choose a URL and create a certificate for a domain that is specific for Automator, e.g. automator.company.com.

The SSL certificate provider will deliver you a zip file that contains a signed certificate (.crt file) and intermediate CA cert. The bundle may be in either .crt or .ca-bundle file extension type. Unzip this file into the same location as your .key file that you created earlier.

(4) After the certificate has been issued, it needs to be converted using OpenSSL to .pfx format including the full certificate chain (root, intermediate and CA cert).

Set your export password when prompted. Then create a new text file called ssl-certificate-password.txt and put the export password into that file and save it.

• automator.key is the private key generated in step 1.

• automator.yourcompany.com.crt is the signed certificate delivered in step 3.

• automator.yourcompany.com.ca-bundle is the CA bundle

• ssl-certificate.pfx is the output file used by Automator that has been encrypted with a password.

• ssl-certificate-password.txt contains the password used to encrypt the .pfx file.

We recommend to save all 5 files in your Keeper vault.

(5) Save ssl-certificate.pfx and ssl-certificate-password.txt for the deployment steps later in this guide.

Please also ensure that you have backed up the files in your Keeper vault so that you can refer to these later when updating the service or re-keying the certificate.

(6) Review the annual certificate update process .

Using Windows

Generate and Prepare the SSL Certificate

Keeper Automator requires a valid signed SSL certificate that has been signed by a public certificate authority. We do not support self-signed certificates. The process of generating an SSL certificate varies depending on the provider, but the general flow is documented here.

Download and install OpenSSL. For convenience, a 3rd party (slproweb.com) has created a binary installer. A popular binary installer is linked below:

Install the version at the bottom labeled "Win32 OpenSSL vX.X.X Light"

During install, the default options can be selected. In the install process, you may be asked to also install a Microsoft Visual Studio extension. Go ahead and follow the instructions to install this extension before completing the OpenSSL setup.

Run the OpenSSL Command Prompt

In your Start Menu there will be an OpenSSL folder. Click on the Win32 OpenSSL Command Prompt.

Annual Renewal Process

On an annual basis, you will need to renew your SSL certificate. Most certificate providers will generate a new cert for you. After certificate renewal, replace the .pfx certificate file in your Automator instance and then restart the service. Refer to the specific automator install method documentation on the exact process for updating the file and restarting the service.

For environments using AD FS ...

If you are using Keeper Automator with AD FS as the identity provider, users will not be able to login until you update the Keeper certificate using the instructions below:

• Login to the Keeper Admin Console

• Go to Admin > SSO Node > Provisioning and then view the SSO Cloud configuration.

• Click on "Export SP Cert".

• In the AD FS Management Console select the Keeper Cloud SSO Relying Party Trust properties.

• On the "Encryption" tab, replace the old certificate with this new cert.

• On the "Signature" tab, Add/Replace the new SP certificate with this new cert.

If you are experiencing login issues after the certificate update

After certificate renewal, sometimes it is necessary to publish a new SP certificate in your identity provider following the below steps:

• Login to the Keeper Admin Console

• Go to Admin > SSO Node > Provisioning and then view the SSO Cloud configuration.

• Click on "Export SP Cert" and save the certificate file.

• Click on "Export Metadata" and save the metadata file, which also contains the certificate.

• Login to your Identity Provider portal and view the SSO configuration for Keeper.

• Upload Keeper's SP certificate file (or metadata, if required) following their instructions to update the Service Provider certificate and Save.

The reason for this, is because the Automator service essentially becomes the service provider. The SSL certificate generated by the customer is used in the signing process.

Azure and AWS Deployments

If you are updating the SSL certificate in an environment that utilizes application gateways or a load balancer with a custom domain that terminates SSL, you need to also update the certificate on that device.

• For Azure deployments using an App Gateway, the .pfx certificate must also be updated in the https listener for the gateway. Go to your Azure > Resource groups > App Gateway > Listeners and upload the new certificate.

Configure Keeper for Trusona Integration

Visit the and login as the Keeper Administrator.

(US / Global) (EU-hosted customers) (AU-hosted customers) (GovCloud customers)

1) Click on the Admin tab and click Add Node

2) Name the node and click Add Node

3) From the Provisioning tab, click Add Method

4) Select Single Sign-On with SSO Connect™ Cloud and click Next

5) Enter your Configuration Name and Enterprise Domain, then click Save. Take note of the Enterprise Domain. This will be used later for Enterprise SSO login.

6) The newly-created SAML 2.0 with Cloud SSO Connect provisioning method will be visible. Select View from the menu.

