Using a CSV Template

Use CSV data and a JSON template to create validated KeeperPAM imports.

Choose an import path

Keeper Commander supports two CSV-to-JSON workflows:

1. CSV only creates bare pamMachine, pamDirectory, and pamUser records from the values in the CSV.

2. CSV with a JSON template applies shared connection, rotation, and PAM Configuration settings while the CSV supplies the machine- and user-specific values.

Use a JSON template for any import that must create usable SSH, RDP, or database connections. CSV-only imports do not infer a machine management port, operating system, session protocol, or credential mapping.

Validate before importing

Always validate the generated JSON before creating a PAM project:

pam project import --filename /absolute/path/pam_import.json --name "My PAM Project" --dry-run

Use an absolute file path. Do not rely on ~ expansion in the Commander command. Confirm that the dry run reports the expected number of resources and users before running the import without --dry-run.

For more validation and troubleshooting guidance, see Validate a PAM Project Import.

CSV-only imports

Required fields

The minimum CSV fields are:

hostname	username	user_path	password
DESKTOP-001.local
	Administrator	DESKTOP-001.local	REPLACE-BEFORE-USE

user_path identifies the resource that owns a user. The example creates a machine named DESKTOP-001.local and a nested PAM user named DESKTOP-001.local - Administrator.

A minimum CSV-only import creates a bare resource similar to this:

{
  "title": "DESKTOP-001.local",
  "type": "pamMachine",
  "host": "DESKTOP-001.local",
  "pam_settings": {
    "options": {
      "rotation": "off",
      "connections": "on",
      "tunneling": "off",
      "graphical_session_recording": "on"
    },
    "connection": {}
  },
  "users": [
    {
      "title": "DESKTOP-001.local - Administrator",
      "login": "Administrator",
      "password": "REPLACE-BEFORE-USE",
      "type": "pamUser"
    }
  ]
}

This record is not yet configured for an interactive connection or password rotation. Add the required advanced fields, or use a JSON template.

Do not use empty rotation settings

Omit rotation_settings when rotation is not configured. Do not use an empty object:

"rotation_settings": {}

In affected Commander versions, an empty object is interpreted as a rotation request. It can produce Failed to load rotation schedule warnings and stop the import while the first resource is processed. Supply a complete rotation configuration only when rotation is intended.

Some versions of pam_import_generator_v2.py emit an empty rotation_settings object for CSV-only output. Remove that property from the generated JSON before importing if you are not configuring rotation.

Configure usable machines with advanced CSV fields

A usable machine needs both a management port and an interactive session configuration:

• rs.port: management or rotation port, such as 22, 5985, or 5986.

• rs.operating_system: the machine operating system.

• rs.pam_settings.connection.protocol: interactive protocol, such as ssh or rdp.

• rs.pam_settings.connection.port: interactive session port, such as 22 for SSH or 3389 for RDP.

• rs.pam_settings.connection.administrative_credentials: a PAM user title or login used for administrative operations.

• rs.pam_settings.connection.launch_credentials: a PAM user title or login used to launch the connection.

• rs.pam_settings.connection.allow_supply_user: allow the session user to provide a username when no launch credential is selected.

Example: Windows machine with a WinRM management port and RDP session port.

hostname,username,user_path,password,rs.port,rs.operating_system,rs.ssl_verification,rs.pam_settings.connection.protocol,rs.pam_settings.connection.port,rs.pam_settings.connection.allow_supply_user,rs.pam_settings.connection.administrative_credentials,rs.pam_settings.connection.launch_credentials
DESKTOP-001.local,,,,5986,Windows,true,rdp,3389,true,DESKTOP-001.local - Administrator,DESKTOP-001.local - Administrator
,Administrator,DESKTOP-001.local,REPLACE-BEFORE-USE,,,,,,,,

Credential references must match a unique PAM user title or login. The CSV generator can de-duplicate repeated usernames globally, so use unique user titles and usernames when generating multiple local accounts.

Other fields can be applied with rs. for resources and usr. for users. Examples include:

rs.port
rs.operating_system
rs.pam_settings.connection.protocol
rs.pam_settings.connection.administrative_credentials
usr.distinguished_name
usr.rotation_settings.enabled

folder_path is only used by pam project extend; it is ignored by pam project import.

CSV with a JSON template

Use a JSON template when machines share configuration. The template defines the project, PAM Configuration, and default machine settings; the CSV supplies host- and user-specific values.

Your machine template should include complete connection settings. For example:

{
  "type": "pamMachine",
  "title": "xxx:server",
  "host": "xxx:server",
  "port": "5986",
  "ssl_verification": true,
  "operating_system": "Windows",
  "pam_settings": {
    "options": {
      "rotation": "on",
      "connections": "on",
      "tunneling": "on",
      "graphical_session_recording": "on"
    },
    "connection": {
      "protocol": "rdp",
      "port": "3389",
      "allow_supply_user": true,
      "administrative_credentials": "Example AD.DomainAdmin",
      "launch_credentials": "Example AD.DomainAdmin",
      "security": "any",
      "ignore_server_cert": true
    }
  },
  "users": [
    {
      "type": "pamUser",
      "title": "xxx:admin",
      "login": "xxx:Administrator",
      "password": "REPLACE-BEFORE-USE"
    }
  ]
}

Replace values beginning with XXX: with your static configuration. Values beginning with xxx: are placeholders replaced from CSV data. Use the complete template in Importing PAM Resources when your import also includes a PAM Directory or shared credential configuration.

Run the conversion

Download pam_import_generator_v2.py and save it with your CSV and, if used, import_template.json.

python3 pam_import_generator_v2.py --input-file servers_to_import.csv --output-file pam_import.json

For a JSON template:

python3 pam_import_generator_v2.py --input-file servers_to_import.csv --template-file import_template.json --output-file pam_import.json --prefix-names

Before creating the project, run the generated file with --dry-run as shown above.