Enterprise Vault - Administration

Quick start guide

This quick start admin guide is divided into two parts.
First, the BUILD, which explains the operations to be carried out before starting to use the Enterprise Vault.
Secondly, the RUN, which lists the product life operations that can be performed.

BUILD

Enterprise Vault user creation and management uses WALLIX ONE IDaaS (also known as Trustelem), so the BUILD phase will involve configuring both Enterprise Vault and WALLIX ONE IDaaS.

1/ Subscription creation

When you subscribe to WALLIX ONE Enterprise Vault, you'll need to provide several pieces of information: among others the name of your company, and the names of future administrators.

Your company name will be used to create a WALLIX ONE IDaaS subscription.

For instance, MyCompany could have the subscription named "mycompany.trustelem.com".

The list of admins provided will be automatically provisioned when the subscription is created.
They will receive an email with :

So, your first action as an administrator is to create your account using the link provided in the email, and then to go on the WALLIX ONE IDaaS administration page.

2/ Setup WALLIX ONE IDaaS

When you log on to the admin page, the subscription is empty, except for the first administrators. So you'll need to configure it.
There are 3 main things to do on WALLIX ONE IDaaS:

2.1/ Add Enterprise Vault applications

There are two applications to add:

Go to Apps, then Add an application, then select WALLIX Enterprise Vault and WALLIX Enterprise Vault administration.

2025-vault-2.png

2.2/ Add users

If you want to use directory or IDP users, you can do the following setup.

But if you want to use local users, you don't want to create them right away: they'll receive enrollment emails, while the rest of the setup isn't ready yet. That said, you can still create user groups, as they will be used for the next steps.
For instance, you can create a "Users" group, and an "Admins" group.

Go to Groups, then Create.

2025-vault-3.png

2.3/ Give users access to Enterprise Vault

You need to define who can access Enterprise Vault and how. To do this, you'll add permissions.
Permissions can be 1-factor, usually login and password, or two-factor with an additional secret.

Full documentation is available here:

Here's a summary of the main steps:

  1. Create permissions for users and administrators, usually in 2-factor mode.
    Go to Access rules, select Create, then choose your apps et your groups

    2025-vault-4.png
    Internal & External zone depend of the users public IP which is compared to what is provided in Security > General > Internal network.

  2. Enable the desired multi-factors in Security, Authentication factors, Login column

    image.png

  3. In the same page, create an enrollment campaign to automate the 2nd factor enrollment

    image.png

    You'll probably want to use "enrollment during login", which allows the form to be displayed directly after authentication if the user doesn't yet have a 2nd factor.

3/ Setup Enterprise Vault admin application

The next step is to define Enterprise Vault administration policies. 
Link to Enterprise Vault admin app documentation

Today there are 3 policies:

If you want to use Recovery features, it is very important to enable it right now.
Indeed, if a user hasn't logged in AFTER you've activated the option, it won't be possible to help him if he loses his master password.

  1. Go to your user dashboard (your_name.trustelem.com) with an account that has access to the admin app
  2. Click the Admin app
  3. Go to Settings
  4. Enable the desired settings, then Save each categories

image.png

4/ Add the Enterprise Vault specific recovery rights for user

This step is only necessary if you want to use recovery.

There are 2 types of recovery:

Each requires specific rights, which are controlled by WALLIX ONE IDaaS.
To carry out a data recovery action, a validation is required, with a quorum to be reached.
Defining quorum members also requires a specific right.

  1. Go to WALLIX ONE IDaaS admin dashboard, then click Users
  2. Select a User, click Edit and Add attribute
  3. For recovery account:
    name: recovery_account
    kind: bool
    value: true
  4. For recovery data:
    name: recovery_data
    kind: bool
    value: true
  5. For recovery data quorum:
    name: recovery_data_workflow
    kind: bool
    value: true

image.png
Of course, recovery_data and recovery_data_workflow should never be assigned to the same person.

