Credential sources

Credential sources

This page explains where a login can come from: one or more credential sources (Vaultwarden or Bitwarden vaults, CyberArk, Delinea Secret Server, Proton Pass), or Cablebag's own saved passwords on this PC. It also covers the login picker, what syncs and what never does, key passphrases, trusted servers, the SSH key generator and backup.

Before version 0.16.0 this page was called Vault and passwords, and Cablebag knew one Vaultwarden. Your existing vault became the first source, named Vaultwarden, by itself: nothing to set up again, and every login already linked keeps working.

Settings, Credential sources

Settings, Credential sources lists your sources under Sources. Each row shows the name, the account and server, whether it is locked or signed out (and "this PC keeps the key" when it is), or, when open, how many logins it holds and when they were loaded. Next to it:

• Unlock (a Vaultwarden or Bitwarden vault) or Sign in (CyberArk, Secret Server).
• The refresh button, Load the logins again, and Lock or Sign out.
• Edit and the bin button, Remove. Removing a source keeps the links in your sessions, but they no longer work, and what this PC kept for the source is removed.
• Move up: the first source is the one that opens when a connection needs a login and no source is open.

Logins you have checked out (CyberArk and Secret Server, see below) appear as rows of their own, Checked out: ..., with a Check in button.

Add a source offers Vaultwarden or Bitwarden, CyberArk (Privilege Cloud or PVWA), Delinea Secret Server and Proton Pass. Every source gets a Name, such as Work or Home; it is how the source shows in lists.

At start

Remember the unlock on this PC applies to every source that can keep its sign-in:

• Windows Hello (PIN, fingerprint or face): this PC keeps the vault key or sign-in, readable only by your Windows account; Windows Hello confirms it is you once per start. The entry says "not set up here" when Windows Hello is not set up on this PC.
• Without asking: the key or sign-in is kept and used without a prompt, so anyone using your Windows account can open the sources.
• Ask every time: safest; nothing about your sources stays on this PC, and every start asks for the master password or sign-in. Choosing it forgets what this PC had kept for every source.

A Vaultwarden source keeps its vault key, a Secret Server source keeps an encrypted refresh token, and a CyberArk source keeps nothing on disk: you sign in again after a restart.

Vaultwarden or Bitwarden

Fill in the Server (your Vaultwarden address, or https://vault.bitwarden.com or .eu for Bitwarden itself) and the Email address of the account, then Save and Unlock. Unlocking asks for the master password; a two-step login with the code from your authenticator app or the code the vault sent to your email is supported. The opened vault stays in memory only.

You can have several vaults side by side, for example one for work and one for home. Each has its own server, account, kept key and Windows Hello unlock, and each is unlocked, synced and locked on its own.

CyberArk (Privilege Cloud or PVWA)

A CyberArk source reads the accounts you may see from Privilege Cloud or a self-hosted PVWA, fetches a password when a session needs it, checks accounts in again, and can connect through PSM (see CyberArk PSM). Cablebag only reads from CyberArk; it changes nothing there apart from check-out and check-in.

The CyberArk and Delinea parts were built from the official documentation. No CyberArk or Secret Server was available to the maker while building them, so they have not yet run against a real one. If you use either, please try it and say what happened through Report a problem (see Troubleshooting and FAQ); that is the quickest way to get the last details right.

Setting it up

• Address: Privilege Cloud, such as https://company.privilegecloud.cyberark.com or https://company.privilegecloud.cyberark.cloud, or your own PVWA, such as https://pvwa.example.com.
• Sign in with: CyberArk password, LDAP (your directory account), RADIUS, Windows, Single sign-on (SAML) or CyberArk Identity (Privilege Cloud on Shared Services). A Privilege Cloud address on cyberark.cloud (Shared Services) picks CyberArk Identity by itself; everything else starts with CyberArk password.
  • With a password method, fill in your User name (or leave it empty to type it each time). The password is asked for when signing in and never kept.
  • With single sign-on you sign in yourself in a Cablebag window, on your organisation's own sign-in page; the window closes by itself once you are signed in, and Cablebag keeps the sign-in in memory only. The Sign-in page is optional (where the window starts, for example your identity provider's link to CyberArk; empty means the PVWA's own sign-in page, where you choose single sign-on). For CyberArk Identity there is also the CyberArk Identity address of your tenant. The User name is optional here: it is shown while signed in and used for PSM when CyberArk does not say who you are.
• Ticketing system: optional, the name of the ticketing system to fill in when CyberArk asks for a ticket.
• Always ask for a reason: asks why you need an account every time Cablebag fetches a password. Without it, Cablebag asks when CyberArk wants a reason.
• Connecting through PSM: the PSM for SSH and PSM server fields; see CyberArk PSM.

