> ## Documentation Index > Fetch the complete documentation index at: https://docs.oleria.com/llms.txt > Use this file to discover all available pages before exploring further. # FileCloud > Connect FileCloud Online or FileCloud Server to Oleria to discover users, groups, admin roles, user policies, shares, Team Folders, Network Folders and who can access them, non-human identities and their credentials, and audit activity. FileCloud is an enterprise file sharing and sync platform from CodeLathe. Connect your FileCloud site to Oleria to see who can reach your files and who can administer the site: users and their access levels, groups, admin roles, user policies, shares, Team Folders, Network Folders, and the non-human identities that act on your data. Oleria signs in to the FileCloud admin API with an admin account you choose, so you can find dormant or over-privileged accounts and public links and take action directly from Oleria. This integration works with FileCloud Online (`https://.filecloudonline.com`) and self-hosted FileCloud Server. One Oleria connection maps one FileCloud site. On a multi-tenant FileCloud Server, connect each site as a separate instance. ## What Oleria discovers Once connected, Oleria continuously discovers and maps the following from your FileCloud site: * **Accounts** - every FileCloud user, with their name, email address, access level (**Full**, **Guest**, **External**, or **Disabled**), last login, account expiry, lockout, and whether they are an admin. Guest and External users are shown as external users. Oleria also shows the site's **Main Admin**, which FileCloud doesn't list as a user. * **Authentication** - whether each user signs in with a password or single sign-on (SSO), and whether their effective user policy requires multi-factor authentication (MFA), with the policy's MFA methods (email, TOTP, Duo, or SMS). * **Groups** - every group and its members, including the built-in **EVERYONE** and **EXTERNALS** groups and groups synced from Active Directory or SSO. Group admins are shown as the group's managers. * **Roles** - admin roles with their permissions, users, and groups; the built-in Main Admin and promoted admin roles; and user policies, with the users each policy applies to. * **Resources** - every share (shared files and folders, and Team Folder shares) and every Network Folder. * **Access** - who can reach each share or Network Folder: * users and groups added to a share, with their permissions (for example read, write, sync, share, or download) * the share owner * users and groups assigned to a Network Folder, with read or read/write access * anyone with a share's public link * **Non-human identities (NHIs)** - the Team Folder account, API application credentials with their client secrets and issued tokens, client devices (such as FileCloud Drive, Sync, mobile, and Office add-ins) linked to the user who authorized them, and public share links. * **Credentials** - client secrets, app tokens, device authentications, public links and their passwords, and user sessions, each linked to the identity it authenticates. Oleria never reads or stores secret, token, password, or link values. * **Activity** - FileCloud's audit log, including sign-ins, file and share activity, and user, group, and admin changes. Oleria backfills 90 days of history. > [!NOTE] > > Oleria doesn't map individual files and folders that aren't shared, folder-level permissions inside Team Folders, or how nested shares relate to each other. See [Known limitations](#known-limitations). ## Prerequisites * A FileCloud Online site, or a FileCloud Server site reachable over **HTTPS from the internet**. Servers that are only reachable on a private network or VPN can't be connected. * A FileCloud admin account for Oleria. We recommend a dedicated integration user promoted to admin through an admin role, so you can limit its permissions and so the integration isn't tied to a person. You can also connect as the **Main Admin**, which has every permission. * The admin account must sign in with a password and must **not** require two-factor authentication at admin login. Oleria syncs without a person present and can't answer a 2FA challenge. Oleria refuses to connect an account that is asked for a 2FA code. * These admin permissions for the integration user's admin role: | Purpose | FileCloud permission | | :- | :- | | Users, devices, sessions, and the Team Folder account | **Users: Read**, **Team Folders: Read** | | Groups | **Groups: Read** | | Admin roles | **Manage Administrators: Read** | | User