CLI Approvals
Commander Approvals
Keeper Commander, our CLI and SDK platform is capable of performing Admin Device Approvals for automated approval without having to login to the Admin Console. Admin approvals can be configured on any computer that is able to run Keeper Commander (Mac, PC or Linux).
Please see the Installation Instructions here:
https://docs.keeper.io/secrets-manager/commander-cli/commander-installation-setup
You can install the binary versions for Mac/PC/Linux or use
pip3.Enter the Commander CLI using the "keeper shell" command. Or if you installed the Commander binary, just run it from your computer.
$ keeper shell
_ __
| |/ /___ ___ _ __ ___ _ _
| ' </ -_) -_) '_ \/ -_) '_|
|_|\_\___\___| .__/\___|_|
|_|
password manager & digital vault
Use the "login" command to login as the Keeper Admin with the permission to approve devices. Commander supports Master Password and 2FA.
Type "device-approve" to list all devices:
My Vault> device-approve
Email Device ID Device Name Client Version
------------------ ------------------ ---------------- ----------------
[email protected] f68de375aacdff3846 Web Vault Chrome w15.0.4
[email protected] 41sffcb44187222bcc Web Vault Chrome w15.0.4
To manually approve a specific device, use this command:
My Vault> device-approve --approve <device ID>
To approve all devices that come from IPs that are recognized as successfully logged in for the user previously, use this command:
My Vault> device-approve --approve --trusted-ip
To approve all devices regardless of IP address, use this command:
My Vault> device-approve --approve
To deny a specific device request, use the "deny" command:
My Vault> device-approve --deny <device ID>
To deny all approvals, remove the Device ID parameter:
My Vault> device-approve --deny
To reload the latest device approvals without having to exit the shell, use the "reload" command:
My Vault> device-approve --reload
Commander supports an automation mode that will run approvals every X number of seconds. To set this up, modify the config.json file that is auto-created. This file is located in the OS User's folder under the .keeper folder. Example: C:\Users\Administrator\.keeper\config.json)
Leave the existing data in the file and add the following lines :
"commands":["device-approve --reload","device-approve --approve"],
"timedelay":30
JSON files need a comma after every line EXCEPT the last one.
Now when you open Commander (or run "keeper shell"), Commander will run the commands every time period specified. Example:
$ keeper shell
Executing [device-approve --reload]...
Password:
Logging in...
Syncing...
Executing [device-approve --reload]...
Email Device ID Device Name Client Version
------------------ ------------------ ---------------- ----------------
[email protected] f68de375aacdff3846 Web Vault Chrome w15.0.4
Executing [device-approve --trusted-ip --approve]...
2020/09/20 21:59:47 Waiting for 30 seconds
Executing [device-approve --reload]...
There are no pending devices to approve
.
.
.
Similar to the example above, Commander can automatically approve Team and User assignments that are created from SCIM providers such as Azure, Okta and JumpCloud.
To set this up, simply add one more command
team-approve to the JSON config file:{
"user": "[email protected]",
"commands": [
"debug",
"device-approve --reload",
"device-approve --approve",
"team-approve"
],
"timedelay": 60
}
Keeper Commander supports "persistent login" sessions which can run without having to login with a Master Password. Please see the Commander documentation for persistent login at this link.
There are many ways to customize, automate and process automated commands with Keeper Commander. To explore the full capabilities see the Commander documentation.
Last modified 1mo ago