Getting Started
Getting Started with configuring connections on your PAM Record types
Overview
In this guide, you will learn how to setup connections for all the supported protocols on your PAM Record types in your Keeper Vault. Supported database protocols can also launch in the visual KeeperDB interface.
An active license is required in order to use the features available with KeeperPAM. This license is available for both business and enterprise customers.
Prerequisites
Prior to configuring Connections, make sure to have the following:
Connection Enforcement Policies
The following Enforcement Policies affect user's permissions to use Connections and need to be enabled.
Enforcement policies for KeeperPAM are managed in the Keeper Admin Console under Admin > Roles > Enforcement Policies > Privileged Access Manager.
Can configure connection settings
Allow users to configure Tunnel settings on PAM Machine, PAM Directory, PAM Database and PAM Configuration Records Types
Can start connections
Allow users to start tunnels on PAM Machine, PAM Directory and PAM Database Record Types
Can view recordings
Allow users to view session Recordings.
Tunnels can also be enabled on the Keeper Commander CLI using the enterprise-role command:
Enforcement Policy Use Cases
If a user should only have access to launching connections and not configuring connections, then only "Can start connections" policy should be enabled for the user.
In addition to launching connections, If a user should also have access to configure connections, then "Can configure connections settings" and "Can start connections" should be enabled for the user.
Session Recordings
Launched connections can also be recorded. These recordings are available on the PAM Machine, PAM Database, or PAM Directory record types and can be played back on your Vault. For more details on session recording and playback, visit this page.
Installing the Keeper Gateway
The Keeper Gateway is a hosted agentless service that is installed on the customer's network to enabled zero-trust access to target infrastructure. Typically this service is installed on a Linux or Docker environment in each of the networks that requires access.
For more details on installing and setting up your gateway, visit this page.
PAM Configuration
The PAM Configuration contains essential information of your target infrastructure, settings and Keeper Gateway. Setting up a PAM Configuration for your infrastructure is required. For more information on creating and configuring the PAM Configuration, visit this page.
PAM Machine, PAM Database and PAM Directory
A Keeper Connection is a secure, encrypted interactive session established between your vault client to the target endpoint. The target endpoint needs to be defined on one of the following PAM Record types:
Windows/MacOS/Linux Machines, EC2 Instances, Azure VMs
MySQL, PostgreSQL, SQL Server, MongoDB, MariaDB, Oracle
Active Directory, OpenLDAP
Web-based applications
Depending on your target endpoint, visit the corresponding PAM Record Type page for more information on setup.
For visual database access on supported PAM Database records, use KeeperDB.
Supported Connection Protocols
The following table lists all the supported connection protocol that can be configured in your Keeper Vault. Database protocols can launch as interactive sessions or in KeeperDB. Visit the associated link for each protocol for more details on configuration.
PAM Machine
Connecting to the target defined on the PAM Machine Record with the SSH connection protocol
PAM Machine
Connecting to the target defined on the PAM Machine Record with the RDP connection protocol
RBI
PAM Browser
Connecting to the URL defined in the PAM Browser Record with the Remote Browser Isolation (http/https) protocol
PAM Database
Connecting to the target defined on the PAM Database Record with the MySQL connection protocol
PAM Database
Connecting to the target defined on the PAM Database Record with the MariaDB connection protocol
PAM Database
Connecting to the target defined on the PAM Database Record with the SQL Server connection protocol
PAM Database
Connecting to the target defined on the PAM Database Record with the PostgreSQL connection protocol
PAM Database
Connecting to the target defined on the PAM Database Record with the Oracle connection protocol
PAM Machine
Connecting to the target defined on the PAM Machine Record with the VNC connection protocol
PAM Machine
Connecting to the target defined on the PAM Machine Record with the Telnet connection protocol
Connection Authentication Methods
Keeper Connections can be authenticated using one of the following methods:
Launch Credential The session to the target is authenticated using the "Launch Credentials" configured directly on the PAM Machine, PAM Database, or PAM Directory record types. The user does not need access to the credentials in order to launch the connection.
Personal/Private Credential When "Allow users to select credentials from the vault" is enabled, users can choose to authenticate the session to the target using a personal/private credential stored securely in their own Keeper Vault.
Ephemeral Accounts When the ephemeral account feature is enabled on the PAM Machine or PAM database resources, a system-generated, time-limited privileged account is created specifically for the session. This account is deleted automatically after the session ends, eliminating standing privilege. This method is used for Just-In-Time access with no persistent account on the target system.
Connection Templates
The PAM record type with your target system can also be configured as a Connection template. These templates serve as reusable record types for launching sessions to target systems without needing to predefine a specific hostname or credential. For more information, visit the following:
Connection TemplatesAuto-Reconnect
Auto-Reconnect for PAM helps keep users connected without requiring them to manually relaunch a session after an interruption, and no configuration is required. If a connection is disrupted by a device going to sleep, a Wi-Fi drop, a VPN interruption, or a temporary backend issue, Keeper automatically attempts to restore the session so users can stay focused on their work.
When a disruption occurs, the client automatically reconnects after a short delay and continues retrying periodically as long as the session window remains open and policy allows. Each session is handled independently, with retry behavior designed to be throttle-aware and respectful of platform limits.
This feature improves the PAM experience by reducing downtime, minimizing workflow interruptions, and preserving user context where possible. It also provides clear session status updates and logs each reconnect attempt for better visibility and auditing.
Last updated