Validate a PAM Project Import

Validate KeeperPAM project imports before creating resources.

Validate every generated PAM import before creating a project:

pam project import --filename /absolute/path/pam_import.json --name "My PAM Project" --dry-run

Use an absolute path. Confirm that Commander reports the expected resource and user counts before running the command without --dry-run.

Machine connection requirements

For a usable pamMachine, provide both the management settings and the interactive connection settings:

Setting	Purpose	Example
port	Management or rotation port	22 for SSH, 5986 for WinRM
operating_system	Resource operating system	Linux or Windows
pam_settings.connection.protocol	Interactive protocol	ssh or rdp
pam_settings.connection.port	Interactive session port	22 or 3389
administrative_credentials	PAM user used for administrative operations	Exact PAM user title or login
launch_credentials	PAM user used to launch the session	Exact PAM user title or login

The machine port and connection port have different purposes. For example, a Windows machine can use WinRM on 5986 for management and RDP on 3389 for interactive sessions.

Credential references

administrative_credentials and launch_credentials must reference a unique PAM user title or login. For a user owned by a PAM Directory, use the documented Directory Title.User Title format. For a local user nested under a machine, use the local user title or login.

Set allow_supply_user to true when a session user should be able to supply a username rather than selecting a launch credential.

Rotation settings

Omit rotation_settings when rotation is not configured. Do not use an empty object. A complete rotation configuration includes a rotation type, enablement value, and schedule.

"rotation_settings": {
  "rotation": "general",
  "enabled": "on",
  "schedule": {
    "type": "on-demand"
  }
}

If Commander reports Failed to load rotation schedule or stops at 0/N resources, remove empty rotation_settings objects and rerun the dry run.

Troubleshooting

Symptom	Check
No resources are parsed	Use an absolute --filename path and validate the JSON file.
Fewer users than expected	Check for repeated usernames and titles in the CSV generator input.
Missing machine port	Add the resource port and the protocol-specific connection port.
Missing administrator error during rotation	Verify the credential reference and remove empty rotation settings.

Replace all demonstration passwords and placeholders before any operational use.