Migration from Credentials to Secrets

For the Imprivata CPAM 26.1.8 release, the platform enables the migration of Legacy Credentials into the Vault as secrets. The migration runs automatically during the scheduled database upgrade.

The migration preserves existing credential values, associations, permissions, and service bindings. After migration, credentials become secrets and can use new capabilities such as checkout, approval workflows, and enhanced audit history.

Change Reference

The following table contains the key changes from credentials into secrets:

Area Before Migration After Migration
Storage Model Global Credential Pools

Vault-based secret management
Checkout Not available Available with optional approval workflows
Audit History Basic tracking Detailed audit trail with timestamps
External Providers Supported with limited scope Full integration with providers
Categories Credential categories Secret categories
Data Preservation Credential data, integration to applications and services are preserved. Secret data is preserved

During the migration, the following data is preserved:

  • Values, including passwords, SSH Keys, and API tokens.

  • Site, service, and user associations.

  • User and group permissions.

  • Access rules.

  • Service bindings.

  • Existing API and third-party integrations.

Migration Process Considerations

Use the following sections to plan the migration:

Plan the migration as part of the scheduled database upgrade. Before the upgrade, review these items:

  • The approximate number of credentials in the environment.

  • Whether the deployment includes more than 100,000 credentials.

  • Whether SSH keys use non-standard formats.

  • Whether external providers are configured.

  • Whether the organization wants to enable checkout, approval workflows, or enhanced audit logging after migration.

The migration runs automatically during the database upgrade. The migration performs the following actions:

  1. Converts existing credentials to secrets.

  2. Preserves credential values without changing them.

  3. Preserves existing permissions and access rules.

  4. Preserves site, service, and user associations.

  5. Creates the required secret-related records and audit structures.

No manual migration action is required from users or administrators.

After migration, the system uses the Vault and secrets model. Administrators can optionally configure the following features:

Your internal users can continue to access secrets that correspond to credentials they could access before migration, subject to the same permissions.

Use this procedure to confirm that secret scope and access rules match the pre-migration credential configuration.

  • Navigate to Vault > Secrets.

  • Select a secret.

  • Review the Scope field.

    IMPORTANT:

    All imported secrets have the Global Scope field. Ensure to place secret checkout configurations to limit access.

  • Review Access Rules for assigned users and groups.

  • Review Associated Services for site bindings.

The scope and access rules should match the credential configuration before migration.

FAQs

No. Credential values, associations, permissions, and service bindings are preserved during migration.

Ensure to validate the connections. If the connections are not preserved, contact Imprivata Customer Support: support@imprivata.com.

No. Existing passwords, SSH keys, and API tokens are preserved.

No. The migration runs automatically during the database upgrade.

No. Existing integrations that use credential APIs continue to work. New integrations can use secret APIs to access new capabilities such as checkout and approval workflows.

No. Users who had access to a credential before migration have access to the corresponding secret after migration.

Yes. Enable checkout for secrets that require controlled privileged access, stronger audit history, approval workflows, or automatic revocation.

No. Approval workflows require checkout to be enabled.

After migration, complete these checks: