Ctrlk
HomepageSystem Status

Automation Commands

Streamline administrative workflows by automating complex, multi-step processes on the Keeper platform

Overview

Automation Commands provide a unified way to automate credential provisioning for users in the organization. Using a single Commander action, the admin can create PAM Users, create Active Directory accounts, apply rotation settings, perform immediate password updates through the Keeper Gateway, and deliver credentials via one-time share links or direct vault sharing. The result is a repeatable, error-resistant workflow that accelerates employee onboarding and ensures security best practices are followed every time.

Commands

Command
Alias
Purpose

credential-provision

cp

Automate PAM User credential provisioning with AD account creation, automated rotation, and credential delivery via email or direct vault sharing

credential-provision

Automates the end-to-end process of creating PAM User credentials with optional Active Directory account creation, password rotation, folder organization, and secure credential delivery.

Use Case

  • Onboarding new employees with their identity provider credentials

  • Creating Active Directory admin accounts and sharing them to user vaults

  • Automating the process of end-user password resets

  • Rotating and delivering on-demand credentials for any KeeperPAM resource

  • Onboarding existing accounts whose current password is already known (bring-your-own-password)

  • Provisioning new records without rotating immediately (cron-deferred or manual-trigger workflows)

Details

The credential-provision command orchestrates multiple Commander operations in a single workflow. It accepts a YAML configuration file as the request parameters, and it processes the workflow in a single action.

  1. Parse Configuration - Validates the provided YAML configuration file

  2. Username Resolution - Resolves username from template (e.g., {first_initial}{last_name}.adm)

  3. Duplicate Detection - Checks for existing PAM Users to prevent conflicts

  4. Password Determination - Uses account.existing_password when supplied; otherwise generates a secure password from rotation.password_complexity; falls back to a built-in default when neither is supplied

  5. AD User Creation - Creates user in Active Directory via PAM Gateway (optional, when directory_uid and distinguished_name are provided; skipped when account.existing_password is set — the account is declared to already exist)

  6. AD Group Assignment - Adds user to specified AD groups (optional, when ad_groups are provided; runs regardless of step 5)

  7. PAM User Creation - Creates PAM User record in specified folder

  8. Rotation Configuration - Links to PAM Configuration and sets rotation schedule (skipped entirely when no rotation: section is supplied)

  9. Immediate Rotation - Performs on-demand rotation of the password in the target directory via the Keeper Gateway (skipped when rotation.rotate_on_provision: false, or when step 8 was skipped)

  10. Direct Share - Shares record directly to user's Keeper vault (optional, when delivery section is present)

  11. Email Delivery - Sends welcome email with one-time share URL (optional, when email section is present)

Note: Several steps are conditional:

  • Steps 4 & 5 (Password Determination & AD User Creation): if account.existing_password is supplied, Commander stores it verbatim in the vault and skips AD user creation — the account is declared to already exist. AD group additions (Step 6) still apply.

  • Steps 8 & 9 (Rotation Configuration & Immediate Rotation): if the rotation: section is omitted, no rotation is configured for the record. If rotation.rotate_on_provision: false is set, rotation is configured but no immediate rotation fires at provisioning — the scheduled cron (or a manual Rotate Now) handles all subsequent rotations.

  • Steps 10 and 11 are independent — you can use either, both, or neither. If both delivery and email sections are present, the record is shared to the user's vault AND emailed with a one-time share link. If neither is present, the record is created but not delivered.

This automation eliminates manual steps, ensures proper security configuration, and provides a consistent provisioning experience.

Parameters

  • -c, --pam-config <UID> - PAM Configuration record UID (determines which Gateway to use). Can also be provided in YAML as account.pam_config_uid (deprecated — use -c instead).

  • -config </path/to/file> - Path to YAML configuration file containing provisioning settings

  • --config-base64 <base64 encoded file> - YAML configuration encoded in base64 format (for Service Mode / REST API usage)

Optional Parameters

  • --dry-run - Validate configuration without creating resources

  • --output <json|text> - Output format (default: text)

Prerequisites

In order to utilize this automation command, the following needs to be set up:

  • An active KeeperPAM license

  • PAM Configuration created for Active Directory, AWS, Azure or GCP depending on the target

  • A Keeper Gateway set up which is able to rotate credentials in the target system

For email delivery:

  • An Email Configuration set up for mail delivery

For direct share delivery:

  • Target user must have an existing Keeper vault

For AD user creation and group assignment:

  • Gateway v1.8.0 or later

  • A PAM Directory record (pamDirectory) with directoryType=ad linked to the PAM Configuration

  • Gateway must have network access to Active Directory

Security Constraints

When account.existing_password is set, Commander enforces two invariants to prevent the supplied password from reaching any target system:

  1. AD-create is skipped. The internal action that normally fires when distinguished_name or ad_groups is set will NOT run. The operator is declaring the account already exists; Commander stores the supplied password in the vault as the source of truth. AD group additions still apply.

