Sharing Secrets

Sharing passwords is crucial for information technology teams. Due to the sensitive nature of sharing secure information, Secret Server ensures shared passwords are tracked and guarded.

Secret Permissions

There are four secret permission levels to choose from when sharing secrets with another user or group:

• View: The user may see all secret data, such as username and password, as well as metadata, such as permissions, auditing, history, and security settings.
• Edit: Users with Edit permission can modify secret data. They can move secrets to another folder unless the Inherit Permissions from Folder setting is enabled, which requires Owner permission to move the secret. The ability to share secrets is now exclusively available to users with Owner permission.
• List: The user may see the secret in a list, such as a list returned by running a search, but won't be able to view any other details about the secret nor edit it.
• Owner: The user may change all of the secret's metadata.

For the View and Edit permission levels, you can also grant extended permissions, such as Edit Dependencies, which provide fine-grained access to specific operations. See Secret Permissions for details.

Secrets can be shared with either groups or individual users. The secret Sharing section allows secrets to be configured for access.

Password Visibility

Password visibility in the password text-field depends on secret access permission, role permissions, secret security policy settings, and the field-level settings on the secret template. The following table shows the possible combinations of the first three and their password visibility result. For template field settings that mask the password regardless of the table, see Template Field Settings That Mask the Password below.

Table: Password Visibility Determinants

Secret Access Permission	View Launcher Password Role Permission	Hide Launcher Password Policy Setting	Password Visible
Owner	No	On	Yes
Owner	Yes	On	Yes
Owner	Yes	Off	Yes
Owner	No	Off	Yes
Edit	Yes	On	Yes
Edit	No	On	Yes
Edit	Yes	Off	Yes
Edit	No	Off	Yes
View	Yes	On	No
View	No	On	No
View	No	Off	No
View	Yes	Off	Yes
List	Yes	On	No
List	No	On	No
List	Yes	Off	No
List	No	Off	No

Template Field Settings That Mask the Password

Two settings on the password field of the secret template can mask the password for a user even when the table above says the password should be visible. Both are set per field in the secret template designer (Administration > Secret Templates > [template] > Fields). See Secret Template Fields for the full list of field settings.

• Edit Requires: The minimum secret permission needed to edit the field. When set to Owner, only users with Owner permission on the secret can edit the field. Users with Edit permission can still edit the rest of the secret but not this field.
• Viewing requires edit: When enabled, the field is hidden in view mode and shown only when the secret is in edit mode.

When both settings are enabled on the same password field, a user who is not an owner of the secret cannot see the password at all. Viewing requires edit hides the field unless the user can edit it, and Edit Requires: Owner means a non-owner can never edit it, so the field is never displayed to that user. This applies regardless of the user's View Launcher Password role permission or the Hide Launcher Password policy setting, and in both the Secret Server UI and the Delinea Platform UI.

This is expected behavior. To let non-owner users view the password, either change Edit Requires to Edit or clear Viewing requires edit on the field. To let a specific user view it without changing the template, grant that user Owner permission on the secret.

Procedure

To add or remove secret sharing:

1. View the secret you want to share. The secret's page appears on the Overview tab.

2. Click the Sharing tab.

3. Click the Edit link. The page becomes editable.

4. Ensure the Inherit permissions checkbox is deselected so that editing is possible.

5. Enable the Add from External Directory toggle. The Member Type and Directory Source filter dropdowns appear.

6. Change the Scope dropdown setting to All to view all users and groups, assigned and unassigned alike.

7. Click the Member Type dropdown list to limit the scope of your search.

8. Click the Directory Source dropdown list to limit the scope of your search.

9. Type into the search text box any user, group name or keyword in their title that whom you want to add to the assigned list or alternatively remove from the assigned list for the secret.

10. When the user or group appears in the dropdown list, select it. The user or group appears in the Shared with list in the Sharing tab automatically.

11. Click the Secret Permissions cell for the user or group to open the permission panel, and assign permissions:

    • Role: Select the permission level using the radio buttons: List, View, Edit, or Owner.

    • Extended Permissions: For the View and Edit roles, an additional section appears with checkboxes for fine-grained permissions:

      • Edit Dependencies: Allows the user to manage secret dependencies. This is selected by default for the Edit role.

    The Extended Permissions section is hidden for Owner (all permissions are implicit) and List (extended permissions are not applicable).

    To close the panel, click outside it or press Escape.

12. Click Save to apply all pending changes, or click Cancel to reverse any changes.

13. Repeat the process for additional users or groups.

You can also modify sharing settings for users or groups that already have sharing enabled for the secret. If a user or group is not displayed, they do not have access to the secret.

Troubleshooting

When a user cannot see users/groups to share secrets with, despite having been granted all necessary permissions, ensure you haven't customized their permissions outside of the built-in roles. Verify if the user is part of a Secret Server Team, and if so, they need the Unrestricted By Teams permission to view users/groups. See User Teams for further details.