> ## Documentation Index
> Fetch the complete documentation index at: https://docs.oleria.com/llms.txt
> Use this file to discover all available pages before exploring further.

# DocuWare

> Connect DocuWare Cloud to Oleria to bring users, groups, roles, and OAuth app registrations from your document management platform into your identity and access graph.

Connect DocuWare to Oleria to see who has access to your DocuWare Cloud organization: its users, groups, roles, and the OAuth app registrations that can sign in to it. Oleria reads identity and access data from the DocuWare Platform API as a dedicated DocuWare user, so you can see where access is over-provisioned and take action directly from Oleria.

## What Oleria discovers

Once connected, Oleria continuously discovers and maps the following from your DocuWare organization:

* **Accounts** - every user in the organization, with their name, email address, and whether they're active. Oleria also shows whether two-step verification is on for the user and whether the user signs in through an external identity provider. Users who hold an administrator role, directly or through a group, are marked as administrators.
* **User groups** - every group and its members.
* **Roles** - every role, and the users assigned to each role directly. Roles a user holds only through a group appear in that user's profile details, not as role assignments. See [Known limitations](#known-limitations).
* **Non-human identities (NHIs)** - the OAuth app registrations in your organization, with their OAuth scopes and whether each one is enabled. For each registration that has client secrets, Oleria shows every secret as its own non-human identity and credential, with its expiration date. Oleria reads secret metadata only. It never reads the secret values. App registrations require an Organization Administrator - see [Prerequisites](#prerequisites).

Oleria refreshes this data on its [regular sync schedule](/integrations/overview#sync-model).

<Note>
  Oleria doesn't import file cabinets, document trays, or documents. This integration covers identity and access governance for users, groups, roles, and app registrations only.
</Note>

## Prerequisites

* A DocuWare Cloud organization, at an address such as `https://acme.docuware.cloud`. On-premises DocuWare isn't supported.
* A dedicated DocuWare user for Oleria, with the **User Management** configuration right. Oleria needs this right to read users, groups, and roles, and to run every user, group, and role action.
* Optional: make that user an **Organization Administrator** to let Oleria discover app registrations and their client secrets, and disable app registrations. DocuWare may not allow app registration access for username-and-password connections even for an Organization Administrator. If it doesn't, or the user isn't an Organization Administrator, Oleria still syncs users, groups, and roles, and skips app registrations.
* Admin access to the Oleria workspace.

<Warning>
  Create a dedicated user for Oleria instead of using a named person's account. The connection stops working if that person leaves, is deactivated, or changes their password.
</Warning>

## Create a DocuWare user for Oleria

<Steps>
  <Step title="Create the user">
    Sign in to DocuWare as an administrator and create a user for Oleria, for example `oleria-integration`. Give it a password.

    Oleria signs in with this user's DocuWare username and password. Use a user that can sign in with a password, not one that signs in only through an external identity provider.
  </Step>

  <Step title="Grant the User Management right">
    In DocuWare Configuration, give the user the **User Management** configuration right.
  </Step>

  <Step title="Make the user an Organization Administrator (optional)">
    To discover and disable app registrations, make the user an **Organization Administrator**.
  </Step>
</Steps>

<Note>
  The exact location of these settings can change over time. If the steps above don't match what you see, refer to DocuWare's own documentation.
</Note>

## Connect DocuWare to Oleria

<Steps>
  <Step title="Open the integration">
    Go to your Oleria workspace, select **Integrations** -> select **DocuWare**.
  </Step>

  <Step title="Complete the connection form">
    Select **Continue** and provide the following:

    | Field | Notes |
    | :- | :- |
    | Organization URL | Required. Your DocuWare Cloud address, for example `https://acme.docuware.cloud`. Only `*.docuware.cloud` addresses are accepted. You can't change this after you connect. |
    | Username | Required. The user name of the dedicated DocuWare user you created. You can't change this after you connect. |
    | Password | Required. The password of that DocuWare user. Oleria stores it encrypted after it validates the credentials. |
  </Step>

