Integrate Password Management andZero-Knowledge Security Into Your Single
Sign-on Solution With Keeper SSO Connect™

REV 2.18.21© 2021 Keeper Security, Inc.

1

EXECUTIVESUMMARY
Employees’ inability to keep track of all the passwords
they need to do their jobs harms productivity,
wastes money, and complicates identity and accessmanagement (IAM) and security throughout theenterprise.
Single sign-on (SSO) solves some of these problems but
still leaves organizations with significant logistical andsecurity gaps. Keeper SSO Connect fills these gaps byextending SSO deployments with an integrated
zero-knowledge password encryption system thatprovides advanced password management, sharing,and security capabilities.

Keeper SSO Connect
fills IAM security
gaps by extending
SSO deploymentswith integrated
zero-knowledge
password encryption.

© 2021 Keeper Security, Inc.

2

BENEFITS OF IMPLEMENTING
SSO IN THE ENTERPRISE

Eliminating Password Fatigue

Enhancing Productivity

Instead of having to keep track of dozens
of different passwords, employees have tomemorize only one.

On average, employees devote nearly 11hours every year to entering and resetting
passwords. By simplifying access toresources, SSO helps keep users productive.

Minimizing Help Desk Tickets

Supporting Identity Accessand Management (IAM)

The Gartner Group estimates that up to
50% of help desk support calls are forpassword resets, and the average labor
cost to address one password reset is $70.
Greatly reducing or eliminating password
reset tickets saves money and frees up help
desk employees to focus on more complex
support tasks.

SSO is a common component in enterprise
IAM stacks. SSO simplifies and speeds up
IAM deployment by enabling administrators
to easily configure strong authenticationand other access controls. Administrators
also gain visibility into user accessthroughout the SSO deployment.

Supporting Zero-Trust
Environments

Supporting Compliance
Reporting

By simplifying and speeding up IAM
deployments, SSO supports zero-trust
environments, which require strong
authentication for all users.

SSO systems are an easy way to extend
audit and reporting capabilities to include
user sign-on data, which is required bymany compliance frameworks.

© 2021 Keeper Security, Inc.

3

SSO SHORTCOMINGS
For all the benefits of SSO, it’s not a panacea. SSO
solutions leave significant security and functionality
gaps. Ironically, these gaps involve the very problem
that businesses seek to solve with SSO: password
management and security.

A Single Point of Failure
One of the biggest shortcomings of SSO platforms isthat they’re a single point of failure. If a user forgets
their password, they’re locked out of multiple sites andapps instead of just one. Conversely, if a user’s password
is compromised, cybercriminals can access multiple
systems instead of just one.

Incompatible Apps and Services
The typical organization uses anywhere from several
hundred to several thousand cloud apps. In addition
to business productivity applications that everyonein the company uses, specific departments and teams
utilize their own subsets of job-specific applications.
These frequently include legacy line-of-business (LOB)
apps that don’t support SSO but that aren’t feasible torefactor or replace because they contain essential dataor perform critical business functions.

No Visibility or Control Over User
Password Habits
Left on their own to keep track of passwords for nonSSO accounts, individual users and teams come up
with their own systems, such as storing passwords
in text files or spreadsheets or writing them down on
sticky notes. These “homemade” solutions are neither
efficient nor secure. Users may also engage in poor
password practices, such as using weak passwords,
reusing passwords across accounts, sharing passwords
without authorization, and not enabling multi-factor
authentication (2FA).
As a result, despite having invested in an SSO
deployment, organizations are left vulnerable
to password-related data breaches -- especiallysince administrators have no visibility or control
over password usage in these sections of the dataenvironment. They’re unable to enforce security policies
such as using a strong, unique password for non-SSO
accounts or enabling multi-factor authentication (2FA)
on all accounts that support it.

© 2021 Keeper Security, Inc.

4

KEEPER SSO
CONNECT...
Easy to deploy and scale

Supports passwordless strategies

Extends to thousands ofusers and endpoints

Seamlessly Integrates with any IdP,
in Any Data Environment
Keeper SSO Connect is a fully-managed SaaS solutionthat can be used without deploying any on-premise orcustomer-managed components. It is hosted and managed
by Keeper Security while maintaining zero-knowledgearchitecture.

Keeper Integrates with All Major
Identity Providers

Azure ADand O365

Active Directory
Federated Services

Microsoft 365

GoogleWorkspace

Okta

OneLogin

DuoCentrify

JumpCloudPing

F5 BIG-IP APM

And More!

© 2021 Keeper Security, Inc.

