Package: dss-sdk
dss-sdkA better SDK for Delinea Secret Server.This is an SDK and CLI for interacting with Delinea Secret Server. The CLI usesTyper,
and the SDK useshttpx. Both usePydanticfor
data serialization from the Delinea APIs.Table of ContentsInstallationUsageCLISDKRoadmapContributingInstallationTo install, ensure Python 3.8+ is installed and run:pipinstalldss-sdkorpipinstall--userdss-sdkdepending on available permissions.UsageThis small package contains two-fold purpose. The first is a command line tool you can use to interact with your Delinea
Secret Server. This is done via thedsstool in your terminal. The second purpose is for those wanting to perform a
bit more automation or complicated tasks with Delinea SS. This is done viaimport dssin your Python code.ThedssCommand Line ToolAfter installation, the tool should immediately be available in your terminal. If not, you either need to close your
terminal and re-open, or ensure your pythonScriptspath is in yourPATH.Runningdss --helpgives you the following:Usage:dss[OPTIONS]COMMAND[ARGS]...DelineaSecretServerCLI.

╭─Options────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│*--serverTEXTTheFQDNofyourDelineaSecretServer.[envvar:DELINEA_SERVER][default:None][required]│
│--client-idTEXTTheclientIDregisteredwithyourDelineaserver.[envvar:DELINEA_CLIENT_ID][default:None]│
│--client-secretTEXTTheclientsecretforthespecifiedclientIDregisteredwithyourDelineaserver.[envvar:DELINEA_CLIENT_SECRET][default:None]│
│--windows-credentialTEXTThenameofaWindowsCredentialcontainingtheClientIDandClientSecret[envvar:DELINEA_WINDOWS_CREDENTIAL][default:None]│
│--version│
│--install-completionInstallcompletionforthecurrentshell.│
│--show-completionShowcompletionforthecurrentshell,tocopyitorcustomizetheinstallation.│
│--helpShowthismessageandexit.│
╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
╭─Commands───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│get-secretGetsasecret.│
│register-clientRegistersanewclientwithyourserver.│
│search-secretsSearchavailablesecretsusingvariousparameters.│
│store-windows-credentialStoresClientIDandClientSecretinWindowsCredentialManager.│
╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯Main OptionsOption:--serverThe--serveroption is required, or you can specify an environment variable calledDELINEA_SERVERthat is the name
of your Delinea instance. Let's assume it'stest.secretservercloud.com. You can either use it like:dss--servertest.secretservercloud.comor you can export the environment variable:# Mac / LinuxexportDELINEA_SERVER='test.secretservercloud.com'# Windows$env:DELINEA_SERVER='test.secretservercloud.com'If you export the environment variable, you do not need to provide the--serveroption in the command line.Option:--client-idand--client-secretWhen using these options, they're both required to be set. You can acquire a Client ID and Secret using theregister-clientcommand. Just like with--server, you can specify the options before
the command, or export the environment variables:dss--client-idtest-id--client-secretsome-test-super-secretor you can export the environment variable:# Mac / LinuxexportDELINEA_CLIENT_ID='test-id'exportDELINEA_CLIENT_SECRET='some-test-super-secret'# Windows$env:DELINEA_CLIENT_ID='test-id'$env:DELINEA_CLIENT_SECRET='some-test-super-secret'This is what the CLI will use to acquire an OAuth2 token from your Delinea instance and subsequently use the token to
auth the API calls.Option:--windows-credentialNOTE: This will ONLY work on a Windows machine.When providing this option, you don't need to provide the Client ID or Client Secret via the command line or environment
variables, as it will access them via a Windows Credential. You can store your credentials in Windows Credential Manager
using thestore-windows-credentialcommand.CommandsThe commands are how you interact with the Delinea Secret Server from the CLI.Command:register-clientUsage:dssregister-client[OPTIONS]Registersanewclientwithyourserver.