  2. Immediate rotation must be explicitly deferred. If a rotation: section is present alongside existing_password, you must set rotation.rotate_on_provision: false — otherwise the configuration is rejected at validation time. This prevents Commander from generating a new password and pushing it to the target at provisioning, which would defeat the bring-your-own-password intent.

To rotate an existing_password-onboarded account, click Rotate Now in the Vault UI (or use pam action rotate <UID>). At that point Commander generates a fresh password and the gateway pushes it to the target.

YAML Configuration Structure

In the example YAML configuration below, Sarah Jones is a new employee that is being onboarded to Company.com. The identity provider / IGA / HR system (such as Workday, Aquera, Sailpoint, ConductorOne, etc) triggers a request to Keeper that performs the following:

  • Identifies the user in the target directory

  • Rotates the password in the directory, according to the desired complexity rules

  • Saves the password as a PAM User record in the Commander user's vault

  • Configures automated password rotation of the record for once per week

  • Delivers the credential to the new employee's personal email address through a one-time share link

  • One-time share link expires in 7 days

User Section (Required)

The "user" section identifies the end-user identity in the target directory.

Field
Type
Required
Description

first_name

string

Yes

New User's first name

last_name

string

Yes

Employee's last name

personal_email

string

Yes

Personal email for credential delivery

employee_id

string

No

Employee identifier

department

string

No

Department (used for folder organization)

Account Section (Required)

The "account" section identifies the PAM Configuration and user ID in the target directory.

Field
Type
Required
Description

username

string

Yes*

Username for target system

username_template

string

Yes*

Template for deriving username (see Username Templates below)

pam_config_uid

string

No**

UID of PAM Configuration record (deprecated — use -c flag instead)

directory_uid

string

Yes

UID of pamDirectory record for AD user creation

distinguished_name

string

No***

AD Distinguished Name (supports {username} placeholder)

ad_groups

list

No

List of AD group DNs to add the user to

existing_password

string

No

Account's current real password. Stored in the vault; never pushed to a target. Use when onboarding an account that already exists in AD. Validator forbids combining this with a rotation that would fire at provisioning — see Security Constraints.

*Either username or username_template is required (not both).

**Required if -c / --pam-config is not provided on the command line.

***Required for Active Directory in multi-OU environments (recommended for all AD deployments). Supports {username} placeholder which is resolved from username or username_template.

Username Templates

The username_template field supports the following variables, resolved from the user section:

Variable
Example Input
Result

{first_name}

Felipe

felipe

{last_name}

Dias

dias

{first_initial}

Felipe

f

{last_initial}

Dias

d

{email_prefix}

fdias@company.com

fdias

All output is lowercased. Variables can be combined:

Vault Section (Optional)

The "vault" section controls where the PAM User record is stored in the vault.

Field
Type
Required
Description
Default

folder

string

No

Subfolder path relative to gateway application folder, or a folder UID

PAM Users/{department}

To find the Application Folder, see the Vault > Secrets Manager > PAM Configurations > Application Folder setting.

Example: If the gateway folder is My Infrastructure and the vault.folder parameter is Users/Service Accounts, the final path becomes My Infrastructure/Users/Service Accounts.

Rotation Section (Optional)

Controls password rotation settings. Omit this section entirely to indicate Commander should not manage rotation for the new record. When present, exactly one of schedule or on_demand: true must be specified (mutually exclusive).

Field
Type
Required
Description

schedule

string

Yes*

6-field CRON expression

on_demand

boolean

Yes*

Configures rotation for manual triggering only; no cron schedule is stored.

password_complexity

string

Yes

Password complexity rules

rotate_on_provision

boolean

No (default true)

When false, skips the immediate rotation at provisioning time. The configured schedule (or manual Rotate Now) handles all subsequent rotations.

* - Exactly one of schedule or on_demand is required when the section is present.

