Add multiple applications - Bulk upload
You can upload multiple applications automatically into the Vault. Using the Bulk Upload feature, you upload a Comma Separated Values (CSV) file containing all the required details about applications into the Vault through the PVWA.
Bulk Upload overview
Based on a CSV input file, Bulk Upload creates the following environment in the Vault:
Creates or updates application IDs (users) according to the specified information.
Assigns authorizations to application IDs and Credential Providers in the relevant Safes.
Assigns application IDs and the Credential Providers to groups. In this case, authorizations to Safes will be assigned to the groups and not directly to the application IDs or Credential Providers.
The following permissions are required to add multiple applications using the Bulk Upload:
|
Location |
Description |
Permissions |
|---|---|---|
|
Vault |
To create application IDs (users) and specify access authorizations |
Manage users |
|
Safes |
In the Safe(s) where the accounts are stored and the Credential Provider and applications have access: |
|
CSV file
Application parameters that will be uploaded to the Vault are stored in a text file as Comma Separated Values (CSV). The first line in the file defines the names of the application properties. Every other line represents a single application and its property values, according to the properties specified in the first line.
By default, the authentication method for all the applications that are uploaded is based on the new authentication methods, with no credential files. Applications that already exist in the Vault and use credential files will be reconfigured for the new method if they are listed in the CSV file. None of their other configurations or restrictions will be changed, unless they are defined in the CSV file.
The application properties in the CSV file are listed in the table below. Any of the following values can be specified for each application property:
| Property value | Description |
|---|---|
|
Value |
The application property in the Vault will be defined according to the value that is specified in the CSV file, including authentication restrictions. For example, if the CSV file specifies only one application IP address, but the application restrictions in the Vault define IP addresses, after the CSV file is uploaded, the existing values will be deleted and only the new value will be defined. |
|
Empty |
New properties will not be defined or they will be assigned the default value. Existing application property values will not be changed. |
|
Clear |
New application properties will be left empty. The value of existing application property values will be cleared and the property will be left empty. |
|
To delete current path restrictions, write ‘CLEAR’ in any of the path restriction columns. Likewise, to specify a new path restriction, specify the new value in any of the path restriction columns. |
The following application properties can be specified for every application that will be uploaded to the Vault:
| Parameter | Description | ||
|---|---|---|---|
|
Application ID ( mandatory) |
The unique name (ID) of the application that will be created or updated. This name can contain up to a maximum number of 128 characters. Acceptable value: String |
||
| Application Description |
A description of the application. Acceptable value: String |
||
| Business Owner First Name |
The first name of the application’s business owner. Acceptable value: String |
||
| Business Owner Last Name |
The last name of the application’s business owner. Acceptable value: String |
||
| Business Owner Email |
The email address of the application’s business owner. Acceptable value: String |
||
| Business Owner Phone |
The phone number of the application’s business owner. Acceptable value: String |
||
| IP Restrictions |
The IP addresses or IP subnets where the application can run, separated by semicolons. IP subnets must be in CIDR format, IP/number, where:
Acceptable value: String |
||
| OS User Restrictions |
The Windows domain OS user(s) that are authorized to run the application. Acceptable value: String |
||
|
Path Restrictions (Non Recursive) |
The paths where applications can run. Separate multiple paths with semicolons. These paths are updated with “Allow internal scripts to request credentials on behalf of this application ID”= No and Path is Folder=No. Acceptable value: String We recommend always combining authentications with OS User or Allowed Machines authentication, or both. |
||
|
Path Restrictions (Recursive) |
The paths where applications can run. Separate multiple paths with semicolons. These paths are updated with “Allow internal scripts to request credentials on behalf of this application ID”= Yes and Path is Folder=No. Acceptable value: String We recommend always combining authentications with OS User or Allowed Machines authentication, or both. |
||
|
Folder Restrictions (Non Recursive) |
The paths where applications can run. These paths are updated with “Allow internal scripts to request credentials on behalf of this application ID”= No and Path is Folder=Yes. Acceptable value: String We recommend always combining authentications with OS User or Allowed Machines authentication, or both. |
||
|
Folder Restrictions (Recursive) |
The paths where applications can run. Separate multiple paths with semicolons. These paths are updated with “Allow internal scripts to request credentials on behalf of this application ID”= Yes and Path is Folder=Yes. Acceptable value: String We recommend always combining authentications with OS User or Allowed Machines authentication, or both. |
||
|
Hash Restrictions |
The unique hash values of the application. Specify multiple hash values with semicolons. For more information, refer to Generate an application hash value. To add more information in a comment after each hash value specified for an application, use ‘#’ after the hash value, followed by the comment. For example, You can add additional information in a comment after each hash value specified for an application by specifying ‘#’ after the hash value, followed by the comment. For example,
The comment must not include a colon or a semicolon. Acceptable value: String We recommend always combining authentications with OS User or Allowed Machines authentication, or both. |
||
|
Location ( mandatory) |
The location in the Vault hierarchy where the application will be created. The user uploading the CSV file must be on the same level or higher. Acceptable Values: Vault location |
||
| Disabled |
Whether or not the application user will be disabled. Acceptable values: Yes /No Default: No |
||
| Logon From |
The time from when the Credential Providers/Central Credential Providers can retrieve the password for this application. Acceptable values: Between 00:00 and 23:59. For example, 07:00. |
||
| Logon To |
The time until when the Central Credential Provider can retrieve the password for this application. Acceptable values Between 00:00 and 23:59. For example, 22:00. |
||
| Expiration Date |
The date that the application user will expire. Acceptable values: DD-MM-YYYY; must be today’s date or a future date. |
||
| Safes |
The Safes that the application and Credential Provider users will be given authorization to access. Acceptable values: Safe name |
||
| Application Groups |
The group to which the application user will be added. Specify an existing group. When a group is specified, the group will be assigned as an owner of the specified Safe(s) and not the application user. Acceptable values: Group name |
||
| Provider Groups |
The group to which the Credential Provider user will be added. Specify an existing group.