5Two-Step Setup for Rapid Deployment
Keeper SSO Connect doesn’t require any on-premises orcustomer cloud-hosted services, nor does it require any
additional software or equipment. Setup is accomplishedin two easy steps:
Step 1: Enable and configure the Keeper
Application within the IdP
Step 2: Configure SSO Connect within the Keeper
Admin Console

Streamlined Login Flow Promotes
Efficiency & Enhances Security
Keeper SSO Connect’s streamlined login flow promotes
efficiency by simplifying end user login. If Keeper
recognizes an end user’s email domain as an SSOenabled enterprise, the user will be automatically routed
to their identity provider. When combined with SCIM
auto-provisioning or Just-In-Time (JIT) provisioning,onboarding new users is fast and secure.

Proprietary Security Model Ensures No
One Can Access User Login Credentials
Keeper SSO Connect utilizes client-side generated
ECC (Elliptic Curve Cryptography) private/public key
pairs for seamless, secure integration with SSO identity
providers. By using device-level ECC keys to protectuser vaults, Keeper maintains zero knowledge while
offering a fully cloud-based SSO integration. All data intransit and at rest is encrypted and cannot be viewed byany outside party, not even Keeper Security employees.

Secure and Streamlined Device
Approvals Support Zero-Trust Security
Device authorization is a core component of a zerotrust security model. With Keeper SSO Connect, every
approved user device has a local, private, ECC key. With
Keeper’s advanced zero-knowledge encryption, keys
are securely exchanged between the user’s devices,or through Keeper administrator approvals. Device
approvals can also be automated.
Organizations can configure push-based device
approval to be performed one of two ways:

Keeper + SSO = 100% Coverage
Use Case

KeeperEnterpriseSSO Identity
ProviderBy an administrator who holds “ApproveDevice” permissions

Password-Based Apps
Shared Passwords & Secrets

Via an automated approval method(the Keeper Admin Console, the Keeper
Commander CLI, or an Azure function)

Encrypted Data Storage
Social Media Sites
Native Apps
Offline AccessMulti-Layered,
Zero-Knowledge
SSH Keys & SSL Certs
API Credentials
Encrypted Private Files
Zero-Knowledge Encryption

SAML-Based Apps

via Keeper
SSO Connect© 2021 Keeper Security, Inc.

6

End-to-End Password Management Across the Enterprise
Keeper SSO Connect gives your administrators access to all of the capabilities of the top-rated
Keeper password management platform, including:
Personalized onboarding and 24/7 support andtraining from a dedicated support specialist

Provision secure shared folders, subfolders,and passwords for teams

Support for RBAC, 2FA, auditing, event reporting,and multiple compliance standards, including
HIPAA, DPA, FINRA, and GDPR

Enable offline vault access when SSO is
not available
Dynamically provision vaults through SCIM

Specify password complexity requirements, suchas maximum/minimum password lengths andinclude/exclude special characters

Protect against the dark web andcredential-stuffing attacks

Your end users benefit from features that help them optimize their workflows and improve theirpassword security, including:A secure digital vault that can be accessed fromany device, running any OS

Login credential autofill that works on any
website or app

Automatic password generator

Secure storage for sensitive files, documents,photos, and videos on unlimited devices

Seamlessly Provision Keeper Enterprise Across Your Entire Organization in a Few Hours

IDPSCIM
EPM Platform
Zero-Trust + Zero-Knowledge

All SAML-Based
IdPs Supported

Seamless
Integration

SAML 2.0

Encrypted
Sync

SAML 2.0

Encrypted
Data KeyEnd User Device
Mobile, Desktop, Web

Encrypted
Storage

TLS + PROTOBUF

256-bit AES
Elliptic-Curve Crypto© 2021 Keeper Security, Inc.

7

CONCLUSION
SSO platforms are designed to solve security and functionality problems related to user passwords, but unlessorganizations also invest in a password management solution, they are left with significant security and functionality
gaps. Keeper SSO Connect bridges these gaps by extending SSO deployments with comprehensive passwordmanagement and encryption through the top-rated Keeper password management platform.
Keeper SSO Connect works with any tech stack and seamlessly integrates with all popular IdP platforms. Deployment issimple and fast. The platform improves usability for end users, provides administrators with visibility and control over
employee password practices, enhances employee efficiency, eliminates password-related help desk tickets, and helps
organizations prevent password-related data breaches.

keepersecurity.com | sales@keepersecurity.com©
©20202021©Keeper
2021 KeeperSecurity,Security,
Inc.
Inc.
8