Integration with KeeperPAM

Step by step instructions for integrating KeeperDB with KeeperPAM

Overview

KeeperDB integrates with KeeperPAM to provide managed, audited database access. Users launch database sessions without handling credentials, and admins keep full policy control, session visibility, and reviewability.

Key capabilities

• Fully audited database sessions

• Passwordless access with workflow, approvals, and check-in/check-out

• Zero standing privilege with just-in-time access

• Embedded visual sessions or CLI access

Prerequisites

An active KeeperPAM license is required. KeeperPAM is available for both business and enterprise customers.

• KeeperPAM Homepage

• Request a Demo

• Contact Support

Before you configure KeeperDB access, make sure you have:

• Reviewed Getting Started

• Deployed a Keeper Gateway

Visual walkthrough

These steps show the manual setup flow. You can also import resources with Keeper Commander CLI.

Create a PAM Database record

In the Keeper Vault, open a shared folder that is provisioned to a Gateway. Then create a PAM Database record.

This example uses a Microsoft SQL Server database.

Enter the basic connection details such as hostname and port. Then select Set Up to configure PAM settings. Make sure the correct Database Type is selected.

Configure rotation settings

If credential rotation is required, Keeper uses the linked Administrative Credentials record to connect and rotate the target credential over the configured port.

Configure connection settings

Enable the connection with the required database protocol. In this example, the protocol is SQL Server.

Enable session recording and key event capture. To activate KeeperAI threat detection for the session, enable all three session recording options.

Configure KeeperDB and CLI settings

The KeeperDB tab lets you allow CLI sessions, visual KeeperDB sessions, or both. If both are enabled, the user chooses the launch mode at runtime.

Session persistence is disabled by default. Each session starts fresh.

• If By User is selected, UI preferences and query state are retained for that user.

• If By Resource is selected, shared users reuse the same UI preferences and latest query state.

• By Resource also prevents simultaneous multi-user connections to that resource.

Configure just-in-time access

The JIT tab controls whether the session requires an ephemeral account or temporary privilege elevation.

Configure tunnel settings with KeeperDB Proxy

A local Keeper Tunnel can be created from the Keeper Desktop application when tunneling is enabled on the resource. If KeeperDB Proxy is also enabled, the Keeper Gateway injects the launch credentials into the connection stream without exposing them to the user.

This lets users connect with their preferred database tool, including the native KeeperDB application, without handling credentials directly.

Enable KeeperAI

If KeeperAI is enabled, all interaction with the database is recorded and monitored by the configured AI agent running on the Keeper Gateway.

• Learn more about setting up KeeperAI on the Gateway

Enable workflow controls

Enable workflow controls to enforce policies such as check-in/check-out, approvals, and MFA. Users shared to the record with launch access must follow the workflow policy configured on that record.

• Learn more about Keeper Workflow

Launch KeeperDB

When a user checks out the resource and launches KeeperDB, the session opens directly in the Vault. The connection is established through the Keeper Gateway without exposing the underlying credentials.

The query editor opens in the Vault and can be expanded to full screen.

The embedded session supports the same core features as the standalone app, including multi-sheet editing, query history, monitoring, and graph views.

Review session activity

If you have permission to review recordings, open the record details and go to Session Activity. This view shows all recorded database session activity for the resource.

Review the KeeperAI summary

KeeperAI generates a high-level summary and step-by-step analysis for the session. If you need more context, you can open the playback and review the full recording.