Skip to content

Thycotic secret ids arg #2148

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
sk-keeper wants to merge 4 commits into from
Closed

Thycotic secret ids arg #2148

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
0ff9353
Add secret-ids argument for thycotic import
lthievenaz-keeper Jun 12, 2026
55e4503
Pass secret-ids arg from import command to thycotic import
lthievenaz-keeper Jun 12, 2026
f3559f3
Add handling for secret-ids arg in Thycotic import
lthievenaz-keeper Jun 12, 2026
b8540a8
Correct secret_ids check
lthievenaz-keeper Jun 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions keepercommander/importer/commands.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,6 +79,8 @@ def register_command_info(aliases, command_info):
help='temp directory used to cache encrypted attachment imports')
import_parser.add_argument('--show-skipped', dest='show_skipped', action='store_true',
help='Display skipped records')
import_parser.add_argument('--secret-ids', dest='secret_ids', action='store',
help='Comma separated list of secret IDs to fetch (Thycotic)')
import_parser.add_argument(
'name', type=str, help='file name (json, csv, keepass, 1password), account name (lastpass), or URL (ManageEngine, Thycotic)'
)
Expand Down
3 changes: 2 additions & 1 deletion keepercommander/importer/imp_exp.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -715,6 +715,7 @@ def _import(params, file_format, filename, **kwargs):
filter_folder = kwargs.get('filter_folder')
dry_run = kwargs.get('dry_run') is True
show_skipped = kwargs.get('show_skipped') is True
secret_ids = kwargs.get('secret_ids')

import_into = kwargs.get('import_into') or ''
if import_into:
Expand All @@ -732,7 +733,7 @@ def _import(params, file_format, filename, **kwargs):
filter_folder_lower = filter_folder.lower() if isinstance(filter_folder, str) else ''

for x in importer.execute(filename, params=params, users_only=import_users, filter_folder=filter_folder,
old_domain=old_domain, new_domain=new_domain, tmpdir=tmpdir, dry_run=dry_run):
old_domain=old_domain, new_domain=new_domain, tmpdir=tmpdir, secret_ids=secret_ids, dry_run=dry_run):
if isinstance(x, ImportRecord):
if filter_folder and not importer.support_folder_filter():
if not x.folders:
Expand Down
24 changes: 24 additions & 0 deletions keepercommander/importer/thycotic/thycotic.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -341,6 +341,30 @@
secrets_ids.extend([x['id'] for x in auth.thycotic_search(query)])
else:
secrets_ids = [x['id'] for x in auth.thycotic_search(f'/v1/secrets/lookup')]

# secret_ids arg
debug_ids = kwargs.get('secret_ids')
if debug_ids is not None:
# Convert CLI string input into list
if isinstance(debug_ids,str):
debug_ids = debug_ids.replace(' ','').split(',')
# Handle secret IDs list
if isinstance(debug_ids,list):
# Deduplicate
debug_ids = list(set(debug_ids))
# Check whether secrets were found in the lookup
stringified_secrets_ids = [str(x) for x in secrets_ids]
stringified_debug_ids = [str(x) for x in debug_ids]
found_secrets = [x for x in stringified_debug_ids if x in stringified_secrets_ids]
logging.info(f'From the specified {len(debug_ids)} secret IDs, {len(found_secrets)} were found in the secret server lookup.')
logging.info(', '.join(found_secrets))

Check failure

Code scanning / CodeQL

Clear-text logging of sensitive information High

This expression logs
sensitive data (secret)
Loading
as clear text.
This expression logs
sensitive data (secret)
Loading
as clear text.
This expression logs
sensitive data (secret)
Loading
as clear text.
This expression logs
sensitive data (secret)
Loading
as clear text.
This expression logs
sensitive data (secret)
Loading
as clear text.
This expression logs
sensitive data (secret)
Loading
as clear text.

# Replace import list with specified IDs
secrets_ids = debug_ids
else:
# Quit if secret IDs != list
logging.warning('Invalid input for secret IDs, exiting.')
return

self._send_keep_alive_if_needed(params)
print(f'Loading {len(secrets_ids)} Records ', flush=True, end='')
Expand Down Expand Up @@ -779,12 +803,12 @@
except requests.exceptions.ConnectionError:
time.sleep(10)
rs = requests.get(url, headers=headers, verify=False, proxies=self.proxy)
if rs.status_code != 200:

Check failure

Code scanning / CodeQL

Clear-text logging of sensitive information High

This expression logs
sensitive data (secret)
Loading
as clear text.
This expression logs
sensitive data (secret)
Loading
as clear text.
This expression logs
sensitive data (secret)
Loading
as clear text.
This expression logs
sensitive data (secret)
Loading
as clear text.
This expression logs
sensitive data (secret)
Loading
as clear text.
This expression logs
sensitive data (secret)
Loading
as clear text.
error_rs = rs.json()
raise Exception(error_rs['message'])
chunk_rs = rs.json()
records = chunk_rs.get('records')
if isinstance(records, list):

Check failure

Code scanning / CodeQL

Clear-text logging of sensitive information High

This expression logs
sensitive data (secret)
Loading
as clear text.
This expression logs
sensitive data (secret)
Loading
as clear text.
This expression logs
sensitive data (secret)
Loading
as clear text.
This expression logs
sensitive data (secret)
Loading
as clear text.
This expression logs
sensitive data (secret)
Loading
as clear text.
This expression logs
sensitive data (secret)
Loading
as clear text.
result.extend(records)
else:
break
Expand All @@ -792,9 +816,9 @@
skip = chunk_rs['nextSkip']
else:
break
return result

Check failure

Code scanning / CodeQL

Clear-text logging of sensitive information High

This expression logs
sensitive data (secret)
Loading
as clear text.
This expression logs
sensitive data (secret)
Loading
as clear text.
This expression logs
sensitive data (secret)
Loading
as clear text.
This expression logs
sensitive data (secret)
Loading
as clear text.
This expression logs
sensitive data (secret)
Loading
as clear text.
This expression logs
sensitive data (secret)
Loading
as clear text.

Check failure

Code scanning / CodeQL

Clear-text logging of sensitive information High

This expression logs
sensitive data (secret)
Loading
as clear text.
This expression logs
sensitive data (secret)
Loading
as clear text.
This expression logs
sensitive data (secret)
Loading
as clear text.
This expression logs
sensitive data (secret)
Loading
as clear text.
This expression logs
sensitive data (secret)
Loading
as clear text.
This expression logs
sensitive data (secret)
Loading
as clear text.

def thycotic_entity(self, endpoint): # type: (str) -> Optional[dict]

Check failure

Code scanning / CodeQL

Clear-text logging of sensitive information High

This expression logs
sensitive data (secret)
Loading
as clear text.
This expression logs
sensitive data (secret)
Loading
as clear text.
This expression logs
sensitive data (secret)
Loading
as clear text.
This expression logs
sensitive data (secret)
Loading
as clear text.
This expression logs
sensitive data (secret)
Loading
as clear text.
This expression logs
sensitive data (secret)
Loading
as clear text.
self.ensure_auth_token()
headers = {
'Accept': 'application/json',
Expand Down
Loading