7) Note the Entity ID, Assertion Consumer Service (ACS) Endpoint and Single Logout Service Endpoint

8) Click Export SP Cert

Configure Trusona

1) Log into the Trusona Dashboard at scanning the QR code from your mobile device using the Trusona app for or .

Create Keeper Integration in Trusona

2) From your Trusona account dashboard, select Keeper from the left-hand navigation.

3) Click Create Keeper Integration.

4) Name the integration and click Save.

5) Click Download XML to download the XML metadata for use in the Keeper Admin Console.

6) Select Keeper on the left-hand navigation.

7) Click Edit from the Actions dropdown menu for your integration.

8) Paste the following information noted earlier in the documentation when creating the integration in the Keeper Admin Console in the corresponding field:

• Assertion Consumer Service (ACS) Endpoint

• IDP Initiated Login Endpoint

• Single Logout Service (SLO) Endpoint

9) Under Certificate, upload the SP Cert exported from the Keeper Admin Console and Click Save.

10) Return to the Keeper Admin Console

11) Optionally enable Just-In-Time Provisioning to allow users to create accounts in the node by typing in the Enterprise Domain name when signing up.

12) Under SAML Metadata, upload the metadata.xml file downloaded from the Trusona dashboard.

13) Under Identity Provider Attribute Mappings, enter the following:

• First Name: given_name

• Last Name: name

• Email: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress

User Provisioning

Instructions on how to provision users with SSO Connect Cloud can be found .

End User Login

Users may login either using their enterprise domain or email address.

Login Using Email Address

1. Navigate to the Keeper Vault

2. Enter your email address and click Next

3. From your Trusona app on your smart device, scan the QR code on your desktop browser

4. You will now be logged in to your Keeper vault

Login Using Enterprise Domain

1. Navigate to the Keeper Vault

2. Click the Enterprise SSO Login dropdown and select Enterprise Domain

3. Enter the Enterprise Domain name you specified in the Keeper portion of this walkthrough and click Connect

4. From your Trusona app on your smart device, scan the QR code displayed on your desktop browser

5. You will now be logged in to your Keeper vault

AWS SSO

Log into AWS and select on AWS Single Sign-On.

On the SSO Dashboard, select Configure SSO access to your cloud applications.

On the Applications menu, select Add a new application.

Next select Keeper Security and select Add.**

Fill in the Display name and Description (optional) in the application details section.

In the AWS SSO metadata section, select the download button to export the AWS SSO SAML metadata file. This file gets imported in the SSO Connect IdP Metadata section on the configuration screen.

Copy this file to the Keeper SSO Connect server and upload it into the Keeper SSO Connect interface by either browsing to or dragging and dropping the file into the Configuration screen's SAML Metadata area:

Next download the Keeper metadata file and upload it to the AWS Application metadata file. Navigate to the view screen of the Keeper SSO Connect Cloud™ provisioning.

Click the "Export Metadata" button to download the config.xml file.

Back on the Ping Identity application configuration, select the Select File button and choose the config.xml file downloaded in the above step.

After saving changes the Configuration for Keeper Password Manager has been saved success message will be displayed.

• Either, generate a smaller SSL certificate, re-export and import the metadata file or manually set the ACS URL and Audience URL in the AWS SSO application configuration.

Next, Ensure the Keeper application attributes that are to be mapped to AWS SSO are correct (These should be set by default. Select the Attribute mappings tab. The AWS string value to ${user:subject} and format is blank or unspecified. The Keeper Attributes are set as follows:

To make this change navigate to the Connect Directory on the AWS SSO page.

Select on the Edit attribute mappings button.

Change the AWS SSO email attribute from ${dir:windowsUpn} to ${dir:email} .

Select on the the Assigned users tab and then the Assign users button to select users or groups to assign the application.

On the Assign Users window:

• Select either Groups or Users

• Type the name of a group or user

• Select on the Search connect directory to initiate the search.

The results of the directory search will display under the search window.

Select the users/groups that are desired to have access to the application and then select the Assign users button.

Note: Keeper SSO Connect expects that the SAML response is signed. Ensure that your identity provider is configured to sign SAML responses.

Your Keeper SSO Connect setup is now complete!

Move existing users/initial admin to SSO authentication

Users created in the root node (top level) will need to be migrated to the sub node that the SSO integration was configured on. If users remain in the root node, they will be prompted for the master password when accessing the vault and/or admin console.