When a Provider Group is specified, the group will be assigned as an owner of the specified Safe(s) and not the Credential Provider user. Acceptable values: Group name |
||
| Providers |
The Credential Providers that will be authorized to retrieve passwords for this application. Each Credential Provider will be given access authorization for the same Safes and accounts as the application. Acceptable values: A Credential Provider that has already been installed and defined in the Vault. |
||
| Allow Extended Authentication |
When defined as Yes, the Credential Providers can enable you to specify an unlimited number of machines and Windows domain OS users for a single application. Acceptable values: Yes /No Default: No |
|
Groups, Safes, and Credential Provider parameters can be added in the CSV file only. Then, once the applications have been defined in the Vault, their properties can only be updated in the PVWA Application Details page. |
Application CSV file
You can create a file in Excel and save it in CSV format so that it can be uploaded to the Vault. Each column in the Excel file represents a different application property.
You can create a file in Excel and save it in CSV format so that it can be uploaded to the Vault. Each column in the Excel file represents a different application property.
-
In the PVWA, in the Applications tab, click Add/Update Applications; the Add/Update Applications dialog box appears.
-
Click Download sample CSV; the File Download window appears.
- Click Open to open the CSV file immediately,
or,
Click Save to specify where the file will be saved.
-
Use this sample CSV file as a basis for your own applications CSV file.
|
Do not change the order of the columns in the file. Most of the columns are not mandatory and can be left empty. |
-
Prepare a CSV file that contains all the applications to create in the Vault and their properties. For more information, refer to the table in the previous section.
-
Before uploading the CSV file, make sure that the user has the authorizations specified above.
-
In the PVWA, in the Applications tab, click Add/Update Applications.
The Add/Update Applications dialog box appears.
-
If you have not yet created a CSV file, you can download a sample to use as a basis.
To download a sample CSV file:
-
Click Download sample CSV; the File Download window appears.
-
Click Open to open the CSV file immediately,
or,
Click Save to specify where the file will be saved.
- Use this sample CSV file as a basis for your own applications CSV file.
-
-
Click Browse to select a prepared CSV file.
-
To run a simulated upload process before the applications are actually defined in the Vault, select Perform simulation step.
This process validates that the information specified in the CSV file can be successfully uploaded to the Vault.
-
Click Preview; if the CSV file is valid, the Add/Update Applications window will display the first 100 applications that are specified in the CSV file.
-
At this point, you can check the table of applications and their properties that is displayed to make sure that all the information required to define the applications correctly in the Vault is specified.
-
Click Continue to simulate the process that creates applications in the Vault; the Add/Update Applications Progress window displays the errors that occur during the simulation.
-
This information enables you make sure that all the Locations, users, groups, and other objects in the Vault are valid, and that they are specified correctly in the CSV file.
-
Click Continue to upload applications to the Vault,
or,
Click Cancel to cancel the process and modify the Vault environment or the CSV file.
-
If you click Continue, the PVWA will add or update the applications listed in the CSV file. The Add/Update Applications Progress window displays the status of the process as it occurs. This includes confirmation that applications have been defined successfully as well as errors.
-
You can download a complete log file of both the simulation process and the actual process at any time by clicking Download full log file. This file contains a full log of the actions that occurred during the process. It is deleted when you click Close.
-
Click Close to finish the process and close the Add/Update Applications window.
| The CSV file contains sensitive data; we recommend that you delete it immediately after use. |
