# Gateway Configuration with Custom Fields

{% hint style="info" %}
These configuration capabilities are functional and currently in an experimental phase, and we invite users to actively explore and utilize them. We are actively evaluating their functionality and performance, with the intention of considering them for official integration into our product in the future.
{% endhint %}

## Advanced Gateway Configuration with Custom Fields on PAM Resource Record Types

When setting up Rotation in your Keeper Vault, you store the credentials of your assets involved in rotation on their corresponding [PAM Resource Record Types](/keeperpam/privileged-access-manager/getting-started/pam-resources.md). On these record types, you are able to [create custom fields](/enterprise-guide/record-types.md#custom-fields).

The additional gateway configurations will be defined with these custom fields on the PAM Record Types. The Keeper Gateway will then adjust its behavior based on the defined configurations.

The following tables lists all the possible configurations with custom fields:

<table data-full-width="false"><thead><tr><th width="198">Custom Field Name</th><th width="97.51953125">Type</th><th width="137">Default Value</th><th>Description</th></tr></thead><tbody><tr><td><code>Shell</code></td><td>Text</td><td><code>None</code></td><td>Allows you to specify a custom shell path that the Gateway will use when executing rotation and post-rotation scripts. This gives you control over the environment in which these scripts run.<br><br>Example Value: <code>C:\MY\SHELL</code></td></tr><tr><td><code>NOOP</code></td><td>Text</td><td><code>False</code></td><td><p>Allows you to control whether the Gateway performs the primary rotation operation or proceeds directly to execution of the post-rotation script.</p><p>If set to <code>True</code> the Gateway will skip the rotation process and proceed directly in executing the post-rotation script(s).<br><br>Example Value: <code>True</code></p></td></tr><tr><td><code>Kerberos</code></td><td>Text</td><td><code>False</code></td><td>Specifically designed for WinRM connections using Kerberos authentication.<br><br>By default, the Gateway automatically decides whether to use Kerberos based on certain rules, and If these conditions are met, the Gateway will attempt to use Kerberos for WinRM. However, if you encounter issues with this automatic detection, setting this field to <code>True</code> will override the default behavior and force the Gateway to use Kerberos for WinRM.<br><br>Example Value: <code>True</code></td></tr><tr><td><code>Private Key Type</code></td><td>Text</td><td><code>ssh-rsa</code></td><td><p>Gateway Version 1.3.4+<br><br>This custom field pertains to the type or algorithm of the private key stored in a record.<br><br>When adding a private key to a record, users do not need to take any additional action regarding its type or algorithm. The system is designed to automatically recognize and use the same algorithm as the existing private key during the rotation process. If the algorithm in use is ECDSA, the key size will also be preserved during the rotation.<br><br>Available Options if needed to overwrite the key type:<br><br><code>ssh-rsa</code> (Note: 4096 bits)</p><p><code>ssh-dss</code> (Note: 1024 bit, obsolete) <code>ecdsa-sha2-nistp256</code></p><p><code>ecdsa-sha2-nistp384</code></p><p><code>ecdsa-sha2-nistp521</code></p><p><code>ssh-ed25519</code></p></td></tr><tr><td><code>Private Key Rotate</code></td><td>Text</td><td><code>True</code></td><td><p>Gateway Version 1.3.4+<br></p><p><code>TRUE</code> - (Default) If the custom field doesn't exist, the private key will be rotated if it exists.</p><p><code>FALSE</code> - The private key won't be rotated, even if it exists. Users should pick this if they wish to retain the private key in the record without any rotations.</p></td></tr></tbody></table>

**Note:**

* The custom fields values are not case-sensitive.

## Advanced Gateway Configuration with Custom Fields on PAM Configuration

When setting up Rotation in your Keeper Vault, you store essential information of your target infrastructure, settings and associated Keeper Gateway on the [PAM Configuration](/keeperpam/privileged-access-manager/getting-started/pam-configuration.md). On the PAM Configuration, [you are able to create custom fields.](#adding-custom-fields-on-pam-configuration)

The additional gateway configurations will be defined with these custom fields on the PAM Configuration. The Keeper Gateway will then adjust its behavior based on the defined configurations.

The following tables lists all the possible configurations with custom fields:

<table data-full-width="false"><thead><tr><th width="198">Custom Field Name</th><th width="72.0078125">Type</th><th width="174.76171875">Default Value</th><th>Description</th></tr></thead><tbody><tr><td><code>Azure Authority FQDN</code></td><td>Text</td><td><code>Azure SDK Default</code></td><td>Overrides the Azure Active Directory authority endpoint used for authentication.<br><br>If not specified, the default authority configured in the Azure SDK is used (e.g., login.microsoftonline.com).<br><br>This field is only applicable to PAM configurations targeting Azure environments, including Azure Government.<br><br><strong>Example</strong>: login.microsoftonline.us</td></tr><tr><td><code>Azure Graph Endpoint</code></td><td>Text</td><td><code>Azure SDK Default</code></td><td>Overrides the Microsoft Graph API base URL used by Azure integrations.<br><br>If not specified, the default Graph endpoint configured in the Azure SDK is used (e.g., <code>https://graph.microsoft.com/v1.0</code>).<br><br>This field is only applicable to PAM configurations targeting Azure environments, including Azure Government<br><br><strong>Example</strong>: graph.microsoft.us/v1.0</td></tr><tr><td><code>userMatch</code></td><td>Text</td><td></td><td>Match on OU to filter found users during Discovery<br><br><strong>Example:</strong> <code>OU=Users,DC=company,DC=com</code></td></tr></tbody></table>

