Keeper
Connect Keeper to Ploy to see every Keeper user on a node, whether their account is locked, and which Keeper teams and roles they belong to. Ploy can also invite users, lock and unlock them, and add people to or remove them from teams and roles.
The Keeper integration is in beta. It was built from Keeper's published provisioning documentation and has not yet run against a live Keeper account, so some behaviour may differ from what this guide describes until it has.
Before you start
You need a Keeper Business or Enterprise account and a Keeper administrator who can manage provisioning on the node you want to connect.
Ploy connects to one Keeper node per connection. Users on that node's sub-nodes are not included; connect each sub-node separately if you need them.
To invite users from Ploy, the email domain they use must already be reserved to your Keeper account.
Step 1: Agree to the beta terms
On the first page of the Keeper setup in Ploy, tick the beta consent box. While the integration is in beta, when Keeper rejects a request Ploy records the error it returned, with personal details such as names, email addresses and tokens removed, so we can fix problems quickly. Nothing else about your Keeper data is shared.
Step 2: Create a SCIM provisioning method in Keeper
Sign in to the Keeper Admin Console.
Select the node whose users Ploy should see.
Open the Provisioning tab and add a new method, choosing SCIM.
Keeper shows a SCIM base URL and a Provisioning Token. Copy both now.
Save the provisioning method. Keeper's own test button only works after the method is saved.
Keep the token somewhere safe until Step 3. If you edit this provisioning method later, Keeper issues a new token and the old one stops working, so you would need to paste the new token into Ploy.
Step 3: Connect Keeper in Ploy
In Ploy, go to Integrations, find Keeper and click Connect.
Paste the SCIM base URL. It looks like
https://keepersecurity.com/api/rest/scim/v2/1234567, with your own data centre and node number.Paste the Provisioning Token.
Click Test connection, then finish the setup.
Ploy reads your Keeper users and teams within the hour.
What Ploy reads
Users: every Keeper user on the connected node, with their email address and whether their account is locked. A locked user is shown as having no access to Keeper.
Teams and roles: every Keeper team on the node, and every Keeper role your provisioning is set up to manage, with their members.
Keeper's provisioning connection does not report sign-in history, two-factor status or licence usage, so Ploy does not show these for Keeper.
What Ploy can change
Invite a user: Keeper emails them an invitation, and their vault exists once they accept it. If the email already belongs to a Keeper user on this node, Ploy treats them as already invited.
Lock and unlock a user: a locked user cannot sign in, and their vault is kept. Keeper does not allow provisioning tools to delete users, so locking is how Ploy removes access. A Keeper administrator can delete a user permanently in the Admin Console.
Add people to and remove them from teams and roles: from the team or role's page in Ploy. Keeper holds new memberships in its approval queue until an administrator, a team member or Keeper Automator approves them.
Troubleshooting
"Keeper rejected that Provisioning Token": the token was mistyped, or the provisioning method was edited and a new token issued. Copy the current token from Keeper and test again.
"Keeper could not find SCIM at that URL": copy the SCIM base URL again from the provisioning method in Keeper.
A user is missing: check they are on the connected node and not on a sub-node.
Inviting a user fails with a licence message: your Keeper account has no free licences. Add licences in Keeper and try again.