Bring identity governance to Keeper with SailPoint IdentityIQ and Identity Security Cloud. Aggregate accounts and entitlements, provision vaults, manage privileged access and offboard users from SailPoint while preserving Keeper's zero-knowledge encryption.
Govern access to privileged resources, such as credentials, servers, databases and cloud identities, all while maintaining Keeper's zero-knowledge encryption model. Through SailPoint, your team can manage identity lifecycle and enforce least-privilege access across Keeper's entitlement structure, including nodes, roles, teams, folders, and individual records, ensuring the right identities have access to the right resources at the right time.
Collect and list the entitlements available in your Keeper organization, with their permissions.
List users from your Keeper organization and map each one to their existing Keeper Vault entitlements.
Invite users from SailPoint, provision a Keeper Vault for each and assign their access.
Enable, disable or delete Keeper accounts and keep user details in sync.
An engineer requests access to "Production PostgreSQL" in SailPoint by selecting the entitlement associated with the database's Keeper record.
SailPoint routes the request to the designated approver based on your configured approval policies.
Once approved, the connector grants access to the database's Keeper record at the assigned permission level. The record appears in the engineer's vault.
Review the database entitlement through SailPoint access certifications. Confirm the engineer still needs access or revoke the entitlement when it is no longer required.
SailPoint manages Keeper accounts and entitlements through Keeper Commander Service Mode running on your infrastructure. The connector is restricted to approved governance operations, preserving Keeper's zero-knowledge encryption.
Administrative access to manage users, teams, roles and sharing across your organization.
API v2 running and reachable from SailPoint, set up in one flow with sailpoint-app-setup.
Permissions to create sources, configure correlation and run aggregations in Identity Security Cloud.
No, SailPoint never reads vault contents. Every operation runs through Commander Service Mode on your own infrastructure, and its allowlist blocks secret-bearing commands like get, export and find-password. Keeper's zero-knowledge model stays intact.
SailPoint connects to Keeper through Keeper Commander running in Service Mode on your infrastructure, using API v2. SailPoint never talks to Keeper directly. If Commander runs on a private network, expose it via ngrok or Cloudflare Tunnel and point the source to that HTTPS URL.
The connector can provision the full user lifecycle — invite, enable, disable and delete — plus roles, teams and record and folder shares. You decide which of these the connector may manage when you run setup; anything you disable is rejected with an HTTP 403.
There are five entitlement types supported: nodes, teams, roles, folders and records. Folder and record entitlements carry their own permission level and work with both classic and nested shared folders.
The connector transfers the departing user's vault to the target account you set during setup, then removes their Keeper account. Nothing they held is lost; it moves to the transfer target first.
チャットサポートを利用する場合、Cookie を有効にしてください。
