What Oleria discovers
Once connected, Oleria continuously discovers and maps the following from your ERPNext site:- Accounts - every user, with their name, username, email address, whether they’re enabled, when they were created, their last sign-in and last activity, and their last password change. System users are standard accounts, website (portal) users are shown as external users, and the Guest user represents anonymous visitors. Administrator and holders of the System Manager role are marked as administrators. Each account shows its sign-in methods (password, the single sign-on providers the user has signed in with, and the two-factor method), whether two-factor authentication is required for it, and, when ERPNext’s Employee records are readable, the user’s department, designation, company, and manager.
- Non-human identities - every user API key, OAuth client registered on your site, OAuth client secret, OAuth grant (the tokens an OAuth client holds for one user), and social login client secret, each with a credential. API keys and OAuth grants link to the user they act as, with that user’s full access, and OAuth grants show their scopes and expiry. Oleria never reads API secrets, client secrets, or token values.
- Groups - user groups and their members, and role profiles, which appear as groups whose members are the users holding the profile and which hold the profile’s roles.
- Roles - every role and who holds it, including the roles ERPNext assigns automatically: All and Guest for every user, Desk User for system users, and every role for Administrator.
- Resources - modules and DocTypes, with the permissions each role grants on each DocType (read, write, create, delete, submit, cancel, amend, report, export, import, share, print, email, and select, per permission level), and documents shared with a user or with everyone.
- Activity - sign-ins, sign-outs, failed sign-ins, and impersonations; changes to users, roles, role profiles, user groups, permissions, shares, user permissions, OAuth clients, social login keys, LDAP settings, and system settings; deletions of these records; and data exports, prints, and report downloads.
Oleria doesn’t import business records such as invoices or orders, except documents that are shared with a user or with everyone.
Prerequisites
- ERPNext (or another Frappe Framework site) version 15 or later, on Frappe Cloud or self-hosted.
- A dedicated ERPNext system user with the System Manager role. The API key acts as this user and stops working if the user is disabled.
- Admin access to the Oleria workspace.
A self-hosted site must be reachable from Oleria over HTTPS at a public address. Before you connect, contact support@oleria.com to have your site’s address allowlisted. Sites on
frappe.cloud don’t need this.Required permissions
ERPNext API keys have no scopes. A key acts with its user’s roles, and ERPNext lets only the System Manager role read users, roles, permissions, and logs.
When you select Authenticate, Oleria refuses a key whose user doesn’t hold System Manager.
Create an API key
1
Create the integration user
In ERPNext, go to the User list and add a user for Oleria, for example
oleria@example.com. Give it the System Manager role.2
Generate keys
Open the user, go to Settings -> API Access, and select Generate Keys.
3
Copy the key and secret
Copy the API Key and the API Secret. ERPNext shows the secret only once.
Connect ERPNext to Oleria
1
Open the integration
Go to your Oleria workspace, select Integrations, then select the ERPNext tile.
2
Complete the connection form
3
Authenticate
Select Authenticate. Oleria checks that ERPNext accepts the key and that its user holds System Manager, then saves the integration.
Verify the integration
Confirm ERPNext appears on the Connected tab of your Oleria Integrations page. After the first sync completes, you can review the discovered accounts, roles, groups, DocTypes, and API keys in your Oleria workspace.If you generate new keys for the integration user in ERPNext, the old secret stops working. Update it in Oleria by editing the integration. Editing the integration always asks for the API secret, so enter the current one if you don’t replace it.
Remediation actions
Beyond discovery, Oleria can act on ERPNext access to remediate risk. Every action needs the System Manager role. The share actions also need Share on the document’s DocType (see Required permissions). Oleria checks both before an action runs.
Oleria never disables or deletes the user the connection authenticates as, never removes that user from a group or role, and never clears that user’s API key. It never changes the Administrator or Guest users.
Known limitations
- Two-factor enrollment isn’t available. ERPNext doesn’t expose whether a user has set up two-factor authentication. Oleria shows whether two-factor is required for each user, from your two-factor settings and the roles that require it. ERPNext asks a user to set it up at their next sign-in.
- Administrator and Guest aren’t shown. ERPNext hides its built-in Administrator and Guest users from every user except Administrator, so Oleria’s dedicated user can’t read them.
- API key use isn’t logged. ERPNext records no creation time or last use for API keys, and requests made with an API key don’t appear in the activity log. Sign-in records don’t say whether the user signed in with a password or single sign-on.
- Restrictions aren’t shown as access. User permissions and module profiles only narrow what a user can see, so Oleria doesn’t show them as grants. Changes to user permissions appear in activity.
- OAuth scopes don’t limit access. ERPNext doesn’t restrict what an OAuth token can read or change by its scopes, so Oleria shows each OAuth grant with the full access of its user. The scopes are listed for reference.
- OAuth grant expiry. An OAuth grant shows as expired once its latest access token expires, even though the client may be able to refresh it.
- Activity retention. ERPNext keeps sign-in records for 90 days by default (Log Settings), so the first sync can’t import older sign-ins.
- Sessions can’t be ended directly. ERPNext offers no API to sign another user out, so there’s no Revoke user sessions action. Disabling a user ends their sessions.
- Some credentials aren’t collected. Oleria doesn’t inventory connected apps, webhook secrets, email account passwords, or the LDAP bind password.
- Custom roles. ERPNext marks a role as custom only when its Is Custom option is set, so roles you created without it show as standard roles.