Can anyone recommend a F/OSS enterprise password management solution on/around the same level as something like Cyber-Ark?

Specifically, something along the lines of a standard password manager, (like KeePass), but with the ability to login with ldap credentials and get access to passwords for your environment, specific to your duties--Synced between multiple locations and departments. It could be a Web Application with a backend database, or it could be multiple databases somehow synced between multiple locations, though a Web App would be preferable.

I have seen the post by Tok (accepted answer) on using Git to do it, but I wanted to see if there was anything specifically written for this type of need.

The enterprise environment is Windows & Linux.

  • For which platform(s)?
    – Steve
    Feb 4, 2011 at 1:28
  • Can you describe the requirements and features you're looking for more specifically? Passwords for what, used by who, etc. And (ala the faq) what sort of context or risk profile you have in mind? A link to Tok's post would also be handy.
    – nealmcb
    Feb 6, 2011 at 4:48
  • You might also want to distinguish it from this related question: Password Management within an Organisation
    – nealmcb
    Feb 6, 2011 at 5:23
  • @nealmcb Tok's post is the selected answer to the question you just linked to. I didnt realize that I was not being clear when I said that the solution should be akin to Cyber-Ark. I'm not sure how else I can describe it--Some sort of Enterprise-quality password management solution... If you dont know what Cyber-Ark is, then think KeePass, but with the ability to login (with ldap credentials) and get access to passwords for your environment--Synced between multiple locations and departments. Does that help? Feb 6, 2011 at 5:37
  • 1
    I'm just suggesting that it would be a service to the folks you are asking for help, and attract more interest and answers, to edit all that and more in to the question. Links to product web pages are less helpful since they usually are full of unclear marketing junk, change over time, and it is unclear which aspects of that product address what your actual interests are.
    – nealmcb
    Feb 6, 2011 at 16:18

2 Answers 2


A large enterprise can't use a password manager like KeepPass, that would be a total nightmare. A more scalable password management solution is LDAP and Kerberos. Kerberos' highlights are that its very scalable and no matter how large you can disable access to a user across the entire system immediately, because authentication is centralized.

  • 3
    @Rook, your answer claims that if a company is not using Kerberos then they are not really on top of their security. I disagree with that statement.
    – D.W.
    Mar 31, 2011 at 7:03
  • @D.W. So then your problem with me is more than just flame. Also i stand by this. If you need some "password manager" for your enterprise then you messed up somewhere. [mod edit - no need for the foul language]
    – rook
    Mar 31, 2011 at 7:10
  • @Rook - across my client base (a large percentage of the fortune 350) very few have Kerberos. I see it in certain departments, and in principle I like it (having used it from the very early days) but it is just one solution, and is not appropriate for every organisation.
    – Rory Alsop
    Mar 31, 2011 at 8:18
  • @Rory Alsop♦ So then do these organizations that don't use kerberos use a password manager "like KeePass" for their entire enterprise? I hope the answer is NO, because that would be a nightmare.
    – rook
    Mar 31, 2011 at 19:12
  • @Rook - god no! That would be a complete nightmare :-)
    – Rory Alsop
    Mar 31, 2011 at 23:19

i would like to try clipperz in our small office for all the websites that employees have to authenticate to in order to carry out their job.

clipperz.com is an open source web application with the intention of encrypting sensitive information using javascript before transmittal to the central server. Host it yourself or sign-up for their service. You may have to adapt it for your specific needs, not sure if it natively supports ldap or kerberos authentication. (i prefer kerberos because other machines or services do not need to be sent my password. With LDAP authentication, your password is sent out.)

Of course, the big vulnerablity is a "man-in-the-browser". Mitigate that vuln by setting up a separate instance of portable firefox that is more locked down and has a proxy configuration that blocks all websites except the internal clipperz webserver.

Not the answer you're looking for? Browse other questions tagged .