Add Nested Shared Folder (NSF) support to CyberArk PAM import by pvagare-ks · Pull Request #2233 · Keeper-Security/Commander

pvagare-ks · 2026-07-20T13:12:03Z

Summary

Adds --nsf to pam project cyberark-import so CyberArk migrations can create project folders, records and PAM configuration under Nested Shared Folders instead of classic shared folders.

Changes

Added pam project cyberark-import <cybeark_tenant> --nsf command for creating nsf folders, pam records and pam config

adeshmukh-ks · 2026-07-23T10:03:53Z

            "--platform-map", "map.json",
            "--state-filter", "active,inactive",
            "--no-verify-ssl",
+            "--nsf",


use nsf as default and add classic flow as a flag

adeshmukh-ks

if possible change the code to make nsf as default flow and classic folder flow to be on using a flag

…rated from proto. Fixed bug where pamGitHubConfiguration was not recognized as a PAM configuration type. Added tests.

* KC-1407: Add terraform-app-setup with Min-Commander-Version gate (#2299) * Add terraform-app-setup with API v2 defaults and Min-Commander-Version gate * Change error message * Separate commands as tuple and improve test cases * Update container name to include terraform * Fix for review comments * Add min-commander-version gate to terraform container

The pykeepass add_entry method will unconditionally check for duplicates with xpath, which breaks if there are quotes in the record title. Fixed the issue by replacing the add_entry method with a custom keepass_add_entry function.

…AM tunnel/connection edit (#2298) * Fix NSF nsf-record-update RS_OUT_OF_SYNC after PAM tunnel/connection edits Keep nested_share_records and record_cache revisions aligned after PAM and classic sync so NSF updates no longer send a stale revision. Route PAM connection/RBI/split updates through update_pam_record and retry once on RS_OUT_OF_SYNC. * Fix review issues for NSF PAM record update sync Keep NSF permission caches after classic sync, mark classic PAM edits for resync, and safely retry stale-revision updates. * Addressed review comments: safe RS_OUT_OF_SYNC retry and revision max in sync Pass field overrides to nsf-record-update instead of merged data; do not retry whole-record payloads. Scope sync fallback to ImportError, use max() for classic NSF revision, and add concurrency/retry tests.

…et-node to import --format=cyberark command

…direct --send-email SMTP (#2296) * Require ownership when resolving email-config by title Shared-in records titled like an email config could redirect record-add --send-email SMTP delivery. Only owned configs are eligible now, and missing configs fail with a clear error. * Filter email-config list to owned configs only, clarify the non-owned warning text, and cover record-add / pam rotate not-found paths. * Harden email-config ownership checks and regression coverage * Rename GChat one-time-share command ID to external share and add create-secret. Replace chat_command_one_time_share_id with chat_command_external_share_id (/keeper-external-share, default 3), add chat_command_create_secret_id (/keeper-create-secret, default 4), and update setup prompts, vault fields, README, and unit tests. * Drop unsafe account_uid ownership check in email-config lookup The account_uid equality fallback could treat shared-in records as owned when sync_down stored the current user's UID as a display fallback. Use owner.owner and meta_data_cache only, and add a regression test for RecordOwner(False, current_uid).

…d/update. * Handle NSF record fields the same way as classic add/update. * Update unit tests * Fix for review comments * Resolve merge conflicts * Fix review comments * Change error message

The Vault UI allows two options for exporting: exporting only owned records or owned+shared records. Adding this choice to Commander's export command.

The Vault UI allows you to export owned or owned+shared records. The Commander export only allows you to export owned_shared records. Adding support for --owned-only flag, which provides parity between Vault and Commander

…2312) * Fix pam project export by discovering from project folders * Add warning messages * Fix review comments * Add lazy user title index

…er reuse (#2308) * Grant NSF project folders to the KSM app on pam project import/extend * Reuse pre-existing NSF PAM root folder instead of creating a duplicate * Refresh cached record revision after update to avoid RS_OUT_OF_SYNC

pvagare-ks requested review from adeshmukh-ks and sali-ks July 20, 2026 13:12

pvagare-ks self-assigned this Jul 20, 2026