Then Save and Sign in. The row shows how many logins were loaded; a large vault shows "the first ... logins (searching asks the server for the rest)", and the login picker then asks CyberArk as you type.

Reasons, tickets, check-out and check-in

When a safe's platform requires a reason or a ticket, or when CyberArk refuses a password for lack of one, a window Access through asks for the Reason and, when needed, the Ticketing system and Ticket number, then Continue. Exclusive and one-time accounts are checked out to you when Cablebag fetches their password; they are listed under Settings, Credential sources with Check in. When Cablebag closes, it checks in what was checked out and signs out of CyberArk, waiting at most five seconds for that.

When several CyberArk accounts fit the server you connect to, a window Connect to asks which one.

Single sign-on in a Cablebag window

The sign-in window is a separate window with a browser profile of its own, apart from Cablebag's own page and from your web browser. It only shows web pages, never Cablebag's own, and the pages in it cannot reach Cablebag. Cablebag takes only the one thing it needs at the end (the SAML response on its way to CyberArk, or the Identity session cookie, which is removed from the window's profile right after it is read). Closing the window cancels the sign-in. Nothing it sees is logged.

Delinea Secret Server

A Secret Server source reads secrets from Secret Server on your own server or Secret Server Cloud. Like CyberArk, it was built from the documentation only; please report how it works with yours.

• Secret Server address: https://server/SecretServer or https://tenant.secretservercloud.com.
• Sign in with:
  • A Secret Server user name and password: your User name (a Secret Server user, or your Active Directory user name), the Domain for an Active Directory account (such as CORP; empty for a Secret Server user), and Ask for a two-factor code, which asks for the code from your authenticator with the password every time. Without that switch, Cablebag asks for a code when Secret Server wants one.
  • A Delinea Platform service user: the Delinea Platform address (such as https://tenant.delinea.app) and the Service user; the Secret Server address is then the one the Delinea Platform shows under Settings, Secret Server Connection.
• Ticket system number: only when Secret Server checks ticket numbers against more than one ticket system.

Sign in asks for the password (and the two-factor code). The password is used once and never kept. Secret Server can keep you signed in with a refresh token; Cablebag keeps that token on this PC, encrypted, only when Remember the unlock on this PC allows it, and with Windows Hello it confirms it is you before using it. Signing out ends the session on the server.

A secret that needs more than a click opens a window Open : a Reason when Secret Server asks why you need it, a Ticket number if your organisation uses them, the DoubleLock password for a DoubleLocked secret. A secret that requires check-out is checked out to you when you use it ("nobody else can use it until it is checked in"); Cablebag checks it in when you sign out, and you can check it in earlier under Settings, Credential sources.

Not offered, on purpose: Windows integrated sign-in to Secret Server, single sign-on to its API, and requesting access to a secret that needs approval. For those, use Secret Server itself; Cablebag says so when it runs into one.

Proton Pass

A Proton Pass source reads your logins through pass-cli, Proton's own command-line tool (pass-cli.exe on Windows, from proton.me/pass/download). pass-cli keeps its own sign-in on this PC, through your web browser; Cablebag never sees your Proton password and only reads.

• Where pass-cli is: empty when it is on the PATH, otherwise the full path of pass-cli.exe. This is a setting of this PC only and never goes into Sync: a program path that came in from another PC would be a program another PC chose to run here.
• Vaults: the names of the vaults to use, separated by commas, such as Work. Empty uses every vault.

