This is a governance integration for Password Safe Cloud. Oleria discovers identities, groups, roles, and NHIs. It doesn’t inventory assets, managed systems, or Smart Rules as resources. On-premises BeyondInsight isn’t supported.
What Oleria discovers
Prerequisites
- A BeyondTrust Password Safe Cloud instance, with a URL such as
https://example.ps.beyondtrustcloud.com. Oleria accepts instance URLs underbeyondtrustcloud.comonly. - A BeyondInsight administrator who can create user groups, API registrations, and users.
Choose an authentication method
Oleria supports two authentication methods. Both connect as a BeyondInsight user, and Oleria’s access comes from that user’s groups.Set up the integration
1
Create a user group for Oleria
In BeyondInsight, create a user group for Oleria. Under the group’s Features, grant the permissions you need from this table.
Oleria checks both required permissions when you connect. If any other read permission is missing, Oleria still syncs, but skips that kind of data. It picks the data up on the next sync after you grant the permission.
2
Share Secrets Safe folders
Secrets Safe returns only the secrets that the connecting user can see. Share each Secrets Safe folder you want Oleria to govern with the Oleria group.
3
Create the credential
Follow the steps for the method you chose.
- OAuth client credentials
- API key
- Create an API registration of type API Access Policy.
- Create an Application user, bind it to the API Access Policy registration, and add it to the Oleria group.
- Copy the Application user’s Client ID and Client Secret.
4
Allow Oleria's IP addresses
If the API registration restricts source addresses, add Oleria’s IP addresses to its rules. Contact support@oleria.com for the current list.
Connect BeyondTrust Password Safe to Oleria
1
Open the integration
Sign in to your Oleria workspace and navigate to Integrations -> BeyondTrust Password Safe -> Connect.
2
Complete the connection form
3
Complete the connection
Select Authenticate. Oleria signs in and confirms that it can read the connecting user’s own record, which needs User Accounts Management (Read), and the user audit log, which needs User Audits (Read). If either permission is missing, the connection fails with a message that names it. Otherwise, Oleria begins the first sync.If BeyondInsight rejects the credentials, Oleria doesn’t retry, so that a wrong password or token counts only once toward the RunAs user’s lockout threshold. BeyondInsight records the reason under User Audits.
Edit the connection
You can change the authentication method and credentials of an existing connection, but not the Instance URL. To connect a different instance, create a new connection.- Secrets: Leave a secret blank to keep the stored value. You must enter a new Client Secret if you change the authentication method or the Client ID, and a new API Key if you change the authentication method.
- RunAs password and personal access token: A blank value keeps the stored one only while the RunAs Username and authentication method stay the same. If you change either, Oleria removes the stored values, and you must enter them again if the registration still requires them.
- Removing a stored factor: To remove a stored value that the registration no longer requires, select Remove stored RunAs password or Remove stored personal access token, then select Update.
Verify the integration
Confirm BeyondTrust Password Safe appears on the Connected tab of your Oleria Integrations page. After the first sync completes, you can review BeyondInsight users, groups, roles, NHIs, and activity in your Oleria workspace.Known limitations
- No remediation actions: This integration is read-only. Oleria doesn’t change users, groups, or NHIs in BeyondTrust Password Safe.
- Password Safe Cloud only: On-premises BeyondInsight and U-Series appliances aren’t supported.
- MFA status: BeyondTrust’s API doesn’t report whether a user has multi-factor authentication, so Oleria shows MFA as unavailable.
- Password changes and creation dates: BeyondTrust’s API doesn’t report when a user was created or last changed their password.
- Personal access tokens: BeyondTrust’s API can’t list personal access tokens, so Oleria doesn’t discover them.
- Secrets Safe coverage: Oleria sees only the secrets that are shared with the connecting user.
- Activity history: Oleria collects up to the last 120 days of user audit events.
- User Audits permission removed later: If the Oleria group loses User Audits (Read) after you connect, activity syncs fail until you grant it again. Oleria doesn’t skip ahead, so the events from that period are collected once the permission is back.
- Activity types: BeyondTrust doesn’t publish its full list of audit event types. Oleria classifies the events it recognizes, and shows any other event as a custom activity, labeled with its BeyondInsight section and action.
- Oleria’s activity in API key mode: With OAuth client credentials, Oleria excludes its own sign-ins from the activity it collects. With an API key, the RunAs user’s activity is kept, including Oleria’s own sign-ins. Every event by the RunAs user is labeled as coming from the Oleria connection user, so you can tell it apart from other users’ activity.
- Credential-level access: Oleria shows Password Safe access as roles on Smart Rules. It doesn’t show which group can retrieve each individual managed account.
- Smart Rules the Oleria group can’t read: If BeyondInsight denies Oleria access to the Password Safe roles on a Smart Rule, Oleria skips that Smart Rule’s roles and still collects the roles on every other Smart Rule.