policies, MFA, and application credentials | **Settings: Read** | | Shares and Team Folders | **User Share: Read**, **Team Folders: Read** | | Network Folders | **Network Share: Read** | | Activity | **Audit: Read** | * To run [remediation actions](#remediation-actions), also the **Update** permission for each area an action changes. * Admin access to the Oleria workspace. > [!NOTE] > > For a self-hosted FileCloud Server, or a FileCloud Online site on a custom domain, Oleria must be able to reach the server over HTTPS. Contact [support@oleria.com](mailto:support@oleria.com) to allowlist its exact hostname before you connect. Sites on `filecloudonline.com` need no extra setup. > [!NOTE] > > The exact location of these settings can change between FileCloud versions. If the steps below don't match what you see, refer to FileCloud's administrator guide. ## Create the integration admin in FileCloud Skip to [Connect FileCloud to Oleria](#connect-filecloud-to-oleria) if you connect as the Main Admin. In that case, make sure **Settings** -> **Admin** -> **Enable multi-factor authentication for admin logins** is turned off. **1. Create the user** Sign in to the FileCloud admin portal. In the navigation panel, click **Users**, then click **Add User**. Choose **Default Authentication**, set **Access Level** to **Full**, enter a username (for example `oleria-integration`), an email address, and a strong password, then click **Create**. **2. Create an admin role** In the navigation panel, click **Admins**. On the **Manage Admin Roles** screen, click **Add new role**, enter a **Role Name** (for example `Oleria`), and click **Create Role**. **3. Select the permissions** Go through the pages of permissions and select the read permissions listed in [Prerequisites](#prerequisites). To use remediation actions, also select the **Update** permissions listed in [Remediation actions](#remediation-actions). **4. Add the user to the role** Click the **Users** tab. In **Add Users to Role**, enter the integration user's name, click **Add**, then click **Close**. Adding the user to the role makes it a promoted admin. **5. Turn off 2FA for the integration user** A promoted admin uses the MFA setting of its user policy at admin login. Click **Settings** -> **Policies**, and assign the integration user a policy where **MFA** -> **Require multi factor authentication** is turned off. To create one, click **New Policy**, then assign the user to it with the user icon next to the policy. > [!NOTE] > > On FileCloud Server, if `TONIDOCLOUD_2FA_ADMIN_FLOW_FOR_PROMOTED_ADMINS` is set in `cloudconfig.php`, promoted admins use the admin-portal MFA setting instead. In that case, **Settings** -> **Admin** -> **Enable multi-factor authentication for admin logins** must be turned off. ## Connect FileCloud to Oleria **1. Open the integration** Go to your Oleria workspace, select **Integrations** -> select **FileCloud**. **2. Complete the connection form** | Field | Notes | | :- | :- | | FileCloud server URL | Required. Your FileCloud Online site, for example `https://acme.filecloudonline.com`, or your FileCloud Server's HTTPS address. A path is kept if your server runs under one. You can't change this later. | | Admin username | Required. The integration user's username, or the Main Admin's login. | | Admin password | Required when you first connect. The account's password. Oleria stores it in a secrets vault. | When you edit the integration later, leave **Admin password** blank to keep the stored password. If you change **Admin username**, enter that account's password. **3. Authenticate** Select **Authenticate**. Oleria signs in to FileCloud and reads the user list before saving. The connection fails if the account requires 2FA at admin login, or can't list users. ## Verify the integration Confirm the FileCloud site appears on the **Connected** tab of your Oleria **Integrations** page. After the first sync completes, review the discovered accounts, groups, roles, shares, Network Folders, non-human identities, and activity in your Oleria workspace. > [!NOTE] > > Oleria signs in as the admin account each time it syncs, so the sign-ins appear in FileCloud's audit log. Oleria leaves its own activity out of the activity it imports. If you change the account's password in FileCloud, edit the integration in Oleria, enter the new password, and select **Update**. ## Remediation actions Oleria can take the following actions in FileCloud. Before each action, Oleria checks that the admin account holds the **Update** permissions the action needs. The