PingOne Privilege

User Vault

User Vault is a private credential store for each user in PingOne Privilege. Users store their own credentials for the backend systems they access, and PingOne Privilege injects the right user’s credential into backend calls at request time. Credentials stay out of the agent and out of reach of other users.

How User Vault works

  1. The user stores a credential for a target system in their vault.

  2. When the user’s session or agent calls the backend system, PingOne Privilege injects that user’s credential into the request at request time.

  3. The credential is never exposed to the agent or to anyone else.

All vault operations are strictly self-service and bound to the calling user. No administrator, auditor, or support role can read another user’s credentials. Credentials are encrypted at rest.

Supported resource types

The user vault supports the following resource types:

  • Remote Agent

  • MCP Server

  • Server

  • Git Server

  • RDP Server

  • Database

Supported credential types

The user vault supports the following credential types:

  • Username / Password

  • API Key

  • Token

  • SSH Key

  • Certificate

  • Generic (key-value)

Entries are bounded by per-user count and per-credential size limits. When you delete an entry, it is staged for deletion and permanently removed after 24 hours.

Create a vault entry

The location of the User Vault in the navigation depends on your PingOne Privilege role:

  • Users: User Vault appears in the left-hand navigation under Directory > My Vault.

  • Administrators: Sign on to the admin console, click your user profile in the upper-right corner, and click Switch to user. The console switches to the user view, where User Vault appears under Directory > User Vault.

To create a vault entry:

  1. In the PingOne Privilege user console, go to Directory > My Vault.

  2. Click Add Credential.

  3. Select the Resource type for the entry, such as an MCP Server or Git Server.

  4. Enter the credential details:

    • Credential Type

    • Description

    • Username

    • Password

    • URL (optional)

    • Expires (optional)

  5. Click Save Credential.

The credential is saved in your vault.

Manage vault entries

  1. In the PingOne Privilege user console, go to Directory > My Vault.

  2. To edit the entry:

    1. Find the credential you want to manage and click the Pencil () icon.

    2. Make the changes you want to the configuration fields, then click Save Credential.

  3. To delete the entry:

    1. Find the credential you want to manage and click the Delete button.

    2. Click Mark for Deletion.

      The entry is now viewable in the Pending Deletion tab.

      The entry is recoverable for 24 hours. You can restore it from the vault list until the nightly cleanup permanently deletes it.