  <Step title="Confirm the connection">
    Select **Authenticate**. Oleria signs in to DocuWare with the username and password and reads your organization before it saves anything. Find the newly connected organization on the **Connected** tab of your Oleria **Integrations** page.
  </Step>
</Steps>

<Note>
  **Authenticate** checks the username, password, and organization. It doesn't check the user's rights. If the user is missing the **User Management** right, the connection saves but Oleria can't read your users. Confirm the data after the first sync, as described in [Verify the integration](#verify-the-integration).
</Note>

## Verify the integration

Confirm the DocuWare organization appears on the **Connected** tab of your Oleria **Integrations** page with a status of **Healthy**. After the first sync completes, check that users, groups, and roles appear in your Oleria workspace. If you made the user an Organization Administrator, check whether app registrations appear too. If they don't, see [Known limitations](#known-limitations).

<Warning>
  If you change the user's password in DocuWare, update it in Oleria right away: edit the integration, enter the new password, and select **Update**. Until you do, syncs and actions fail, and each attempt counts as a failed sign-in for that user in DocuWare. Oleria doesn't re-send a password DocuWare has already rejected, which limits failed attempts but doesn't prevent them. If your DocuWare organization locks users after failed sign-ins, the user can be locked out.
</Warning>

<Note>
  When you edit the integration, you can change only the password. To connect a different DocuWare organization or a different user, add a new integration.
</Note>

## Remediation actions

Oleria can take these actions in DocuWare. Each one runs with the rights of the connection's DocuWare user:

* **Deactivate a user** and **reactivate a user**. Requires the **User Management** right.
* **Add a user to a group** and **remove a user from a group**. Requires the **User Management** right.
* **Add a user to a role** and **remove a user from a role**. These actions change direct role assignments only. Requires the **User Management** right.
* **Disable an app registration** (Disable NHI). Disabling turns the app registration off without deleting it or its client secrets, so it can be turned back on. Requires an **Organization Administrator**, and DocuWare must allow the connection to use its App Registration API. See [Known limitations](#known-limitations).

Keep these limits in mind when you use these actions:

* Oleria won't deactivate the connection's own DocuWare user, or remove it from a group or role, because that would disconnect the integration.
* Removing a user from a role removes only the direct assignment. If the user also holds the role through a group, the user keeps the role until you remove them from that group.
* Oleria can't disable client secrets. DocuWare can only delete a client secret, which can't be undone. Disable the app registration that owns the secret instead.
* Oleria won't disable DocuWare's built-in system clients.

## Known limitations

* **No activity or last-login data.** DocuWare doesn't provide an API for its audit reports, so Oleria doesn't import activity or last sign-in dates for DocuWare users.
* **DocuWare Cloud only.** Oleria connects only to `*.docuware.cloud` organizations. On-premises DocuWare isn't supported.
* **Username and password sign-in only.** Oleria connects with a DocuWare username and password. It doesn't support connecting through single sign-on or an OAuth app registration.
* **Roles held through a group aren't role assignments.** DocuWare's API doesn't list which roles are assigned to a group. Oleria shows roles a user holds only through a group in the user's profile details. These roles still count when Oleria marks a user as an administrator.
* **No role permissions.** DocuWare's API doesn't expose the function rights or file cabinet profiles a role grants.
* **No creation dates or owners.** DocuWare's API doesn't report when users, groups, or app registrations were created, or who created or owns them.
* **App registrations need an Organization Administrator, and may not be available.** Oleria reads app registrations through DocuWare's App Registration API, which DocuWare may not allow for username-and-password connections. If it isn't available, or the user isn't an Organization Administrator, Oleria skips app registrations and their client secrets, and the Disable NHI action isn't available. Oleria checks this when you connect. If you give the user access later, edit the integration and select **Update** so Oleria starts importing app registrations. If app registrations were available when you connected and later stop being available, for example because the user is no longer an Organization Administrator, syncs fail rather than show your app registrations as removed. Restore the user's Organization Administrator access to fix this. If DocuWare is unavailable when you connect, the connection fails. Try again later.

## Contact us

For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.