### Adding Custom Fields on PAM Configuration

{% hint style="info" %}
Custom Fields can only be added on the PAM Configuration with Keeper Commander
{% endhint %}

Custom Fields can be added on PAM Configuration with Keeper Commander. To add custom fields:

1. Log on to Keeper Commander
2. List all your PAM Configuration and get the UID of your PAM Configuration

```bash
pam config list
```

3. Add the custom field to the PAM Configuration. The following example will add the custom field "Azure Authority FQDN" with value "login.microsoftonline.us" to the PAM Configuration:

```bash
record-update -r "YOUR_PAM_CONFIG_UID" c.text."Azure Authority FQDN"="login.microsoftonline.us"
```

For more information on adding custom fields with the record-update command, visit this [page](/keeperpam/commander-cli/command-reference/record-commands/creating-and-updating-records.md#custom-fields).

4. The following command will allow you to view the custom field you set from step 3:

```bash
get "YOUR_PAM_CONFIG_UID"
```

**Note:**

* Custom fields on PAM Configurations can only be modified and viewed with Keeper Commander

## Rotation Rollback Fields

PAM records (pamUser, pamMachine, pamDirectory, pamDatabase and pamConfiguration) support fields for enabling / disabling rotation rollback. These fields are documented in more detail [here](/keeperpam/privileged-access-manager/password-rotation/post-rotation-scripts/rotation-rollback.md).

<table data-full-width="true"><thead><tr><th width="304">Label</th><th width="83">Type</th><th width="101">Default</th><th>Description</th></tr></thead><tbody><tr><td><code>Rollback On Private Key Fail</code></td><td>Text</td><td><code>TRUE</code></td><td>If the private key rotation fails, should everything be rolled back?</td></tr><tr><td><code>Rollback On Password Fail</code></td><td>Text</td><td><code>TRUE</code></td><td>If the password rotation fails, should everything be rolled back?</td></tr><tr><td><code>Rollback On Post Rotation Fail</code></td><td>Text</td><td><code>FALSE</code></td><td>If the post rotation fails, should everything be rolled back?</td></tr><tr><td><code>Rollback On SaaS Fail</code></td><td>Text</td><td><code>TRUE</code></td><td>If the Saas rotation fails, should everything be rolled back?</td></tr><tr><td><code>Re-run On Post Rotation Fail</code></td><td>Text</td><td><code>FALSE</code></td><td>If the post rotation fails, should the rollback re-run the post rotation script?</td></tr><tr><td><code>Reverse Params On Re-run</code></td><td>Text</td><td><code>TRUE</code></td><td>If re-running the post rotation script, should the new and old passwords be switched?</td></tr><tr><td><code>Rollback On Service Fail</code></td><td>Text</td><td><code>TRUE</code></td><td>If the service password rotation fails, should everything be rolled back?</td></tr><tr><td><code>Rollback On Service Restart Fail</code></td><td>Text</td><td><code>TRUE</code></td><td>If the service cannot be stopped or started, should everything be rolled back?</td></tr><tr><td><code>Rollback On Service Machine Down</code></td><td>Text</td><td><code>FALSE</code></td><td>If the machine running the service is down, should everything be rolled back? This includes the machine is down, the gateway can not reach, or the username or password are invalid.</td></tr><tr><td><code>Rollback On Task Fail</code></td><td>Text</td><td><code>TRUE</code></td><td>If the task password rotation fails, should everything be rolled back?</td></tr><tr><td><code>Rollback On Task Machine Down</code></td><td>Text</td><td><code>FALSE</code></td><td>If the machine running the task is down, should everything be rolled back? This includes the machine is down, the gateway can not reach, or the username or password are invalid.</td></tr><tr><td><code>Rollback On IIS Pool Fail</code></td><td>Text</td><td><code>TRUE</code></td><td>If the IIS pool password rotation fails, should everything be rolled back?</td></tr><tr><td><code>Rollback On IIS Pool Machine Down</code></td><td>Text</td><td><code>FALSE</code></td><td>If the machine running the IIS pool is down, should everything be rolled back? This includes the machine is down, the gateway can not reach, or the username or password are invalid.</td></tr></tbody></table>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.keeper.io/keeperpam/privileged-access-manager/getting-started/gateways/advanced-configuration/gateway-configuration-with-custom-fields.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.