The first user with data/account recovery rights will automatically have the encryption keys needed for these operations. However, this will not be the case for subsequent administrators.
The first admin will have to share these keys via the recovery key sharing page on the user application.
(Settings > Recovery keys > Activate access)

Notes

Now you're all set, you can create local users if you need to, and communicate about the availability of this new application.

RUN

Once Enterprise Vault is up and running, here's a list of the most important things administrators can do.

WALLIX ONE IDaaS

WALLIX Enterprise Vault admin app

WALLIX Enterprise Vault user app

Administration application

The Enterprise Vault admin application is dedicated to 5 usages :

Do do so, you'll find 4 menus:

image.png

Dashboard

The dashboard tab displays a summary of the contents as well as the client interfaces used to access it.

image.png

This page gives a quick overview of Enterprise Vault adoption in your company. Among other things, you can see:

There is one clickable information: the icon at the end of the user interface lines. 
It gives details of the software used per user.

Users

The Users tab displays a list of WALLIX Enterprise Vault users. Users with anomalies are displayed in red.

image.png

This page shows, user by user:

In addition, for each user it is possible to:

A user deleted on Enterprise Vault still exists on WALLIX ONE IDaaS.

Certain scenarios prevent the user from being deleted: for example, if the user is the only owner of the recovery key, or the only owner of a shared vault with members.

A user displayed in red has been deleted on the WALLIX ONE IDaaS side. But the user still exists on Enterprise Vault.
It is not possible to automate the user deletion on Enterprise Vault from WALLIX ONE IDaaS.

Shared Vault

The Shared Vault tab displays a list of vaults shared by WALLIX Enterprise Vault users.

image.png

This page shows, vault by vault:

In addition, for each vault it is possible to delete the vault.

All owner/other member fields (active/unauthorized/deleted) are clickable, giving details of the users concerned.

Logs

The Logs tab displays the logs of actions performed and items viewed

image.png

This page shows:

There are 3 types of filters for searching logs, which can be combined:

At present, it is not possible to extract logs (export or link with SIEM).

Settings

The Settings tab allows the personnalisation of WALLIX Enterprise Vault according to your choices and security policies.

image.png

Today there are 3 policies:

Log

If password access are logged, it is not possible anymore to have an offline access

Recovery

When recovery is enabled, each item will be encrypted with an additional key dedicated to recovery.
This encryption is added the first time the user decrypts his items with his own key.
Consequently, even if the recovery is enabled, these operations can only be performed AFTER the user has made a new access.
So if you want to use them, it's important to activate recovery features from the beginning!

Security

Recovery account

Account recovery allows users to request a reset of their master password if they have lost it.

There are 3 prerequisites:

The workflow will be as follows:

  1. User requests master password reset
  2. Admin accepts reset
  3. User sets new master password

Enable account recovery

  1. Go to the Enterprise Vault admin app
  2. Go to Settings 
  3. Enable the line Authorize account recovery
  4. Click Save button

image.png

The length of time for which the request is valid can also be set here.
The default setting is 2 hours.

Add account recovery rights to a user

  1. Go to your WALLIX ONE IDaaS admin page
  2. Go to Users and select an existing user
  3. Click Edit then Add an attribute
  4. Provide the following attribute:
    name: recovery_account
    kind: bool
    value: true

image.png


When this user will log in the Enterprise Vault user app, and if he is the first one with recovery rights(data or account), he will have the following message:

image.png

In fact, specific encryption keys are required to carry out recovery operations.
These are created when the first admin is authenticated.
Consequently, for subsequent admins, an admin who has the keys must share them.

  1. Go to your Enterprise Vault user app with an admin who has the recovery key
  2. Go to Settings, then Recovery keys
  3. Click Activate access for the new admins

image.png

Workflow

User requests master password reset

If the button "Start a password reset procedure" is not displayed, causes can be:
- The "recovery account" option is not enabled in the admin page
- No admin has the right "recovery account"
- The user has not been logged in since the recovery account option was activated.

Admin accepts reset

image.png

User sets new master password

image.png

Recovery data

Data recovery allows admin to access personal items for selected users.

The point is to recover a secret which is no longer accessible due to the owner's unavailability.
Consequently, in this mode it is only possible to copy a personal secret's identifier, a personal secret's password, or to export the personal vault.
No other action is possible.

There are 4 prerequisites:

The workflow will be as follows:

  1. An admin requests the access to a specific user account
  2. The quorum members are notified and accept the request
  3. The admin is notified and reload his user app: he has access to the user personal items

Shared Vaults are not accessible through data recovery.

Enable Data recovery

  1. Go to the Enterprise Vault admin app
  2. Go to Settings 
  3. Enable the line Authorize data recovery
  4. Click Save button

image.png

The length of time for which the request is valid when accepted can also be set here.
The default setting is 12 hours.

Add data recovery rights to a user

  1. Go to your WALLIX ONE IDaaS admin page
  2. Go to Users and select an existing user
  3. Click Edit then Add an attribute
  4. Provide the following attribute:
    name: recovery_data
    kind: bool
    value: true

image.png

When this user will log in the Enterprise Vault user app, and if he is the first one with recovery rights (data or account), he will have the following message:

image.png

In fact, specific encryption keys are required to carry out recovery operations.
These are created when the first admin is authenticated.
Consequently, for subsequent admins, an admin who has the keys must share them.

  1. Go to your Enterprise Vault user app with an admin who has the recovery key
  2. Go to Settings, then Recovery keys
  3. Click Activate access for the new admins

image.png

Add quorum rights to a user

  1. Go to your WALLIX ONE IDaaS admin page
  2. Go to Users and select an existing user
  3. Click Edit then Add an attribute
  4. Provide the following attribute:
    name: recovery_data_workflow
    kind: bool
    value: true

image.png

Define the quorum

  1. Go to your Enterprise Vault user app with an admin who has the quorum rights
  2. Go to Settings, then Approvers groups
  3. Click Add group
  4. Choose a name and a quorum number (number of validation needed to accept the request), then click Save

    image.png


  5. Click + on the Users column, then provide the approvers email address then click Validate
    Press "Enter" if you want to add multiple approvers

    image.png



  6. Click the Group name the Quorum or the Users if you need to change an information

    image.png


  7. Click Save

Workflow

The admin requests the access to a specific user account

image.png

The quorum members are notified and accept the request

image.png

The admin has access to the user personal items

image.png

Synchronizing Trustelem Groups with the Enterprise Vault CLI (BETA)

🎯 Goal

Automatically define access rights to shared vaults and collections in Enterprise Vault based on membership in Trustelem groups, using a custom JSON attribute called vaultSync.

🧩 Overall Workflow

The script reads all Trustelem groups that include the vaultSync attribute.

  1. For each group:

    • A shared vault is created or updated.

    • Collections are created or removed according to the configuration.

    • User permissions are applied.

  2. If a user also has a vaultSync attribute, it overrides the group configuration.

🧷 Trustelem Configuration

Step 1 – Add custom attributes

🔹 vaultSync JSON attribute on a Trustelem Group (mandatory)

Example to adapt:

{ 
  "sharedVault": "SharedVault1",
  "collections": ["Collec1", "Collec2"],
  "createCollections": true,
  "deleteCollections": false,
  "role": "User",
  "permission": "view" 
}

Field Type Description
sharedVault string Name of the shared vault to sync
collections string[] List of collections to manage
createCollections boolean Auto-create missing collections
deleteCollections boolean Auto-remove collections not listed
role string User role in the vault: "Owner", "Admin", or "User"
permission string Permission in the collection: "view", "viewExceptPass", "edit", "editExceptPass", "manage"
🔹 vaultSync JSON attribute on a Trustelem User (optional)

Overrides group settings when applied.
Example to adapt:

[ 
  { 
    "sharedVault": "SharedVault1",
    "collections": ["Collec1"],
    "role": "Admin",
    "permission": "edit" 
  }
]

Step 2 – Generate a Trustelem API Key

  1. In the Trustelem admin console, go to Rest API > New API key
    ⚠️if you can't see the Rest API tab, you have to create a ticket to require the feature.

  2. Click the edit (pencil) icon

  3. Check:

    • users_read

    • groups_read

  4. Save.

  5. Note the following values:

    • KEY ID

    • Bearer Token

🛠 CLI Script Configuration

1/ Download Enterprise Vault CLI.
2/ Create the synchro script

Example with the Linux CLI:

#!/bin/bash
# --- Configuration ---
vault_id="to_replace"
vault_secret="to_replace"
vault_password="to_replace"
vault_url="to_replace"
trustelem_key_id="to_replace"
trustelem_bearer="to_replace"
trustelem_url="to_replace"

# --- Function: Connect and unlock the Vault CLI ---
connect_to_vault() {
    ./wv logout > /dev/null 2>&1
    ./wv config server "$vault_url" > /dev/null 2>&1
    export WV_CLIENTID=$vault_id
    export WV_CLIENTSECRET=$vault_secret
    export WV_TRUSTELEMKEYID=$trustelem_key_id
    export WV_TRUSTELEMBEARER=$trustelem_bearer
    export WV_TRUSTELEMURL=$trustelem_url
    ./wv login --apikey > /dev/null 2>&1
    export WV_SESSION=$(./wv unlock "$vault_password" --raw)
}

# --- Main Execution ---
connect_to_vault
./wv syncgroups

PowerShell example with the Windows CLI:

# --- Configuration ---
$vault_id = "to_replace"
$vault_secret = "to_replace"
$vault_password = "to_replace"
$vault_url = "to_replace"
$trustelem_key_id = "to_replace"
$trustelem_bearer = "to_replace"
$trustelem_url = "to_replace"

# --- Function: Connect and unlock the Vault CLI ---
function Connect-ToVault {
    ./wv.exe logout | Out-Null
    ./wv.exe config server $vault_url | Out-Null
    $env:WV_CLIENTID = $vault_id
    $env:WV_CLIENTSECRET = $vault_secret
    $env:WV_TRUSTELEMKEYID = $trustelem_key_id
    $env:WV_TRUSTELEMBEARER = $trustelem_bearer
    $env:WV_TRUSTELEMURL = $trustelem_url
    ./wv.exe login --apikey | Out-Null
    $session = ./wv.exe unlock $vault_password --raw
    $env:WV_SESSION = $session.Trim()
}

# --- Main Execution ---
Connect-ToVault
./wv.exe syncgroups

Values to replace:

Variable Description
vault_id API service account ID (web client > Account parameters > Security > API Keys)
vault_secret API service account secret (web client > Account parameters > Security > API Keys)
vault_password Master password for the service account
vault_url Vault instance URL (e.g., https://vault-yourdomain.trustelem.com)
trustelem_key_id KEY ID from Step 2
trustelem_bearer Bearer Token from Step 2
trustelem_url Trustelem admin URL (e.g., https://admin-yourdomain.trustelem.com)
3/ Start the script.

⚙️ Detailed Synchronization Behavior

1. Shared Vault Management

⚠️ Important: if the service account is not a shared vault member, it has no way to know if the shared vault already exists or not. In this case, the script will assume the shared vault doesn't exist and a new shared vault with the same name will be created.

2. Collection Management

⚠️ Important: do not set both createCollections=true and deleteCollections=true at the same time.

🔸 Note on User Attributes: User-level vaultSync attributes cannot create or delete collections—only assign permissions.

3. User Membership & Permissions

🧾 Special Cases

Scenario Behavior
🔁 Trustelem group renamed in AD Synchronization continues (attribute remains present)
🗑 Trustelem group deleted Synchronization stops, but the vault remains unchanged
♻️ Group deleted and recreated Vault is no longer linked; re-adding the attribute resumes sync

✅ Permissions Summary

Action Required Right (Service Account)
Create shared vault None (becomes Owner)
Modify existing vault Must be Owner
Create/delete collection manage
Add/remove users from collections manage
Update user permissions manage