Sign in checks that pass-cli is signed in. When it is not, Cablebag opens pass-cli login in a window of its own, which signs in through your web browser; Cancel stops it. The list of logins (titles, user names and addresses) is loaded when the source opens; a password is read from Proton Pass only when a connection needs it, and the passwords in the list are dropped at once. With Remember the unlock on this PC set to Ask every time, Sign out also signs pass-cli out.

When pass-cli is not found, the source says so with where to get it.

The login picker

Wherever a login is needed, the Login from the vault picker links one: in a session, in a folder's settings, as a Proxmox API token (From a credential source (user name = token ID, password = secret)), as an AI host's key (From the vault), as a WireGuard private key, and as the access token for Sync (From a credential source (password = token)).

• Without any source it offers Set up a credential source.
• When every source is closed it offers Unlock to choose a login or Sign in to to choose a login.
• Choose a login opens a search box (Name, user or address). The matches of every open source are listed, grouped by source when more than one is open; closed sources can be unlocked or signed in to at the bottom of the list. Sources that did not load every login ask their server as you type.
• A linked login shows its name and user, and the source when you have more than one. The picker says when the source is no longer set up, when the login no longer exists there, or that it is Linked to a login in that you have to unlock or sign in to first. The X removes the link.

Finding a login when you connect

A session without a linked login still gets one: when it connects, Cablebag looks in every open source for logins that match the host. With exactly one match it is used; with several, a window Log in to lists them (with their source when you have more than one) and offers Use this login, Type a password or Cancel. When no source is open, the first source in the list is opened first.

The status bar shows Vault: unlocked or locked with one source, and all open or 1 of 2 open with several. Its menu has Unlock, Lock or Sign in to, Sign out of and Sync for each source, and Credential sources. The search box (Ctrl+K) has the same commands.

Filling logins in web tabs

The key button in a web tab's address bar fills a login from your open sources into the page: it offers the logins saved for the page's site, and fills the one you pick. Nothing is filled by itself, and a login saved for another site is only filled after you confirm the site. See Web tabs.

What syncs and what never does

The list of sources (names, servers, accounts and options) travels with Sync, so another PC shows the same sources and only needs to unlock or sign in. What a source keeps on this PC (vault keys, refresh tokens) and every secret it hands out never sync. With more than one Vaultwarden source and sync encrypted with a vault key, Settings, Sync asks for The vault whose key it is (choose the same one on every PC).

Passwords a source hands out are kept in memory only while the source is open, so the Assistant can hide them, and are dropped when it is locked or signed out.

Passwords kept on this PC

A password you type when connecting can be remembered with Remember in the password vault (it is saved only after the login worked). Settings, Passwords on this PC lists them, with the protocol (SSH, RDP, WINRM and so on), user and host, a Show button and Forget. They are encrypted so that only your Windows account on this PC can read them. They never go into Sync, and the Assistant never sees them.

Passwords are not decoded out of other programs' files on import; Cablebag finds them in a credential source or asks once.

Key passphrases

The passphrase of an encrypted private key is asked when it is first used and can be kept; it then appears under Settings, Passwords on this PC as Key passphrase, with the same protection.

Trusted servers

Settings, Trusted servers lists the SSH servers whose identity you confirmed, with the key type, fingerprint and date. Forget one to be asked again on the next connection.

SSH key generator

Tools, SSH key generator creates a key pair and puts it on a server in one go:

1. Create a key: Ed25519 (recommended), ECDSA 256 or 384, or RSA 3072 or 4096 for older servers, with a comment. Or Open existing key to load one you already have.
2. Save it, with an optional passphrase, as a private key file plus its .pub. Use the private key file in your session settings.
3. Put it on a server: choose a saved SSH session and click Add to the server. Cablebag logs in once the usual way and adds the public key to ~/.ssh/authorized_keys, without duplicates.

Copy public key copies it for a server you manage another way.

Backup and restore

Settings, About Cablebag, under Your data:

• Data folder, with Open: where sessions, settings, saved passwords (encrypted) and what the assistant remembers are kept, in one folder on this PC.
• Back up... writes everything to one file. Saved passwords in it only open on this PC, with your Windows account.
• Restore... takes a backup; it replaces the current data when Cablebag starts again, and the current data is kept in the data folder.