System Requirements
The Keeper SSO Connect is a lightweight service that can be installed on a private on-premise or cloud-based server.
The following server platforms are currently supported.
​
Operating System | Architecture | HSM Support |
Windows Server 2019 Windows Server 2016 Windows Server 2012 R2 Windows Server 2012 Windows Server 2008 R2* | x64 (64-bit) | HSM is not supported |
Red Hat Enterprise Linux 6.8+ | x64 (64-bit) | HSM Supported |
CentOS Linux 7+ | x64 (64-bit) | HSM Supported |
Ubuntu Linux 16.04+ | x64 (64-bit) | HSM Supported |
openSUSE Linux 15.0 r+ | x64 (64-bit) | HSM Supported |
Keeper SSO Connect requires Java JRE or JDK. We recommend customers use Java 11.0 (LTS). If you have a different version of Java installed we recommend uninstalling that version and install Java 11.0 first before you proceed. Otherwise you may experience service hang issues. To ensure all Java installation dependencies are met we require that you install Java using the appropriate .exe or .msi installer which will setup the environment as needed to operate correctly.
We currently support Oracle Java SE 11.0 which can be downloaded from here:
Or OpenJDK 11.0 which can be downloaded from the link below:
The following table outlines the minimum hardware requirements per each server.
Max # of users per server | Processor speed (GHz) | Number of processors / Cores | Memory (GB) | Disk (GB) |
1-1,000 | 3 | 1 / 4 | 2 | 40 |
1,000 - 50,000 | 3 | 2 / 4 | 8 | 40 |
50,000 - 100,000 | 4 | 2 / 8 | 16 | 40 |
Both scalability and high availability can be achieved by placing a load balancer in front of a cluster of Keeper SSO Connect servers. The Keeper Cloud backend will take care of configuration synchronization. Changes applied to one server are automatically distributed to all servers in the same SSO node cluster. This includes the user database.
Further scalability, for example to scale to 100,000 users or more, can be achieved by splitting groups of users up into multiple SSO Connect domains. This will require creating separate SSO-enabled node(s) in the Keeper Admin Console and a separate SSO server or server cluster for each node.
SSO Connect can be fully integrated with Amazon CloudHsm or Gemalto on-prem or cloud HSM solutions for key management. The following HSM modules are currently supported:
Vendor | Model | Version | Notes |
Amazon | CloudHsm | v2 | Linux or Windows servers are supported. |
Gemalto | Luna 7 | 6.2+ | Currently only Linux-based SSO Connect instances supported. |
The following network requirements apply to Keeper SSO Connect deployments.
Keeper SSO Connect network connections to Keeper Cloud servers is TCP/443 (TLS 1.2) outbound stateful.
Keeper clients connect to SSO Connect via the externally advertised public FQDN/IP and TCP port.
Local server bind port and the external advertised connection port are configurable separately. In that scenario the ports need to be translated via a load balancer, firewall or locally (eg. iptables).
The external advertised TCP port (default TCP/8443) needs to be allowed inbound into the network subnet where the SSO Connect servers are located. For example if the service is running on Windows, use Windows Firewall to open the port to SSO Connect.
​
HSM Architecture and Deployment
The following is a general HSM architecture diagram for Luna HSM deployments.
Keeper SSO Connect will communicate with the Luna HSM via a library (libLuna.so) which handles all Keeper/Luna communication. This communication is typically conducted via TCP port 1792 stateful from Keeper SSO Connect outbound to Luna HSM inbound.
