Skip to content

Import Command - Match Shared Folder by uid (revised) - #2363

Merged
sk-keeper merged 3 commits into
Keeper-Security:releasefrom
lthievenaz-keeper:feat-import/match-sf-by-uid_revised
Sep 10, 2026
Merged

sk-keeper merged 3 commits into
Keeper-Security:releasefrom
lthievenaz-keeper:feat-import/match-sf-by-uid_revised

Conversation

@lthievenaz-keeper

Copy link
Copy Markdown
Contributor

Builds on top of PR #2326 (--unsafe flag for apply-membership)

Problem

During an import (e.g. JSON), shared folders are matched by path, not UID.
If a vault has a shared folder with the same UID, but different path (e.g. the shared folder is nested in a personal folder), the import will create a new shared folder.

Changes

If the import includes a UID which matches that of a shared folder in the vault, the folder will not be duplicated.
The new path will be ignored (revision from #2334)

Limitations

Currently only wired up for Classic folders, NSF folders are currently not written to JSON in a way that allows UID matching.

Sample test

  • Create personal folder root
  • Create shared folder SF in root
  • (optional - create records in SF)
  • Share folder SF to user_b
  • Export folders with export --format json <file>
  • Import the resulting JSON file in user_b's vault with import --format json <file>

Before

A duplicate SF is created inside a new root folder for user_b

After

A folder root is created, however no duplicate SF folder is created (records are resolved to it correctly)

In import (e.g. JSON), shared folders are matched by path, not UID.
If a vault has a shared folder with the same UID, but different path (e.g. the shared folder is nested in a personal folder), the import will create a new shared folder.

This changes the import process so that if the import includes a UID which matches that of a shared folder in the vault, the folder will not be duplicated, records/sub folders will be added to the existing folder in it's current location. 
The path set in the import folder will be ignored.

Currently only wired up for Classic folders
Currently, apply-membership --full-sync will remove folder permissions so that it matches the JSON file, however it won't remove yourself.
Added --unsafe flag, which will allow removing yourself if you're not set on the folder permissions.
This can be useful:
- If the folder is only meant to be shared to your team and not you.
- To reproduce enterprise-push behavior with shared folders at scale
Add unsafe flag and manual documentation.
Unsafe flag allows the apply-membership to remove yourself from the folders if set.
@lthievenaz-keeper lthievenaz-keeper changed the title Feat import/match sf by uid revised Import Command - Match Shared Folder by uid (revised) Sep 10, 2026
@sk-keeper
sk-keeper merged commit 0e14601 into Keeper-Security:release Sep 10, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants