Nodes and Organizational Structure
Keeper's Node Architecture scales to any sized organization
Nodes and Organizational Structure
Keeper's "node" architecture provides customers with a way to organize users into distinct groupings, similar to organizational units in Active Directory. The administrator can create nodes based on location, department, division or any other structure. A node is typically associated with different provisioning methods and identity providers.
By default, the top-level node, or Root Node is set to the organization name, and all Nodes can be created underneath the Root Node.
Smaller organizations might choose to administer keeper as single level. In this scenario, all provisioned users, roles, and teams are accessed from the default Root Node. Larger organizations benefit from organizing locations or departments into multiple nodes. Users can then be provisioned under their respective node and have roles configured to match the specific needs of the business. One of the advantages in defining multiple nodes is to help support the concept of delegated administration. A delegated administrator can be granted some or all of the Administrative permissions but only on their respective node (or sub nodes) to help reduce the administration load on the primary Keeper Administrators.

Nodes and SSO

When rolling out Keeper alongside an SSO identity provider, we require that those users are located within a node. This way, you can have any number of nodes associated with one ore more SSO identity providers.

Nodes and Active Directory

When the Keeper Bridge is installed for Active Directory synchronization, AD Organizational Units are identified as Nodes. Users and security groups, within specific organizational units in Active Directory, will be placed in the corresponding Node within the Keeper Admin Console.
Watch the video below to learn about nodes and organizational structure.
Nodes and Organizational Structure

Creating Nodes

To manually create Nodes and Sub Nodes, select the + button. The Add Node window will appear. Enter the name of the Node and select the node where you want the new node to be added in the tree structure.
Adding a Node
At any time, you can change which node you are viewing by navigating to or selecting the nodes on the far left Node pane. To navigate to the root-node or top level, select the business name (e.g. The Company) in the navigation tree or in the breadcrumb along the top.
Navigating Nodes

Team and User Sharing Visibility

When users are in the vault and sharing records, Teams and Users are visible in the auto-suggest field by all users regardless of what node the team or user resides in.
Sharing Autosuggest

Node Isolation

If the desire is to restrict visibility and control whether or not the usernames and teams associated with other parallel (a.k.a. "sibling") nodes will be hidden in the auto-suggestion dropdown menu when setting up sharing of folders, "node isolation" will need to be enabled. With node isolation enabled, "children" of a node can see each others's associated users/teams as well of those above it (parent nodes).
When a node is isolated, users and teams in the parent node will be visible. Node isolation only limits visibility between parallel nodes.

Activating node isolation

Turning on node isolation can be accomplished using the Keeper Commander CLI, or by opening a support ticket with Keeper support.
To find a list of nodes and node IDs, use the enterprise-info command:
enterprise-info --nodes
To enable node isolation for a specific node, use the enterprise-node command:
enterprise-node --toggle-isolated <NODE_ID>
After node isolation is enabled, a visual indicator will show in the console:
Isolated Node indicator

Managed Service Providers

If you are a Managed Service Provider (MSP) and you are considering the use of Nodes for different customers, we recommend you instead use the Keeper MSP product which provides a specialized set of features for deploying Managed Companies. The Keeper MSP user guide can be found here: Keeper MSP Guide

Nodes & Administrative Permissions

Within a Node, the "Role" is defined that can enable administrative permissions.
If nodes are enabled either via Active Directory integration or configured manually from the Admin Console, the placement of the Role within the Node Tree is important with regards to where the administration permissions begin. Placement of the role at the top level will allow the Admin permissions to flow down to any of the sub-nodes if the Cascade Node Permissions attribute is checked within the "Administrative Permissions" setting of the role. If the role is placed in a sub-node with the Cascade Node Permissions attribute checked then the permissions apply to that node and its sub-nodes only. If the Cascade Node Permissions attribute was not checked then the role permissions are only applied the the specific node to which the role belongs.
Cascade Node Permissions

Nodes & User Provisioning

Each node and sub-node within the Keeper deployment can provision users with different provisioning methods. For example, Finance and Sales & Marketing can use Single Sign-On, and Engineering can use Active Directory.

Stacking Provisioning Methods

A node can contain one or more provisioning methods. For example, you can provision users with Active Directory and authenticate the users with Single Sign-On (SAML 2.0) integration.

Adding a Provisioning Method

Navigate to the Node that you would like to provision users. Then click on the "Provisioning" tab and click "Add Method".
Provisioning Method
Export as PDF
Copy link
On this page
Nodes and SSO
Nodes and Active Directory
Creating Nodes
Navigating Nodes
Team and User Sharing Visibility
Node Isolation
Managed Service Providers
Nodes & Administrative Permissions
Nodes & User Provisioning
Stacking Provisioning Methods
Adding a Provisioning Method