╭─Options───────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│*--service-accountTEXT[default:None][required]│
│*--onboarding-keyTEXT[default:None][required]│
│--descriptionTEXT[default:DelineaPythonSDK]│
│--store-in-windowsStoretheregisteredclientIDandsecretasWindowscredentials.│
│--output-format[table|json|clipboard][default:clipboard]│
│--helpShowthismessageandexit.│
╰─────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯You need to get your service account and onboarding key from your security team or create them in Delinea, if you have
access. Then you can use them to create a Client ID and Client Secret via:dssregister-client--service-accountmyServiceAccount--onboarding-key1234567890abcdefgYou can specify a--descriptionwhich will show up in Delinea as a registered client. It'sDelinea Python SDKby
default. If you specify the--store-in-windowsboolean flag, it will store it as a Windows Credential under the namedss-cli-client.By default, all secrets are exported to your clipboard and are not printed in the console. You can change this behavior
by specifying and--output-formatofjsonfor a JSON output ortableto print them in a pretty table.Command:store-windows-credentialUsage:dssstore-windows-credential[OPTIONS]StoresClientIDandClientSecretinWindowsCredentialManager.

╭─Options──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│*--client-idTEXTTheclientIDregisteredwithyourDelineaserver.[default:None][required]│
│*--client-secretTEXTTheclientsecretforthespecifiedclientIDregisteredwithyourDelineaserver.[default:None][required]│
│--nameTEXTThenametouseinWindowscredentials.[default:dss-cli-client]│
│--helpShowthismessageandexit.│
╰────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯This command can be used to store your Client ID and Client Secret in Windows Credential Manager via:dssstore-windows-credential--client-idtest-id--client-secretsome-test-super-secretYou can also change the name by using the--nameoption, like:--name MyDelineaCreds. Just be sure to provide that
name when specifying--windows-credentialorDELINEA_WINDOWS_CREDENTIAL.You could also use it to store any credential in the Windows Credential Manager, just remember that the--client-idis
the username and--client-secretis the password.Command:search-secretsUsage:dsssearch-secrets[OPTIONS]Searchavailablesecretsusingvariousparameters.

╭─Options──────────────────────────────────────────────────────────╮
│--recent│
│--search-textTEXT[default:None]│
│--folder-idINTEGER[default:None]│
│--secret-template-idsINTEGER[default:None]│
│--helpShowthismessageandexit.│
╰────────────────────────────────────────────────────────────────────╯You can specify no other options, and it will output a table of all the secrets to which the service account has access.
However, you can provide the--recentboolean flag to search only through the recently used secrets, the--folder-idto search for secrets only in that folder,--secret-template-idsto search only for secrets that use a specific
template (you can specify it multiple times for multiple template IDs), or--search-textto look for secrets that
contain text in various places (name, attribute, slug, etc.).Commandget-secretUsage:dssget-secret[OPTIONS]SECRET_IDGetsasecret.

╭─Arguments──────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│*secret_idINTEGER[default:None][required]│
╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
╭─Options────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
│--include-usernameIncludetheusernameintheoutput(Doesnotcopyusernametoclipboard).│
│--output-format[table|json|clipboard]Outputasatable,JSON,orcopytoclipboard.[default:clipboard]│
│--helpShowthismessageandexit.│
╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯This is self-explanatory. Provide theSECRET_IDto get that secret. You can add the--include-usernameboolean flag
to have it print out the username tied to the secret, otherwise it just gets the "password" value. You can specify the
output here, as well, just like in theregister-clientcommand.ThedssSoftware Development KitFor those that need to do complex logic, or automation, the SDK can provide the same means as the CLI, but in Python
classes.Search Secrets Examplefromdss.serverimportSecretServerClientsearch_text="Some Text"username="my-user"ss=SecretServerClient(server="test.secretservercloud.com",client_id="test-id",client_secret="some-test-super-secret")secrets=ss.search_secrets(params={"filter.searchText":search_text,})forsecretinsecrets:print(secret.name,secret.id)Get Secret Examplefromdss.serverimportSecretServerClientsecret_name="my-secret"ss=SecretServerClient(server="test.secretservercloud.com",client_id="test-id",client_secret="some-test-super-secret")secret_id=ss.get_secret_id(secret_name=secret_name)secret=ss.get_secret(secret_id=secret_id)# Do something with the secret...RoadmapCreate testsFor SDKAnd CLIBuildAsyncclientImplementset_secret()For SDKAnd CLISupportpasswordgrant type?ContributingIf you'd like to contribute, please for the repo and create a pull request!Back to Top