Rotation Schedule (6-field CRON) Format: second minute hour day month day-of-week

Password Complexity Format: "length,uppercase,lowercase,digits,special"

Delivery Section (Optional)

The "delivery" section controls direct vault sharing. When present, the PAM User record is shared directly to the specified user's Keeper vault. This section is independent from the email section — you can use either, both, or neither.

Field
Type
Required
Description
Default

share_to

string

Yes

Keeper vault email of recipient

-

transfer_ownership

boolean

No

Transfer record ownership to recipient

false

permissions.can_edit

boolean

No

Allow recipient to edit the record

false

permissions.can_share

boolean

No

Allow recipient to share the record

false

Warning: transfer_ownership is incompatible with password rotation. Transferring ownership moves the record out of the Gateway's control, which prevents automated password rotation. Use can_edit: true instead if the user needs to manage the record while keeping rotation active.

Email Section (Optional)

The "email" section controls email delivery with a one-time share link. When present with a valid config_name, a one-time share URL is generated and emailed to the recipient. This section is independent from the delivery section — you can use either, both, or neither.

Field
Type
Required
Description
Default

config_name

string

Yes

Email configuration name from Admin Console

-

send_to

string

Yes

Recipient email

"example@gmail.com"

subject

string

No

Email subject line

"Your New Credentials"

share_url_expiry

string

No

Share URL expiration time

"7d"

Share URL Expiration Time Format: y (year), mo (month), d (day), h (hour), mi (minute)

Executing the Automation

CLI Execution

The process of executing the Keeper automation is as follows:

  1. Create a YAML file that defines the automation parameters

  2. Call the Commander command:

Service Mode / REST API Execution

For automated workflows triggered by JIRA, Okta, or other systems, use the Commander Service Mode REST API:

Then call the REST API:

Check the result:

Example Configurations

Active Directory Admin Account with Direct Share

Creates an AD admin account in a specific OU, adds to AD groups, configures rotation, and shares directly to the user's Keeper vault.

Execution

AD Account with Direct Share AND Email

Creates an AD admin account, shares to the user's vault, AND sends an email with a one-time share link.

Execution:

Active Directory User with Email Delivery

Execution

Microsoft Entra ID User

Execution

As a result, the PAM User record is created in the vault, rotated in the target directory and sent to the recipient as a one-time share that expires in 7 days.

Onboard Existing Account with Bring-Your-Own-Password

Onboards an Active Directory account that already exists in the target directory, using its current password. Commander stores the password in the vault and configures on-demand rotation, but does not touch AD during provisioning. When the operator clicks Rotate Now, Commander generates a fresh password and pushes it to the existing AD account.

Execution:

Record Creation Only (No Delivery)

Creates a PAM User record with rotation configured, but does not share or email the credential. An admin can share the record manually later.

Execution:

JSON Output (Service Mode)

Scheduled Rotation, Skip the Provisioning-Time Rotation

Creates the account with a Commander-generated password and configures cron-based rotation, but does not fire an immediate rotation at provisioning. The first rotation will happen at the next scheduled cron tick.

Email Template

The recipient will receive an email containing an encrypted one-time share link.

When the user clicks "View Credentials", they are able to decrypt and view the credentials.

AD User Creation

When directory_uid and distinguished_name are provided in the account section, the command creates the user in Active Directory before creating the PAM User record in Keeper.

Requirements:

  • Gateway v1.8.0+ — AD user creation requires Gateway version 1.8.0 or later. The command will check the Gateway version and skip AD operations with a warning if the Gateway is below this version.

  • A pamDirectory record with directoryType=ad must exist in the Gateway's shared folder

  • The pamDirectory record must have admin credentials with permission to create users in the target OU

  • The directory_uid field must reference this pamDirectory record

  • ad_groups requires directory_uid to be set — the Gateway needs the PAM Directory record to know which AD to connect to for group operations

  • AD group DNs must be full distinguished names (e.g., CN=Group-Name,CN=Users,DC=domain,DC=com)

System-Specific Requirements

Active Directory - Distinguished Name is REQUIRED for multi-OU environments. Without it, rotation may fail if multiple users have the same username in different OUs.

Azure AD - Username MUST be in email format: user@domain.com OR DOMAIN\user

AWS IAM - Just use a plain username

Related Commands

PreviousMSP Management CommandsNextEmail Configuration Commands

Last updated