Main Admin has all of them. | Action | What it does | Required FileCloud permission | Revert | | :- | :- | :- | :- | | Disable user account | Sets the user's access level to **Disabled**. | **Users: Read**, **Users: Update** | Supported - restores the previous access level, including Guest or External. | | Enable user account | Sets a disabled user's access level to **Full**. | **Users: Read**, **Users: Update** | Supported - disables the user again. | | Add user to group | Adds the user to a FileCloud group. | **Groups: Read**, **Groups: Update** | Supported - removes the user. | | Remove user from group | Removes the user from a FileCloud group. | **Groups: Read**, **Groups: Update** | Supported - adds the user back. | | Add user to role | Adds the user to an admin role. | **Manage Administrators: Read**, **Manage Administrators: Update** | Supported - removes the user from the role. | | Remove user from role | Removes the user from an admin role. | **Manage Administrators: Read**, **Manage Administrators: Update** | Supported - adds the user back. | | Revoke access to a resource | Removes a user's direct access to a share, or to a Network Folder. | **Users: Read**, **User Share: Read**, **User Share: Update**, **Network Share: Read**, **Network Share: Update** | Supported - adds the user back with the permissions or write mode they had. | | Revoke anonymous access | Turns off a share's public link. | **User Share: Read**, **User Share: Update** | Supported - turns the link back on with its previous settings, unless the link had a password. | | Revoke user sessions | Ends the user's active FileCloud sessions. | **Users: Read**, **Users: Update** | Not supported - the user signs in again. | | Disable non-human identity | Disables an API application credential (running it on the application's client secret disables the whole application, so every token issued to it stops working), revokes an issued app token, turns off a public link, or blocks a client device from signing in. | **Settings: Read**, **Settings: Update**, **User Share: Read**, **User Share: Update**, **Users: Read**, **Users: Update** | Supported for application credentials and public links. Not supported for app tokens and devices: issue a new token, or unblock the device in the FileCloud admin portal. | If a group is synced from Active Directory or SSO, Oleria still changes its membership but warns you that the next directory sync may undo the change. > [!NOTE] > > Oleria refuses to: > > * change the admin account Oleria signs in with, or block its devices > * change the Main Admin or the Team Folder account. Disabling the Team Folder account would cut off every Team Folder. > * change membership of the built-in **EVERYONE** group, which FileCloud manages automatically > * revoke a share owner's access to their own share > * grant or remove the built-in Main Admin or promoted admin roles, or user policies. Only admin roles can be changed. > [!WARNING] > > If a public link had a password, Oleria can't restore the password, so turning the link off can't be reverted. Share the item again in FileCloud if needed. ## Known limitations * **Admin-portal 2FA** - the admin account Oleria uses can't require two-factor authentication at admin login. * **Folder-level permissions** - permissions set on folders inside a Team Folder aren't mapped. Access is shown at the share, so it can appear broader than it is. * **Nested shares** - a share inside another shared folder isn't shown as part of it. * **Unshared files and folders** - only shares and Network Folders appear as resources. * **NTFS permissions on Network Folders** - when a Network Folder uses NTFS permissions, the effective access comes from Active Directory, which FileCloud doesn't expose. Oleria shows the users and groups assigned in FileCloud. * **Group access changes** - Oleria can't remove a group from a share, a Network Folder, or an admin role. * **Last password change and per-user MFA enrollment** - FileCloud doesn't expose them. MFA requirements come from each user's effective policy. * **Admins through groups** - a user who is an admin only through a group's admin role isn't flagged as an admin on their account. The access appears on the group's role. * **Superadmin** - on a multi-tenant FileCloud Server, the superadmin above the sites isn't visible from a site admin account. * **Activity details** - FileCloud's audit log doesn't name the object each event changed, so Oleria shows the event's message instead. ## Contact us For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.