DOCSEARCHbyAlgolia
Submit Docs

Psono Password Manager Documentation

website·Indexed 38 days ago

https://doc.psono.com

Documentation for the Psono Password Manager, including installation guides for the server, mobile app, and fileserver. It covers administrative configuration for SSO via SAML, OIDC, and LDAP, environment variable setup, and the Psono version v1 API. Additionally, it provides details on the Psono Kubernetes Operator for synchronizing values into Kubernetes Secrets.

Tokens
105.7K
Snippets
454
Records
745
Agent score
66%

What's inside Psono

  1. Overview of Psono Password Manager Architecture

    Psono is composed of two primary components: a client and a server. The server acts as the core system, handling logic and data storage. The client is the user interface used to access and manage data. A critical security feature of Psono is that all secrets (including passwords, notes, and bookmarks) are encrypted locally on the user's PC within the browser before being transmitted and stored on the server.

  2. Overview of the LDAP Gateway

    The Psono EE server supports the esaqa LDAP Gateway, which provides a secure method to expose LDAP servers. It uses cryptographic authentication between servers and applications, ensuring that transmission is encrypted via SSL and transport encryption. User secrets are encrypted by keys provided by the gateway and are not stored in the server's settings.yaml. Each user has a unique key calculated based on LDAP parameters.

    Warning: All keys are protected by the LDAP gateway. If the gateway's settings.yaml is lost, all stored data in Psono becomes inaccessible.

  3. Overview of Psono Tenants and Delegated Administration

    Tenants in Psono are administrative boundaries used to organize users and groups into ownership scopes. They allow superusers to delegate administrative roles (e.g., managing users or groups) to specific departments or regions rather than granting global access.

    Critical Constraints:

    • A tenant is NOT a separate vault, login realm, database, or cryptographic boundary.
    • Tenant membership does not grant access to secrets or groups; access is still controlled by standard group memberships and share permissions.
    • Users and groups can belong to zero, one, or multiple tenants.

  4. Overview of Psono Administrative Roles

    Administrative roles control access to the Admin Portal and its management functions. They are distinct from Group Admin and Share Admin permissions, which only control actions within a Psono group. Only a superuser can create or modify administrative roles and their assignments. Users with an active role assignment can access the Admin Portal without needing superuser status.

  5. Introduction to psonoci CI/CD integration utility

    psonoci is a utility designed for Psono CI/CD integration. It is currently in beta. The utility utilizes a sessionless API with local decryption for its operations.

  6. Overview of Psono Emergency Codes

    Emergency codes allow designated coworkers or relatives to access your Psono account in the event of an emergency (e.g., hospitalization). To prevent unauthorized access, these codes grant access only after a configurable waiting period has elapsed following activation. When an emergency code is activated, an email notification is sent to the account owner, providing an opportunity to revoke the code before access is granted.

  7. Overview of Psono Kubernetes Operator synchronization

    The Psono Kubernetes Operator synchronizes selected values from Psono entries (such as Environment Variables entries) into native Kubernetes Secrets. These Secrets can then be consumed by applications via env, envFrom, or Secret-backed volumes.

    Synchronization Workflow:

    1. The operator reads an authentication Secret from the PsonoSecret namespace.
    2. It calls Psono's sessionless /api-key-access/secret/ endpoint.
    3. It receives the encrypted entry and per-entry key, then decrypts them locally using XSalsa20-Poly1305.
    4. It extracts only the values explicitly listed in the PsonoSecret resource.
    5. It creates or updates the target Kubernetes Secret.
    6. This process repeats at a configured refresh interval.

  8. Overview of Psono Gateway

    Psono Gateway enables browser-based SSH, RDP, and VNC sessions for connection entries stored in Psono. It is based on Apache Guacamole and includes a bundled guacd daemon.

    Requirements:

    • Psono Enterprise Edition (Community Edition is not supported).
    • A valid Enterprise Edition license.
    • A trusted, maintained host (as the Gateway handles decrypted credentials in memory).

    Architecture: Users connect to the Gateway via HTTPS. The Gateway then establishes the SSH, RDP, or VNC connection from its own network to the target system using short-lived launch codes exchanged with the Psono server.

  9. Overview of Psono Client and Server Build Pipelines

    Psono utilizes automated build pipelines via GitLab Runner for both the client and server components. These pipelines automate the following stages of the development lifecycle: unit testing and coverage calculation, security and vulnerability scanning, building and packaging, and uploading and releasing.

  10. Understand Psono password manager architecture

    Psono is composed of two primary components: a client and a server. The server acts as the core system, handling logic and data storage. The client is the user interface used to access and manage data. A critical security feature is that all secrets (passwords, notes, bookmarks, etc.) are encrypted locally on the user's device (PC or browser) before being transmitted to and stored on the server.

  11. Understand the Psono datastore and file tree structure

    The Psono datastore is a client-constructed hierarchical tree consisting of folders and items. Folders can contain other folders and items. Every item serves as a link to a secret. Both folders and items can be designated as shares. This structure is primarily utilized within 'password datastores' and 'shares'.

  12. Understand Psono password manager architecture

    Psono is composed of two primary components: a client and a server. The server acts as the core system, handling logic and data storage. The client is the user interface used to access and manage data stored on the server. A critical security feature is that all secrets (passwords, notes, bookmarks, etc.) are encrypted locally on the user's PC within the browser before being transmitted to and stored on the server.