Password vault¶
A vault alias ties a short name to the credentials of an account: the platform's applications refer to it to open a session without the user knowing the password, and the vault can rotate that password on their behalf. This page covers the two modules that manage those aliases: Password vault and Keeper vault.
What the Password vault module offers depends on the password vault mode set in the general options. Only one mode is active at a time:
| Mode | Who holds the secret, and who rotates it |
|---|---|
| Embedded | The platform itself. Rotation is driven by the password policies declared in the console. |
| Systancia Access | An external Systancia Access server. Rotation is delegated to the Systancia Access agents deployed on the workstations. |
| Keeper Security | An external Keeper vault, browsed by the Keeper vault module (section Keeper vault). |
An alias stays tied to the mode that created it
After a mode change, the aliases created in the previous mode remain visible and can be deleted, but no longer edited: editing them is only possible in the mode they were created in.
Password vault in "Embedded" mode¶
Vault access configuration¶
The Configuration toolbar button opens the Safe access configuration window. In Embedded mode it serves to move the storage of secrets onto a remote database, in the Remote database box.
| Field | Description |
|---|---|
| Database type | Target engine. postgresql by default. |
| Server | Host name or address of the database server. |
| Port | Listening port, between 0 and 65535. |
| Username / Password | Credentials to connect to the database. |
| SSL usage | SSL mode of the connection. verify-full by default. |
| Certificate authority (base64) | File of the authority that signed the server certificate, to be uploaded. |
| Site | Site used to reach the database server. |
On failure, a Connection test box appears in the window and details the outcome.
Switching database: two decisions to make
Pointing at another database opens the Database switch settings window, which offers Create the new database and Transfer existing data in the new database. Without the transfer, the aliases already declared do not follow.
Add an alias¶
The + button opens the Add alias window. The Type field drives the rest of the form.
| Common field | Description |
|---|---|
| Alias | Mandatory. Forced to lower case. The @ , < & > " characters are rejected. |
| Type | LDAP password (selected by default), SSH key or SSH password. |
| Domain | Domain of the account. Disabled for both SSH types. Special characters are rejected. |
| Username | Mandatory. Name of the target account. The \ character is rejected. |
| Password / Confirmation | Mandatory, except for the SSH key type. Both values must match. |
| Policy | In the Password rotation box: rotation policy applied to that alias. Mandatory, DefaultPolicy by default. See Password policies. |
Type selected by default. No extra field.
| Field | Description |
|---|---|
| SSH key | File of the private key to store. Its content must start with -----BEGIN ... PRIVATE KEY-----, or be in PuTTY format (PuTTY-User-Key-File-). |
| Password | Passphrase of the key. Optional if the key is not encrypted. |
| (SSH applications) | Two drag-and-drop lists, available and selected, fed by the SSH applications already declared. When there is none, the list displays No SSH application. |
Two conditions to know about
The SSH applications must have been declared beforehand to appear here. And an SSH key is not compatible with a standard SSH application: selecting one causes validation to be refused.
| Field | Description |
|---|---|
| (SSH applications) | Same drag-and-drop lists as for the SSH key. |
Edit an alias¶
Select the alias and click the Properties icon, or double-click the row: the Edit alias window opens. The Alias field becomes plain displayed text. Only aliases created in Embedded mode are edited here.
Display the current password¶
The Display current password button retrieves the password held by the vault.
| Situation | Behaviour |
|---|---|
| Displaying passwords is refused in the general options | The button does not appear. |
| The alias is not associated with an enabled policy | The button is inactive. |
| No rotation has taken place yet | A message states the password is unknown. |
| A password is available | After confirmation it appears next to the button; clicking again hides it. |
Displaying the password triggers its rotation
Displaying it causes the service to renew it once the delay set in the general options expires — 30 minutes by default. A confirmation is therefore always requested.
Delete an alias¶
Select one or more aliases and click ×. A confirmation is requested. The applications that relied on the alias see their SSO setting move from Fixed to Enabled.
Force password renewal¶
Select one or more aliases associated with an enabled policy, then click Force password renewal. A confirmation is requested. The button stays inactive if one of the selected aliases has no enabled policy.
Password vault in "Systancia Access" mode¶
Vault access configuration¶
The Configuration button opens the same Safe access configuration window, which here presents two boxes.
Systancia Access server settings
| Field | Description |
|---|---|
| Server | Host name or address of the Systancia Access server. |
| Use SSL | HTTPS communication. Ticked by default. |
| Port | Service port. 99 by default. |
| Path | Path of the web service. /service.asmx by default. |
| Site | Site used to reach the server. A site with no online Edge Gateway is refused at validation. |
Default credentials
| Field | Description |
|---|---|
| Username / Password | Default access credentials for the Systancia Access server. |
Changing the server address purges the aliases
Changing the server address after a first configuration asks for confirmation: accepting purges the existing aliases that referred to the former server.
Add an alias¶
The + button opens the Add alias window. Two radio buttons drive the rest: User vault or Shared vault, the latter selected by default.
| Common field | Description |
|---|---|
| Alias | Mandatory. Forced to lower case. The @ , < & > " characters are rejected. |
| Password / Confirmation | Password to store in the vault. Both values must match. |
| Field | Description |
|---|---|
| Access Container | Systancia Access container to store the secret in. |
| Application name | Name of the service to create in the container. |
| Username | Name of the target account. The @ and \ characters are rejected. |
| Domain | Domain of the account. |
| Field | Description |
|---|---|
| Mode | Only one value is offered: Password rotation. |
| Access Container | The full DN of the container is expected — for instance CN=admaccess@T4.local,OU=Access,DC=access. A warning in orange recalls it in the form. |
| Application name | Name of the service to create in the container. |
| Username / Domain | Read-only. The account is picked through the Properties icon, among the managed accounts; the domain and the DN then fill in by themselves. |
| Password / Confirmation | Disabled as soon as the selected managed account has already been rotated: its current password is held by the mechanism, there is nothing left to type. |
Edit an alias¶
Select the alias and click the Properties icon, or double-click the row. The Edit alias window offers the same fields; Alias, the choice of vault, the Mode, the Access Container and the Username can no longer be changed. Only aliases created in Systancia Access mode are edited here.
Delete an alias¶
Select one or more aliases and click ×. A confirmation is requested. The applications that relied on the alias see their SSO setting move from Fixed to Enabled.
Force password renewal¶
Select one or more aliases and click Force password renewal. A confirmation is requested. The button is only active if the selected aliases are associated with an enabled rotation policy.
Keeper vault¶
The Keeper vault module browses a tree of Keeper folders and displays the aliases they contain. It serves for consultation only: creating, editing and deleting happen on the Keeper side.
Configure the access¶
The Configuration toolbar button asks for a single item.
| Field | Description |
|---|---|
| Access token | Mandatory. Keeper API token allowing folders and records to be read. |
A token refused by Keeper leads to an explicit error message.
Review the aliases¶
Once the configuration is accepted, the screen splits into two panels: on the left the folder tree loaded from Keeper, with a refresh button in the footer; on the right the alias list of the selected folder, with the Alias, Type and Description columns, and a search field filtering the current folder.