Comment on page
Solutions to common Secrets Manager issues
When attempting a Secrets Manager command in Commander, the tool responds with
In order to utilize Keeper Secrets Manager, two permission criteria must be met:
- 1.The Secrets Manager addon must be enabled for your Keeper Account
- 2.You must be in a role with the Secrets Manager enforcement policy enabled
In the Keeper Admin Console add Secrets Manager to a role with role enforcements. Select or create a new role, open the "Enforcement Policies" settings and navigate to the "Keeper Secrets Manager" tab to allow or disallow Secrets Manager for the role.
The Keeper Secrets Manager Enforcement Policy in the Keeper Admin Console
Any users that are in a role with Secrets Manager allowed will be able to see the Secrets Manager tab in their Keeper Vault, and create and manage Secrets Manager Applications and Devices.
You must have Keeper account administrative permissions to create and edit roles.
er --enforcement="allow_secrets_manager:true" "<ROLE NAME>"
Replace <ROLE NAME> with the role you would like to set the enforcement policy to.
For example, to set the enforcement on the Keeper Administrator role:
er --enforcement="allow_secrets_manager:true" "Keeper Administrator"
When performing commands with the KSM CLI that use a record or folder UID as an input, the command line interface cannot distinguish between a UID that starts with "-" and a command option. If the UID you are using begins with a "-" (dash / hyphen) simply add "--" before the UID to use it.
ksm secret get -- -id8QpE2ZAkdd4KlCfoWQ
*The UID in this example is not a real record UID
When fetching secrets using Secrets Manager, the system responds that the record could not be found.
There are two reasons that this message may appear:
- 1.The record that is being searched for is not shared with the Secrets Manager Application
- 2.The record is a legacy (V2) non-typed record
Individual records can be shared with a Secrets Manager Application, or a shared folder can be shared with a Secrets Manager Application, which will give access to all records in that folder.
To share records or shared folders with a Secrets Manager Application, in Commander use the following command:
sm share add -a <APPLICATION NAME> -s <RECORD OR FOLDER UID>
Keeper Secrets Manager supports typed records (V3) only. If a legacy, non-typed record is queried, Secrets Manager will respond that the record cannot be found.
To identify if a record is typed in Commander, use the
If the record has a type (and is compatible with Secrets Manager) it will be displayed in the record information
my vault> get pICzm4iw9sW454m2ZR4mmQ
Title: My Login
Last Modified: 2021-10-18 16:08:04
If the record is not typed (and not compatible with Secrets Manager) it will not have a Type field.
Additionally, you can view all records in the current folder using the
ls -lcommand. The resulting table has a type column. Any records which are blank in the type column are non typed records.
My Vault> ls -l
# Folder UID Name Flags
--- ---------------------- ----------------- -------
1 RpdmergF5lpsaID3TcHu8A Devops Secrets S
2 461XtX26R1SggIyQDFGfZg Secrets S
3 ZDw67iL28d6-YqUVwBHAug Social
# Record UID Type Title Login URL
--- ---------------------- ------------------- ----------------------- --------------------- -------------------
1 FyP2it0DzwIDPSbch2WyHw address Bank Address 1
2 pICzm4iw9sWS_4m2ZR4mmQ login breached [email protected] keepersecurity.com
3 qUX4gSlmDRfM1Kq9lrQi-w databaseCredentials MySQL Database SQL_Admin
4 rlr04tiSxFmLmRNjEC7h7Q NonTyped Record legacy test.com
In the above example, the bottom record (#4) is not typed, and not compatible with Secrets Manager
When choosing a record type, all types are compatible with Secrets Manager except for the "General" type.
General type records are identical to legacy, non typed records.
Replace an existing record
If you have existing non typed records that you would like to use with Secrets Manager, we recommend creating a "Login" type record and copying the information to it.
Login type records have identical fields to legacy non typed Keeper records.
Login type records have the same fields as legacy Keeper records
Copy fields and files into the new typed record
Place the new typed record in a shared folder that your Secrets Manager application can access, or use the UID to share it to an application directly.
Untyped records can be converted to typed records that Secrets Manager can utilize by using the
convertcommand in Keeper Commander.
convert <UID> --type <TYPE>
convert Dtvb84zwkBmZgxrUByUfpg --type login
The convert command can use patterns to find all relevant records, can recursively apply the conversion to all sub-folders, and supports all record types.
The Keeper Secrets Manager API throttles connections that make a large number of requests in a short period of time. If your connection is throttled, you will receive an error, such as a 503 response code (the actual message depends on the integration/SDK being used).
The Secrets Manager APIs are set to limit any system that makes more than 200 calls per 10 seconds.
This count resets when the 10 second timer expires, however it renews with each subsequent request sent in less than 10 seconds. So without a 10 second pause, the system will continue to be throttled.
- Making 201 calls in less than 10 seconds
- Making 1 call per 9 seconds, you will be throttled on your 201'st call
API request limits are calculated by unique IP address