I am looking for an "enterprise password management"/password vault suite, along the lines of Thycotic's Secret Server. (We're evaluating password management/password vault solutions for our enterprise, and my boss would like me to evaluate at least two products.)
What we need is a way to share passwords within the IT department (at least), and then manage them as people join or leave. We were using a password protected spreadsheet, until we "upgraded" to KeePass (a lateral move, really). With thousands of passwords, I'm simply not willing to go through what we had to do last time a sysadmin left, which was "change all the passwords in the environment. NOW!!!"
I have four requirements:
- Must support encryption of the entire database/collection
- From above, even an Excel spreadsheet or SharePoint site supports this, so easy requirement.
- Must allow granular access control to entries or groups of entries
- Must be able to restrict a particular password or grouping/folder/etc. to a specified person or group of people.
- For example, credentials for accounts with domain admin rights can only be viewed by the domain admins, but the network gear credentials can only be viewed by the network admins.
- Must be able to restrict a particular password or grouping/folder/etc. to a specified person or group of people.
- Must not be cloud-based, as in it must be something we can install on our servers, as well as access and manage internally.
- Not negotiable, due to management (rather than technical) concerns about the cloud and some other company potentially having access to our passwords and such.
- Can import data from standard data formats (xml, csv, xls(x) or KeePass)
Highly desirable features are:
- AD/LDAP integration
- Easy auto-logon/one-click-logon (or ability to integrate with something that does
- For example, ability to launch SSH client and auto-logon from a stored router password, or ability to launch RDP and logon to a Windows server from a stored Windows server password.
- Ability to change passwords from within the application
- Ability to expire or track expiration within the application
- For compliance reason, we have to change the passwords on many of our service accounts at certain intervals, and I would like to track this within our password management suite.
- Templates/ability to handle other data types
- Credit cards and vendor support PINs, for example.
- Ability to create password templates
- Auditing user activity
- Reporting (who has access to what)
I have no particular preference regarding (F)OSS or proprietary solutions, and not much concern to price - cheaper is better, but better is much better than cheaper.
