Active Directory Plugin
Active Directory plugin for Keeper Commander rotation
Keeper has launched a new Password Rotation feature with Keeper Secrets Manager. This new capability is recommended for all password rotation use cases. The Documentation is linked below:
Password Rotation with Keeper Secrets Manager
This plugin provides IT Admins with the ability to rotate the password of an Active Directory user account. This plugin can be run on any system that has network access to the AD server.
Prerequisites
Install the ldap3 module
Prepare Record for Rotation
Create a Record for Rotation
Rotation supports legacy and typed records. If using typed record, a 'Password' type field is required. Additional fields may be added depending on the rotation type as well. See the instructions below.
See the Troubleshooting section for more information on legacy vs typed records
Set the Password Field
In the Keeper record, put the user's current password in the "Password" field
Set the Hostname and Port
If using an untyped record, the host and port can be set to custom fields. See below.
TIP: If no rotation plugin is specified, Commander will use the port number to guess which rotation to use. Port 389 will use AD rotation
Add the following required fields
The following fields are required for AD rotation. Create each field with the label indicated and supply the required information.
| Label | Value | Comment |
|---|---|---|
cmdr:use_ssl | True or False | Whether or not to use SSL connection to AD Server |
cmdr:userdn | Distinguished name of the AD user you want to rotate the password on. |
Additional Rotation Settings
The following values can customize rotation parameters. Add these options to a record as text fields and set the label to correspond to the parameter as shown in the table.
| Label | Value | Comment |
|---|---|---|
cmdr:plugin | adpasswd | |
cmdr:host | Host name or IP address of your AD Server | |
cmdr:port | Optional: Port number of your AD Server. Default value: 389 | |
cmdr:rules | Optional password complexity rules |
Rotate Record
To rotate Active Directory passwords, use the rotate command in Commander. Pass the command a record title or UID (or use --match with a regular expression to rotate several records at once)
The plugin can be supplied to the command as shown here, or added to a record field (see options above). Adding the plugin type to the record makes it possible to rotate several records at once with different plugins.
Notes and Troubleshooting:
The Keeper "Login" field is not used for this plugin. The user is identified with the cmdr:userdn custom field.
If you get the error "Error during connection to AD server" try the following:
Ensure your AD supports secure bind via TLS. The certificate can be self-signed if needed.
Disable 'Minimum password age’ group policy. It is set to one day by default.
Verify connectivity to the host server, make sure it is accessible. Download a tool such as the Softerra LDAP Browser to test if you're able to connect to Active Directory.
Check that your Distinguished Name cmdr:userdn is set correctly. It needs to be exactly right or else the connection will fail. You can check the value of this from within the Softerra LDAP browser software or you can run the below command prompt utility on the AD Server:
For connecting as Craig in this scenario, make sure the cmdr:userdn custom field contains this exact string (without the quotes).
Connecting to Active Directory
Microsoft Active Directory requires SSL connection in order to change the password. The following link explains how to setup a secure connection to Active Directory
Last updated