After the user is moved to the SSO enabled node, they need to log into the Keeper vault initially by selecting the "Enterprise SSO" pull down and inputting in the Enterprise Domain configured on the SSO integration. The user may get prompted to confirm by entering in the master password.

Once the user has authenticated with SSO, they only need to use their email address moving forward to initiate SSO authentication.

They won't have to enter the Enterprise Domain. If typing in the email address and clicking Next does not route the user to the desired SSO, ensure that just-in-time provisioning is enabled in the Keeper SSO configuration and ensure that your email domain is reserved by Keeper. More information regarding routing and domain reservation can be found here.

Google Workspace supports the following integration with Keeper:

• SSO authentication with SAML 2.0

• Automatic Provisioning with Google Cloud APIs and SCIM (Users and Groups)

• Automatic Provisioning with SCIM (Users only)

You can configure with SSO, SSO+Provisioning or Provisioning by itself.

Google Workspace SAML Configuration

To access Google Workspace Admin Console, login to https://admin.google.com/

Visit the Apps > Web and Mobile Apps screen.

Then select "Add App" and select "Search for apps".

In the "Enter app name" search area, search for "Keeper" and select the "Keeper Web (SAML)" app.

Setup Keeper App

Use Option 1 to Download IdP metadata and then select Continue.

Service Provider Details

On the Service Provider Details screen, there are a few fields to fill out. You will replace the ACS URL and the Entity ID with the values that you'll be using from your SSO Connect Cloud instance.

To obtain the ACS URL and Entity ID, locate your SSO Connect Cloud Provisioning method, within the Keeper Admin Console, and select View.

Within the Service Provider section you will find the values for the ACS URL and Entity ID.

Copy and Paste the ACS URL, Entity ID into the Service Provider Details and select "Signed Response" and select CONTINUE.

Attribute Mapping

In the Attributes screen, ensure that there are 3 mappings exactly as they appear below. Set the mappings field to "First Name", "Last Name" and "Primary Email", as displayed below, and select Finish. You have completed your Google Workspace SAML integration into Keeper.

Keeper SAML App Details

Once complete, you will be taken to Keeper SAML App Details Page in which provides you a quick detail overview of the SAML connection and service. Click within the area where it states OFF for everyone to enable SSO for your users.

Enable SSO Connect on Everyone

To enable Keeper SSO Connect, for your users, select ON for everyone and select SAVE.

Enable SSO Connect on Groups

To enable Keeper SSO Connect on specific groups, select Groups to the left of the Service status, search and select the Group in which you want associated to the Keeper SSO Connect App, select / tick "ON" the select SAVE.

Import Google Workspace Metadata

Back on the Keeper Admin console, locate your SSO Connect Cloud Provisioning method and select Edit.

Select Browse Files and select the Google Metadata file previously downloaded.

You will know this was successful when your metadata file reflects within your provisioning method. You may now exit the provisioning configuration.

Note about Single Logout (SLO) Settings with Google Workspace

SSO Setup Complete!

Your Keeper SSO Connect setup with Google Workspace is now complete! Users can now login into Keeper using their Google account by following the below steps:

1. Open the Keeper vault and click on "Enterprise SSO Login".

2. Type in the Enterprise Domain that was provided to the Keeper Admin Console when setting up SSO. On the SSO Connect status screen it is called "SSO Connect Domain".

3. Click "Connect" and login with your Google Workspace credentials.

For the end-user experience (Keeper-initiated Login Flow) see the guide below: https://docs.keeper.io/user-guides/enterprise-end-user-setup-sso#keeper-initiated-login-flow

End-user Video Tour for SSO Users is here: https://vimeo.com/329680541

User and Team Provisioning

Next, we'll show how to configure User and Team Provisioning from Google Workspace. There are two methods of integrating with Google Workspace.

Option 1 (Recommended): Provisioning Users and Groups

Since Google Workspace doesn't natively support SCIM Groups, Keeper has developed a Google Cloud Function that integrates with Google Workspace for automated user and group provisioning. Step by step instructions for setting up this service is documented below:

Google Workspace User and Team Provisioning with Cloud Service

Option 2: Provisioning Users Only

To provision users directly from Google Workspace to Keeper using a direct SCIM integration, follow the guide below (this only provisions users, not groups):

Google Workspace User Provisioning with SCIM

Step 1: Export and Save Keeper Metadata File

To obtain your Keeper Metadata file, locate your SSO Connect Cloud Provisioning method within the Keeper Admin Console, and select View. From there you have access to download and save the Keeper metadata file.

