Keeper Enterprise

Keeper Enterprise is a zero-knowledge, end-to-end encrypted secrets management platform with privileged access management capabilities. It provides secure credential vaulting, just-in-time access, and password rotation for enterprise infrastructure across cloud, on-premises, and hybrid environments. Versions: 8.0.0 P10

Introduction

This plugin integrates RSA Governance and Lifecycle (G&L) with Keeper Enterprise using the Keeper Secrets Manager (KSM) Java SDK. It retrieves credentials for use by collectors and connectors. Credentials are not cached; each retrieval fetches the current password directly from Keeper. All HTTPS transport and end-to-end encryption are handled by the KSM SDK.

Prerequisites

Ensure you have the following:

• Administrative access to your Keeper Enterprise vault.
• The Keeper Secrets Manager CLI installed on a machine used to initialize credentials.
• A list of managed accounts that RSA G&L will access.

Keeper Side Setup

This section describes how to configure Keeper Enterprise for SDK-based access by RSA G&L.

info

This section is provided for reference only. Contact your Keeper administrator to configure Keeper Enterprise in line with your organization's security requirements.

Step 1: Create a Shared Folder

Keeper Secrets Manager applications can only access Shared Folders. Regular folders are not visible to the SDK.

warning

Use Create New > Shared Folder (identified by a two-person icon). If you use Create New > Folder (plain folder), the KSM application will not see it. If the folder does not appear in Secrets Manager, delete it and recreate it as a Shared Folder.

1. Log in to Keeper Vault at keepersecurity.com.

2. Click Create New > Shared Folder.

3. Complete the following fields and click Create.

   Field	Value
   Folder Name	A descriptive name, for example AD Credentials
   User Permissions	No User Permissions
   Record Permissions	View Only

Step 2: Create a Login Record

1. In My Vault, open the shared folder, click the folder menu (...), and select New Record.

2. Select record type Login.

3. Complete the following fields and click Save.

   Field	Value
   Title	A descriptive name for the account, for example AD Service Account
   Login	The username
   Password	The credential password

Step 3: Note the Record UID

The Record UID is the permanent identifier used by the plugin to locate a record. It does not change if the record is renamed or moved.

1. Open the record in Keeper Vault.
2. Click the record menu (...) at the top-right of the record panel and select Record Info.
3. Copy the UID, a 22-character Base64 string, for example YSq-xxLdgsO2RJbz46EKkA.

This value is entered in the G&L vault profile as the Record UID.

Step 4: Create a KSM Application

1. In Keeper Vault, click Secrets Manager in the left sidebar.
2. Click Create Application, enter a name (for example GL-PAM), and click Save.
3. With the application selected, click the Folders and Records tab.
4. Search for and select your shared folder. It is added with Read Only access.
5. Click Save. The Records column should show a count greater than zero.

Step 5: Generate an Access Token and Initialize Credentials

warning

One-time access tokens cannot be retrieved after generation. Copy the token before closing this dialog.

1. With the application selected, click the Devices tab and click Add Device.

2. Complete the following fields.

   Field	Value
   Device Name	A descriptive name, for example GL-PAM-Plugin
   Method	One-Time Access Token
   Lock external WAN IP	Leave unchecked

3. Click Generate Access Token and copy the token. The format is US:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.

4. On any machine with the KSM CLI installed, run the following to exchange the token for permanent credentials.

   # Install the CLI (one-time setup)
   pip install keeper-secrets-manager-cli
   
   # Exchange the token — creates keeper.ini in your home directory
   ksm profile init --token <YOUR_ONE_TIME_TOKEN>

5. Open the generated keeper.ini file (%USERPROFILE%\keeper.ini on Windows, ~/keeper.ini on Linux/macOS).

   [_default]
   clientid          = <base64 string>
   privatekey        = <base64 string>
   appkey            = <base64 string>
   hostname          = keepersecurity.com
   appownerpublickey = <base64 string>
   serverpublickeyid = 10

   Each value maps directly to a field in the G&L vault configuration in the next section.

Installation and Configuration in G&L

note

Requires RSA Governance and Lifecycle 8.0.0 Patch 10 or later.

Complete the Keeper Side Setup section before proceeding. You will need the values from the keeper.ini file generated in Step 5.

Step 1: Install the Plugin

1. Log in to the RSA G&L UI as a System Administrator.

2. Open the Admin menu and click System.

3. Click the Password Vault tab.

4. Scroll to the Vault Types section and click Upload New Vault Type.

   

5. Enter a Vault Type Name (for example, Keeper-Enterprise) and an optional description. Click Choose File, select the distribution JAR (keeper-enterprise-plugin-dist-1.0-<timestamp>.jar), and click OK.

   
   note

   After uploading, restart all remote G&L agents to load the new vault type.

6. After the upload completes, Keeper-Enterprise appears in the Vault Types list.

   

Step 2: Configure the Password Vault

1. Scroll to the Password Vault Configuration section. Select Keeper-Enterprise from the dropdown and click + Create.

   

2. Copy the values from keeper.ini into the corresponding fields, click Test Connection, and click OK to save.

   G&L Field	keeper.ini Key	Description
   Hostname	hostname	Keeper server hostname. Varies by region: keepersecurity.com (US), keepersecurity.eu (EU), keepersecurity.com.au (AU), keepersecurity.jp (JP), keepersecurity.ca (CA)
   Client ID	clientid	Base64-encoded application identity
   Private Key	privatekey	Base64-encoded ECC private key (masked)
   App Key	appkey	Base64-encoded application encryption key (masked)
   App Owner Public Key	appownerpublickey	Optional but recommended
   Server Public Key ID	serverpublickeyid	Defaults to 10

   

3. The saved configuration shows Edit, Test Connection, and Delete options. Use Test Connection at any time to verify connectivity.

   

Step 3: Create Vault Profiles

A vault profile maps a G&L managed account to a specific record in Keeper by its UID. Create one profile per account.

1. Navigate to the Password Vault Profiles section and click + Create Profile.

   

2. Complete the following fields and click Test Profile. A Credential retrieved successfully response confirms the UID is valid and the password is accessible. Click OK to save.

   Field	Description	Example
   Name	Display name for this profile	Active Directory
   Description	Optional description	AD service account
   Record UID	The 22-character Base64 UID copied in Step 3 of the Keeper Side Setup	YSq-xxLdgsO2RJbz46EKkA

   

3. The profile appears in the list. The Identifier column shows the Record UID.

   

4. Repeat for each account that requires Keeper password retrieval.

5. In G&L, open the collector or connector configuration, locate Use Password Vault, select the profile, click Test, and save.

Known Limitations

• Records are accessed by UID, not by title. Record UIDs are permanent and do not change if a record is renamed or moved. If a record is deleted and recreated, its UID changes and the vault profile must be updated.

• The KSM application must have access to the record's Shared Folder. If the record is moved out of the shared folder that the KSM application can access, credential retrieval will fail. Verify folder membership in Keeper Vault under Secrets Manager > application > Folders and Records.

Troubleshooting

Connection Errors

• Verify that all six vault configuration fields match the values in keeper.ini exactly.
• Confirm the Hostname matches your Keeper region.
• Check that the KSM application is active and has not been deleted in Keeper Vault.

Record Not Found

• Confirm the Record UID in the vault profile is correct.
• Verify the record is inside a Shared Folder that the KSM application can access.
• In Keeper Vault, go to Secrets Manager > application > Folders and Records and confirm the folder is listed with a record count greater than zero.

Access Denied Errors

• Verify the KSM application has Read Only access to the shared folder.
• Confirm the shared folder contains the target record and has not been moved or deleted.