Skip to main content
Infisical is a secrets management platform. Connect your Infisical organization to Oleria to see every person and machine identity that can reach your projects, through which role, and what they did.

​
What Oleria discovers

Oleria reads your Infisical organization through the Infisical API on its regular sync schedule:
  • Users - organization members, including pending invitations and deactivated members, with their email, organization role, sign-in methods, and last login time. Pending and deactivated members are shown as disabled.
  • Groups - Infisical groups, their member users and machine identities, and the organization and project roles each group holds. Infisical offers groups on its Enterprise plan.
  • Roles - organization roles and the project roles of each project, built-in and custom, and which users, machine identities and groups hold each. Temporary project role grants appear while they are active.
  • Non-human identities - machine identities, at the organization level and inside projects, with their last login time. Each Universal Auth client secret and Token Auth token is also shown as a non-human identity and a credential linked to the machine identity it authenticates, with its status (active, expired, use limit reached, or revoked).
  • Activity - the organization audit log: user and machine identity logins, membership, group and role changes, credential changes, and secret reads and changes, with the IP address and, for requests from a web browser, the browser and operating system. Infisical keeps audit logs only on its Pro plan and higher, so on other plans Oleria syncs no activity.
Oleria never calls Infisical’s secret endpoints, so it never reads or stores secret values.

​
Prerequisites

  • An Infisical organization on Infisical Cloud (US or EU region) or a self-hosted Infisical instance.
  • An Infisical user who can create machine identities and add them to projects.
  • Admin access on the Oleria platform to add a new integration.

​
Create a machine identity in Infisical

Oleria connects as an Infisical machine identity, so the connection doesn’t depend on any one person’s account.
1

Create the machine identity

In Infisical, go to Access Control -> Machine Identities in your organization and select Create. Name it (for example, oleria) and give it the Admin organization role. To use a custom role instead, include these permissions:Infisical offers custom organization roles on its higher plans.
2

Add the machine identity to each project

Infisical only shows a project’s members and roles to members of that project. For each project you want Oleria to govern, open the project, go to Access Control -> Machine Identities, select Add Machine Identity to Project, then Assign Existing. Choose the identity and the Viewer project role.To add or remove users’ project roles with Oleria, give the identity the project Admin role instead, or a project role with member:edit and member:grant-privileges.
The Viewer role can read secret values in the project. Oleria uses it only to read the project’s members and roles, and never calls Infisical’s secret endpoints.
3

Create the credential

New machine identities use Universal Auth by default. On the identity’s page, copy the Client ID, then select Add Client Secret. Leave TTL at 0 and Max Number of Uses at 0, so the client secret never expires and has no use limit. Copy the client secret.

​
Connect Infisical to Oleria

1

Open the integration

Go to your Oleria workspace, select Integrations, then select the Infisical tile.
2

Complete the connection form

Oleria finds your organization from the machine identity, so you don’t enter an organization ID. When you edit the integration, leave the secret field blank to keep the stored value. If you change the authentication method, client ID, identity ID, or LDAP username, enter the secret again.
3

Save the integration

Select Authenticate to save the integration.

​
Verify the integration

Confirm the new instance appears on the Connected tab of your Integrations page with a status of Healthy. Oleria’s connection check reads your members, machine identities, roles, and groups. If Infisical denies one of these reads, the error names the permission the machine identity is missing.

​
Remediation actions

Every action also needs identity:read and role:read, which Oleria uses to check the machine identity’s own permissions before it acts. Revert only undoes a change the action made. Reverting a user or membership change skips it if the user or membership changed since. Oleria never revokes a credential of the machine identity the connection itself uses.

​
Known limitations

  • Infisical keeps audit logs on its Pro, Advanced and Enterprise plans, for as long as your plan’s retention. On other plans Infisical returns no audit events, and Oleria syncs everything else without activity.
  • Groups appear on Infisical plans that include groups (Enterprise). On other plans, Oleria syncs everything else without groups, and Create group fails with a message that it needs the Enterprise plan.
  • Oleria reads project roles and members only for projects the machine identity is a member of. Add the identity to every project you want governed.
  • Machine identities have no disabled state in Infisical. To disable one, revoke its client secrets and tokens with Disable NHI. Machine identities that sign in with other methods (for example JWT, LDAP, Kubernetes, AWS, or OIDC auth) have no Infisical-issued credential to revoke.
  • Infisical’s API doesn’t expose users’ MFA status, whether SSO is enforced, account creation dates, or password change dates. Oleria shows SSO as configured when your organization has an active SAML, OIDC or LDAP configuration. A user’s sign-in methods come from their last login, plus the methods Infisical lists for the user when it returns them.
  • Oleria shows up to 200 Token Auth tokens per machine identity. Legacy service tokens aren’t in Infisical’s API, so they aren’t shown.
  • Infisical’s assume privileges permission is part of a project role’s permissions, not a list of grants, so Oleria doesn’t show who can assume another member’s privileges.
  • Infisical records no owner or creator for machine identities, client secrets or tokens, so none is shown.
  • Infisical’s API has no endpoint to send an invitation, so Delete user can’t be reverted. Re-invite the user in Infisical.
  • Oleria connects to one Infisical organization per integration. Connect each sub-organization separately. Instance administrators of a self-hosted Infisical aren’t visible to an organization’s machine identity.
  • For a self-hosted instance, Oleria must be able to reach your instance URL. Contact support@oleria.com to allow your instance’s address.

​
Contact us

For questions about this integration, contact us at support@oleria.com.