Step 2: Adding Keeper Metadata to Shibboleth Identity Provider

The Shibboleth IdP must know some basic information about the Keeper relying party, which is defined in SAML metadata. The easiest way to do is to add your Keeper Metadata file to IDP_HOME/metadata/ directory.

Step 3: Adding a New Relying Party Trust to Shibboleth Identity Provider

Instruct Shibboleth how to behave when talking to Keeper by defining a new RelyingParty element in IDP_HOME/conf/relying-party.xml. The following snippet should be added just after the DefaultRelyingParty element. Be sure to replace the provider attribute to include your "Entity ID" (use whatever provider is configured in the DefaultRelyingParty).

<RelyingParty id="keepersecurity.com"
        provider="https://keepersecurity.com/api/rest/sso/saml/264325172298110"
        defaultSigningCredentialRef="IdPCredential">
    <ProfileConfiguration xsi:type="saml:SAML2SSOProfile" encryptAssertions="never" encryptNameIds="never" />
</RelyingParty>

Still in the IDP_HOME/conf/relying-party.xml file, configure Shibboleth to use the keeper metadata file you added in Step 2. Add the following MetadataProvider element next to the existing configured provider (it should have an id value of “FSMD”), making sure to replace IDP_HOME with your actual installation path.

<!-- Keeper Metadata -->
<MetadataProvider id="KeeperMD" xsi:type="FilesystemMetadataProvider" xmlns="urn:mace:shibboleth:2.0:metadata"
    metadataFile="IDP_HOME/metadata/keeper-metadata.xml" maintainExpiredMetadata="true" />

Step 4: Configure Attribute Resolver

Keeper requires that you map specific User Attributes to be sent during authentication. Default Keeper SSO Connect Cloud User Attributes are Email, First and Last, as outlined in the table below. Shibboleth’s attribute resolver must be configured to make this data available by modifying IDP_HOME/conf/attribute-resolver.xml.

Step 5: Configure Attribute FIlter

Finally, configure the Shibboleth attribute filtering engine to release the principal attribute (encoded as a NameID) to Google. Add the following XML snippet to IDP_HOME/conf/attribute-filter.xml alongside the existing policy elements.

<AttributeFilterPolicy>
    <PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="keepersecurity.com" />

    <AttributeRule attributeID="principal">
        <PermitValueRule xsi:type="basic:ANY" />
    </AttributeRule>
</AttributeFilterPolicy>

Step 6: Obtain the Metadata XML File from Shibboleth

1. Locate Shibboleth metadata found at "http://shibboleth.example.com/idp/shibboleth" or in the Shibboleth identity provider filesystem in <install_folder>/shibboleth-idp/metadata.

2. Modify Shibboleth metadata manually and ensure all user endpoints are uncommented (e.g., SingleLogout).

3. Save the XML file.

Step 7: Upload IdP Metadata to Keeper

Once you have your Shibboleth metadata file ready, head back to the Keeper Admin console, locate your SSO Connect Cloud Provisioning method and select Edit.

Scroll down to the Identity Provider section, set IDP Type to GENERIC, select Browse Files and select your Shibboleth Metadata file.

Still within the Keeper Admin Console, exit the Edit View and select View on your SSO Connect Cloud Provisioning method. Within the Identity Provider section you will find the metadata values for the Entity ID, Single Sign On Service and Single Logout Service Endpoint that are now populated.

Graphic Assets

If your Shibboleth instance requires an icon or logo file for the Keeper application, please see the Graphic Assets page.

If you find that SSO is not functional, please review your Shibboleth settings, review your metadata file and user attributes for any errors.

Once complete, repeat Step 4.

If you need assistance, please email [email protected].

Move existing users/initial admin to SSO authentication

Users created in the root node (top level) will need to be migrated to the sub node that the SSO integration was configured on. If users remain in the root node, they will be prompted for the master password when accessing the vault and/or admin console.

After the user is moved to the SSO enabled node, they need to log into the Keeper vault initially by selecting the "Enterprise SSO" pull down and inputting in the Enterprise Domain configured on the SSO integration. The user may get prompted to confirm by entering in the master password.

Once the user has authenticated with SSO, they only need to use their email address moving forward to initiate SSO authentication.

They won't have to enter the Enterprise Domain. If typing in the email address and clicking Next does not route the user to the desired SSO, ensure that just-in-time provisioning is enabled in the Keeper SSO configuration and ensure that your email domain is reserved by Keeper. More information regarding routing and domain reservation can be found here.

Docker on Linux

This guide provides step-by-step instructions to publish Keeper Automator on any Linux instance that can run Docker.

