https://<team>.filecloudonline.com) and self-hosted FileCloud Server. One Oleria connection maps one FileCloud site. On a multi-tenant FileCloud Server, connect each site as a separate instance.
What Oleria discovers
Once connected, Oleria continuously discovers and maps the following from your FileCloud site:- Accounts - every FileCloud user, with their name, email address, access level (Full, Guest, External, or Disabled), last login, account expiry, lockout, and whether they are an admin. Guest and External users are shown as external users. Oleria also shows the site’s Main Admin, which FileCloud doesn’t list as a user.
- Authentication - whether each user signs in with a password or single sign-on (SSO), and whether their effective user policy requires multi-factor authentication (MFA), with the policy’s MFA methods (email, TOTP, Duo, or SMS).
- Groups - every group and its members, including the built-in EVERYONE and EXTERNALS groups and groups synced from Active Directory or SSO. Group admins are shown as the group’s managers.
- Roles - admin roles with their permissions, users, and groups; the built-in Main Admin and promoted admin roles; and user policies, with the users each policy applies to.
- Resources - every share (shared files and folders, and Team Folder shares) and every Network Folder.
- Access - who can reach each share or Network Folder:
- users and groups added to a share, with their permissions (for example read, write, sync, share, or download)
- the share owner
- users and groups assigned to a Network Folder, with read or read/write access
- anyone with a share’s public link
- Non-human identities (NHIs) - the Team Folder account, API application credentials with their client secrets and issued tokens, client devices (such as FileCloud Drive, Sync, mobile, and Office add-ins) linked to the user who authorized them, and public share links.
- Credentials - client secrets, app tokens, device authentications, public links and their passwords, and user sessions, each linked to the identity it authenticates. Oleria never reads or stores secret, token, password, or link values.
- Activity - FileCloud’s audit log, including sign-ins, file and share activity, and user, group, and admin changes. Oleria backfills 90 days of history.
Oleria doesn’t map individual files and folders that aren’t shared, folder-level permissions inside Team Folders, or how nested shares relate to each other. See Known limitations.
Prerequisites
- A FileCloud Online site, or a FileCloud Server site reachable over HTTPS from the internet. Servers that are only reachable on a private network or VPN can’t be connected.
- A FileCloud admin account for Oleria. We recommend a dedicated integration user promoted to admin through an admin role, so you can limit its permissions and so the integration isn’t tied to a person. You can also connect as the Main Admin, which has every permission.
- The admin account must sign in with a password and must not require two-factor authentication at admin login. Oleria syncs without a person present and can’t answer a 2FA challenge. Oleria refuses to connect an account that is asked for a 2FA code.
-
These admin permissions for the integration user’s admin role:
- To run remediation actions, also the Update permission for each area an action changes.
- Admin access to the Oleria workspace.
For a self-hosted FileCloud Server, or a FileCloud Online site on a custom domain, Oleria must be able to reach the server over HTTPS. Contact support@oleria.com to allowlist its exact hostname before you connect. Sites on
filecloudonline.com need no extra setup.The exact location of these settings can change between FileCloud versions. If the steps below don’t match what you see, refer to FileCloud’s administrator guide.
Create the integration admin in FileCloud
Skip to Connect FileCloud to Oleria if you connect as the Main Admin. In that case, make sure Settings -> Admin -> Enable multi-factor authentication for admin logins is turned off.1
Create the user
Sign in to the FileCloud admin portal. In the navigation panel, click Users, then click Add User. Choose Default Authentication, set Access Level to Full, enter a username (for example
oleria-integration), an email address, and a strong password, then click Create.2
Create an admin role
In the navigation panel, click Admins. On the Manage Admin Roles screen, click Add new role, enter a Role Name (for example
Oleria), and click Create Role.3
Select the permissions
Go through the pages of permissions and select the read permissions listed in Prerequisites. To use remediation actions, also select the Update permissions listed in Remediation actions.
4
Add the user to the role
Click the Users tab. In Add Users to Role, enter the integration user’s name, click Add, then click Close. Adding the user to the role makes it a promoted admin.
5
Turn off 2FA for the integration user
A promoted admin uses the MFA setting of its user policy at admin login. Click Settings -> Policies, and assign the integration user a policy where MFA -> Require multi factor authentication is turned off. To create one, click New Policy, then assign the user to it with the user icon next to the policy.
On FileCloud Server, if
TONIDOCLOUD_2FA_ADMIN_FLOW_FOR_PROMOTED_ADMINS is set in cloudconfig.php, promoted admins use the admin-portal MFA setting instead. In that case, Settings -> Admin -> Enable multi-factor authentication for admin logins must be turned off.Connect FileCloud to Oleria
1
Open the integration
Go to your Oleria workspace, select Integrations -> select FileCloud.
2
Complete the connection form
When you edit the integration later, leave Admin password blank to keep the stored password. If you change Admin username, enter that account’s password.
3
Authenticate
Select Authenticate. Oleria signs in to FileCloud and reads the user list before saving. The connection fails if the account requires 2FA at admin login, or can’t list users.
Verify the integration
Confirm the FileCloud site appears on the Connected tab of your Oleria Integrations page. After the first sync completes, review the discovered accounts, groups, roles, shares, Network Folders, non-human identities, and activity in your Oleria workspace.Oleria signs in as the admin account each time it syncs, so the sign-ins appear in FileCloud’s audit log. Oleria leaves its own activity out of the activity it imports. If you change the account’s password in FileCloud, edit the integration in Oleria, enter the new password, and select Update.
Remediation actions
Oleria can take the following actions in FileCloud. Before each action, Oleria checks that the admin account holds the Update permissions the action needs. The Main Admin has all of them.
If a group is synced from Active Directory or SSO, Oleria still changes its membership but warns you that the next directory sync may undo the change.
Oleria refuses to:
- change the admin account Oleria signs in with, or block its devices
- change the Main Admin or the Team Folder account. Disabling the Team Folder account would cut off every Team Folder.
- change membership of the built-in EVERYONE group, which FileCloud manages automatically
- revoke a share owner’s access to their own share
- grant or remove the built-in Main Admin or promoted admin roles, or user policies. Only admin roles can be changed.
Known limitations
- Admin-portal 2FA - the admin account Oleria uses can’t require two-factor authentication at admin login.
- Folder-level permissions - permissions set on folders inside a Team Folder aren’t mapped. Access is shown at the share, so it can appear broader than it is.
- Nested shares - a share inside another shared folder isn’t shown as part of it.
- Unshared files and folders - only shares and Network Folders appear as resources.
- NTFS permissions on Network Folders - when a Network Folder uses NTFS permissions, the effective access comes from Active Directory, which FileCloud doesn’t expose. Oleria shows the users and groups assigned in FileCloud.
- Group access changes - Oleria can’t remove a group from a share, a Network Folder, or an admin role.
- Last password change and per-user MFA enrollment - FileCloud doesn’t expose them. MFA requirements come from each user’s effective policy.
- Admins through groups - a user who is an admin only through a group’s admin role isn’t flagged as an admin on their account. The access appears on the group’s role.
- Superadmin - on a multi-tenant FileCloud Server, the superadmin above the sites isn’t visible from a site admin account.
- Activity details - FileCloud’s audit log doesn’t name the object each event changed, so Oleria shows the event’s message instead.