Skip to main content
Connect Fleet to Oleria to see who can administer your device fleet: which users and automation identities hold a global role or a role on a fleet, which API tokens and enroll secrets exist, and who signed in or changed access. Oleria reads this from the Fleet REST API. This integration works with self-hosted Fleet servers and Fleet-managed cloud (https://<company>.cloud.fleetdm.com). One Oleria connection maps one Fleet server.

​
What Oleria discovers

Once connected, Oleria continuously discovers and maps the following from the Fleet server:
  • Users - every Fleet user, with their global role or fleet roles, position, sign-in method (password, single sign-on, or Fleet’s email-based MFA), creation date, and last activity. Users with no role are shown as disabled. Oleria treats Fleet as an MFA provider only when Fleet’s own MFA can run: on Fleet Premium, with email (SMTP) configured on the server.
  • API-only users - Fleet API-only users, shown as non-human identities of type Service account.
  • API tokens - the token of each API-only user, as a credential linked to that user, with the date it was issued. On Fleet Premium, a token limited to specific API endpoints lists those endpoints.
  • Enroll secrets - the global enroll secret and each fleet’s enroll secrets, shown as non-human identities of type API token with their creation dates. Oleria never reads or stores the secret values.
  • Fleets - each fleet (formerly called a team), shown as a group, with its members and each member’s role.
  • Roles - the global roles (Admin, Maintainer, Observer, and on Fleet Premium Observer+, Technician, and GitOps) and the same roles on each fleet, with who holds them.
  • Activity - Fleet’s audit log, including sign-ins, failed sign-ins, user creation and deletion, role changes, fleet changes, enroll secret changes, and reads of host disk encryption keys and recovery passwords.
Hosts, software, policies, reports, scripts, and labels are not synced.

​
Prerequisites

  • A Fleet server reachable over HTTPS from the internet at a public address. Servers that are only reachable on a private network or VPN can’t be connected.
  • A Fleet user for Oleria. We recommend an API-only user’s API token, which doesn’t expire and isn’t tied to a person. You can also connect with a Fleet user’s email and password. The user’s role sets what Oleria can do:
    • Global observer lets Oleria read users, fleets, roles, enroll secrets of fleets, and the audit log.
    • Global admin is also required to read API-only users’ tokens and the global enroll secret, and to run remediation actions.
  • Fleet Premium for fleets, fleet roles, Fleet’s email-based MFA, the Observer+, Technician, and GitOps roles, and the Create group action. On Fleet Free, Oleria syncs users, API-only users and their tokens, the global enroll secret, global roles, and activity.

​
Create an API-only user in Fleet

1

Create the user

As a Fleet global admin, run fleetctl user create --api-only --name "Oleria" --global-role observer (use admin instead of observer to enable remediation actions). Fleet prints the user’s API token.
2

Copy the token

Copy the token. API-only user tokens don’t expire.
You can also use the token from a person’s My account -> Get API token page, but it expires with the server’s session duration and ties the integration to that person.

​
Use an email and password instead

With Email and password, Oleria signs in to Fleet as that user each time it syncs. Each sign-in opens a Fleet session and adds a sign-in to Fleet’s activity log. Fleet doesn’t allow API sign-in for users who sign in with single sign-on or Fleet’s email-based MFA, so connect those users with an API token instead.

​
Connect Fleet to Oleria

1

Open the integration

Go to your Oleria workspace, select Integrations -> select Fleet.
2

Complete the connection form

When you edit the integration later, leave API token or Password blank to keep the stored value. If you switch the authentication method, enter the new method’s credential.
3

Authenticate

Select Authenticate to validate and save the integration. Oleria checks the token, or signs in with the email and password, against your Fleet server before saving.

​
Verify the integration

Confirm the Fleet instance appears on the Connected tab of your Oleria Integrations page. After the first sync completes, review the discovered users, fleets, roles, and non-human identities in your Oleria workspace.

​
Remediation actions

When Oleria connects as a Global admin, it can take the following actions:
Oleria refuses to:
  • change or delete the integration’s own Fleet user
  • add a user who has a global role to a fleet, or give them a fleet role their global role doesn’t already cover, because Fleet doesn’t let a user hold a global role and a fleet role at the same time
  • remove a global role, because Fleet requires every user to have a role. Assign a different role instead.
  • assign a role that would replace a broader or unrelated role the user holds, such as Observer over Technician, or a global role that is narrower than one of the user’s fleet roles. Remove the existing role first.
  • revoke sessions of an API-only user (use Disable non-human identity), or disable an enroll secret

​
Known limitations

  • Users can’t be disabled. Fleet has no disabled state. Delete user removes a user’s access, but it can’t be undone.
  • Pending invitations aren’t synced.
  • Last password change isn’t available. Fleet doesn’t expose it.
  • MFA for single sign-on users isn’t shown. It’s enforced by your identity provider.
  • Enroll secrets can’t be disabled. Fleet replaces the secret list as a whole, and removing a secret breaks enrollment for installers built with it.
  • The audit log’s source IP is only recorded for sign-ins.

​
Contact us

For questions about this integration, contact us at support@oleria.com.