Setup

(1) Install Docker

If you don't have Docker installed, set it up per the instructions on your platform. For example, if you use the yum package installer:

sudo yum install docker

Start the Docker service if it's not running

sudo service docker start

Then configure the service to start automatically

sudo systemctl enable docker.service

To allow non-root users to run Docker (and if this meets your security requirements), run this command:

sudo chmod 666 /var/run/docker.sock

(2) Pull the Automator image

Use the docker pull command to get the latest Keeper Automator image.

docker pull keeper/automator

(3) Start the service

Use the command below to start the service. This example below is listening to port 443.

docker run -d -p443:443/tcp \
  --name "Keeper-Automator" \
 --restart on-failure:3 \
 keeper/automator

(4) Update the certificate

Inside the docker container, create a "config" folder.

docker exec -it Keeper-Automator mkdir /usr/mybin/config

Copy the ssl-certificate.pfx file created in the Certificate Guide into the container.

docker cp ssl-certificate.pfx \
  Keeper-Automator:/usr/mybin/config/ssl-certificate.pfx

If your .pfx file is protected by a passphrase, you also need to create a file called ssl-certificate-password.txt

echo "my_pfx_password..." > ssl-certificate-password.txt

...and place it into the docker container:

docker cp ssl-certificate-password.txt \
 Keeper-Automator:/usr/mybin/config/ssl-certificate-password.txt

Make sure that the ssl_mode parameter in the keeper.properties file within the container is set to certificate.

docker exec -it Keeper-Automator sed -i 's/^ssl_mode=.*/ssl_mode=certificate/' settings/keeper.properties

(5) Restart the container with the SSL cert

Now that the certificate is installed, restart the Docker container:

docker restart "Keeper-Automator"

(6) Install Keeper Commander

At this point, the service is running but it is not able to communicate with Keeper yet.

On your workstation, server or any computer, install the Keeper Commander CLI. The installation instructions including binary installers are here: Installing Keeper Commander After Commander is installed, you can type keeper shell to open the session, then login using the login command. In order to set up Automator, you must login as a Keeper Administrator, or an Admin with the ability to manage the SSO node.

$ keeper shell

My Vault> login [email protected]
.
.
My Vault>

(7) Initialize with Commander

Login to Keeper Commander and activate the Automator using a series of commands, starting with automator create

automator create --name="My Automator" --node="Azure Cloud"

The Node Name (in this case "Azure Cloud") comes from the Admin Console UI as seen below.

The output of the command will display the Automator settings, including metadata from the identity provider.

                    Automator ID: 1477468749950
                            Name: My Automator
                             URL: 
                         Enabled: No
                     Initialized: No
                          Skills: Device Approval

Note that the "URL" is not populated yet. This is the public URL which the Keeper backend will communicate with. For example, automator.mycompany.com.

Run the "automator edit" command as displayed below, which sets the URL and also sets up the skills (team, team_for_user and device).

automator edit --url https://<application URL> --skill=team --skill=team_for_user --skill=device "My Automator"

Next we exchange keys: The enterprise private key encrypted with the Automator public key is provided to Automator:

automator setup "My Automator"

Initialize the Automator with the new configuration

automator init "My Automator"

Enable the service

automator enable "My Automator"

At this point, the configuration is complete.

For automated health checks, you can use the below URL:

https://<server>/health

Example:

$ curl https://automator.lurey.com/health
OK

For environments using AD FS ...

When activating Keeper Automator with AD FS as the identity provider, users will not be able to login until you update the Keeper certificate using the instructions below:

• Login to the Keeper Admin Console

• Go to Admin > SSO Node > Provisioning and then view the SSO Cloud configuration.

• Click on "Export SP Cert".

• In the AD FS Management Console select the Keeper Cloud SSO Relying Party Trust properties.

• On the "Encryption" tab, replace the old certificate with this new cert.

• On the "Signature" tab, Add/Replace the new SP certificate with this new cert.

Securing the Service

We recommend restricting network access to the service. Please see the Ingress Requirements page for a list of IP addresses to allow.

Testing the User Experience

Now that Keeper Automator is deployed, you can test the end-user experience. No prompts for approval will be required after the user authenticates with the SSO identity provider.

The easiest way to test is to open an incognito mode window to the Keeper Web Vault and login with SSO Cloud. You will not be prompted for device approval.

Service Restart

When you stop/start the Keeper Automator service, the Docker service will automatically retain state.

docker restart "Keeper-Automator"