SaaS Plugins
Automate password rotation for SaaS applications and custom integrations.
KeeperPAM SaaS Rotation Plugins
Overview
KeeperPAM supports automated password rotation for SaaS applications and cloud infrastructure. SaaS rotations are available as built-in integrations, catalog integrations or custom integrations.
Built-in SaaS Integrations
KeeperPAM includes pre-built integrations for the following services:
Okta — Identity and access management
Snowflake — Cloud data platform
AWS Access Keys — Amazon Web Services credential rotation
Azure Client Secrets — Microsoft Azure application secrets
Check Point Gaia OS — Network security appliance management
Cisco IOS XE — Network device management
Cisco Meraki — Cloud-managed networking
REST APIs — Generic REST endpoint integration
Catalog SaaS Integrations
Additional rotation plugins are available in Keeper's SaaS Github Repository:
AWS Cognito — User pool credential rotation
Cisco APIC — Application policy infrastructure controller
Elastic API Key — Elasticsearch API key rotation
Elasticsearch Service Account Token — Service account token rotation
Elasticsearch User — Elasticsearch user password rotation
JFrog Access Token — JFrog platform token rotation
JFrog User Password — JFrog user credential rotation
OpenSearch User — OpenSearch user password rotation
Oracle Identity Domain User — Oracle Cloud identity credential rotation
ServiceNow User — ServiceNow user password rotation
Splunk Token — Splunk authentication token rotation
Splunk User Password — Splunk user credential rotation
and More
As new catalog integrations are added, customers can use them within their environments.
Custom Integrations
Customers can create their own rotation plugins following the examples in Keeper's SaaS Github Repository,. Custom plugins are private and only available to the customer's Keeper Gateway.
For more information, see the Using Custom Plugins section.
Prerequisites
Prior to configuring Workflow, make sure to have the following:
Rotation Enforcement Policy
Enforcement policies for KeeperPAM are managed in the Keeper Admin Console under Admin > Roles > Enforcement Policies > Privileged Access Manager.
The following Enforcement Policies affect user's permissions to configure Rotation settings on PAM Record types and need to be enabled:
Can configure rotation settings
Allow users to configure Rotation settings on PAM User and PAM Configuration Record Types
Rotation configuration Enforcement Policy can also be enabled on the Keeper Commander CLI using the enterprise-role command:
Setting Up SaaS Password Rotation
To set up SaaS rotation, you need to create a SaaS Configuration record, create a PAM User record with the credentials to rotate, and link them together.
Create a SaaS Configuration Record
Click Create New and select SaaS Configuration.
Configure the following fields:
Select Folder
The shared folder where the SaaS Configuration record will be stored. This shared folder must be part of the KSM application associated with the gateway performing the rotation.
PAM Configuration
Select the configuration with the gateway that will perform the rotation. Only configurations associated with the KSM application containing the selected shared folder will appear.
Plugin
Choose the type of SaaS rotation (e.g., AWS Access Key, Okta).
Title
A name for the SaaS Configuration record.
This creates a login record with pre-populated custom fields based on the selected plugin. Each plugin requires specific fields which appear as custom fields on the record.
For detailed information on the custom fields for each plugin, visit SaaS Configuration Field Reference.
Create the PAM User Record
Create a PAM User record containing the credentials or secrets to be rotated. For example, a PAM User for Okta would contain the username and password, while a PAM User for AWS would contain the access key and secret.
Note: This step can be skipped if you already have a PAM User Record
Configure the PAM user with the SaaS Configuration Record
Open the PAM User record and edit the PAM Settings.
Configure the following fields:
Rotation Profile
Select SaaS User as the rotation profile.
PAM Configuration
Select the PAM Configuration that contains the gateway performing the rotation. This is the same configuration your selected when creating a SaaS Configuration Record
SaaS Configuration
Select the SaaS Configuration record you created
Rotation Schedule
(Optional) Set a schedule for automatic credential rotation.
Password Complexity
(Optional) Define password complexity requirements for rotated credentials.
Rotate The PAM User
The PAM User is now ready for rotation. Credentials can be rotated on-demand or automatically based on the configured schedule.
SaaS Configuration Record Details
Each selected plugin creates a login record with custom fields specific to that integration. All fields are blank by default and must be configured before rotation can be performed.
For detailed information on the custom fields for each plugin, visit SaaS Configuration Field Reference.
Custom and Community Plugins
Customers can extend SaaS rotation beyond built-in and catalog integrations by deploying custom plugins. Keeper maintains a GitHub repository with community-contributed plugins, development tools, and templates. Custom plugins are private to the customer's Keeper Gateway.
For setup instructions, development guides, and best practices, visit Custom and Community Plugins.
SaaS Rotation via Commander
SaaS rotation can also be configured, managed, and executed through Keeper Commander.
For more information, visit SaaS Rotation via Commander.
Last updated
Was this helpful?