> ## Documentation Index > Fetch the complete documentation index at: https://docs.oleria.com/llms.txt > Use this file to discover all available pages before exploring further. # Infisical > Connect your Infisical organization to Oleria to discover who can reach your secrets: users, machine identities and their credentials, groups, organization and project roles, and the audit log. Infisical is a secrets management platform. Connect your Infisical organization to Oleria to see every person and machine identity that can reach your projects, through which role, and what they did. ## What Oleria discovers Oleria reads your Infisical organization through the Infisical API on its [regular sync schedule](/integrations/overview.md#sync-model): * **Users** - organization members, including pending invitations and deactivated members, with their email, organization role, sign-in methods, and last login time. Pending and deactivated members are shown as disabled. * **Groups** - Infisical groups, their member users and machine identities, and the organization and project roles each group holds. Infisical offers groups on its Enterprise plan. * **Roles** - organization roles and the project roles of each project, built-in and custom, and which users, machine identities and groups hold each. Temporary project role grants appear while they are active. * **Non-human identities** - machine identities, at the organization level and inside projects, with their last login time. Each Universal Auth client secret and Token Auth token is also shown as a non-human identity and a credential linked to the machine identity it authenticates, with its status (active, expired, use limit reached, or revoked). * **Activity** - the organization audit log: user and machine identity logins, membership, group and role changes, credential changes, and secret reads and changes, with the IP address and, for requests from a web browser, the browser and operating system. Infisical keeps audit logs only on its Pro plan and higher, so on other plans Oleria syncs no activity. Oleria never calls Infisical's secret endpoints, so it never reads or stores secret values. ## Prerequisites * An Infisical organization on Infisical Cloud (US or EU region) or a self-hosted Infisical instance. * An Infisical user who can create machine identities and add them to projects. * Admin access on the Oleria platform to add a new integration. ## Create a machine identity in Infisical Oleria connects as an Infisical machine identity, so the connection doesn't depend on any one person's account. **1. Create the machine identity** In Infisical, go to **Access Control** -> **Machine Identities** in your organization and select **Create**. Name it (for example, `oleria`) and give it the **Admin** organization role. To use a custom role instead, include these permissions: | Permission | Used for | | :- | :- | | `member:read` | Users | | `identity:read`, `identity:get-token` | Machine identities, client secrets and tokens | | `groups:read` | Groups | | `role:read` | Roles | | `audit-logs:read` | Activity | | `member:edit`, `member:delete` | Required for actions: deactivate, reactivate and remove users | | `member:grant-privileges` | Required for actions: change a user's organization role | | `groups:add-members`, `groups:remove-members` | Required for actions: add or remove a user in a group | | `groups:create`, `groups:delete` | Required for actions: create a group | | `identity:edit`, `identity:delete-token` | Required for actions: revoke tokens and client secrets | Infisical offers custom organization roles on its higher plans. **2. Add the machine identity to each project** Infisical only shows a project's members and roles to members of that project. For each project you want Oleria to govern, open the project, go to **Access Control** -> **Machine Identities**, select **Add Machine Identity to Project**, then **Assign Existing**. Choose the identity and the **Viewer** project role. To add or remove users' project roles with Oleria, give the identity the project **Admin** role instead, or a project role with `member:edit` and `member:grant-privileges`. > [!NOTE] > > The Viewer role can read secret values in the project. Oleria uses it only to read the project's members and roles, and never calls Infisical's secret endpoints. **3. Create the credential** **Universal Auth (recommended)** New machine identities use Universal Auth by default. On the identity's page, copy the **Client ID**, then select **Add Client Secret**. Leave **TTL** at `0` and **Max Number of Uses** at `0`, so the client secret never expires and has no use limit. Copy the client secret. **Token Auth** On the identity's page, edit the **Authentication** section and add a Token Auth configuration. Set the access token TTL and max TTL to the longest your policy allows. Then select **Add Token** and copy the token. Update the integration in Oleria before the token expires. **JWT Auth** > [!WARNING] > > JWT Auth sign-in currently fails with a server error from Infisical. Use Universal Auth, and contact [support@oleria.com](mailto:support@oleria.com) if you need JWT Auth. Create an RSA key pair, or an EC key pair on the P-256, P-384 or P-521 curve, in PEM format. On the identity's page, edit the **Authentication** section and add a JWT Auth configuration that uses the static configuration. Paste the public key into **Public Keys**. Oleria signs a 5-minute token for each sign-in with the issuer `oleria`, the audience `infisical`, and the identity's ID as the subject. Set **Issuer** to `oleria`, **Audiences** to `infisical`, and **Subject** to the identity's ID, so the identity accepts only these tokens. Copy the identity's ID from its page, and keep the private key for the connection form. **LDAP Auth** LDAP Auth needs an Infisical Enterprise plan. On the identity's page, select **Add Auth Method**, then **LDAP Auth**. Enter your directory's **URL**, **Bind DN**, **Bind Pass**, **Search Base / DN**, and **User Search Filter**, then select **Add**. Choose a directory user for Oleria that this configuration accepts, such as a dedicated service account. Copy the identity's ID from its page. Update the integration in Oleria when the directory user's password changes. ## Connect Infisical to Oleria **1. Open the integration** Go to your Oleria workspace, select **Integrations**, then select the **Infisical** tile. **2. Complete the connection form** | Field | Notes | | :- | :- | | Authentication method | **Universal Auth** (default), **Token Auth**, **JWT Auth**, or **LDAP Auth**. | | Region | **US (app.infisical.com)**, **EU (eu.infisical.com)**, or **Self-hosted**. You can't change it after the connection is created. | | Instance URL | Required for **Self-hosted**. The `https` address of your instance, with no path (for example, `https://infisical.example.com`). | | Client ID | Required for Universal Auth. The machine identity's Client ID. | | Client secret | Required for Universal Auth. The client secret you created. | | Access token | Required for Token Auth. The token you created. | | Identity ID | Required for JWT Auth and LDAP Auth. The machine identity's ID. | | Private key | Required for JWT Auth. The PEM private key whose public key you added to the identity. | | LDAP username | Required for LDAP Auth. The directory user the identity's LDAP Auth accepts. | | LDAP password | Required for LDAP Auth. That directory user's password. | Oleria finds your organization from the machine identity, so you don't enter an organization ID. When you edit the integration, leave the secret field blank to keep the stored value. If you change the authentication method, client ID, identity ID, or LDAP username, enter the secret again. **3. Save the integration** Select **Authenticate** to save the integration. ## Verify the integration Confirm the new instance appears on the **Connected** tab of your **Integrations** page with a status of **Healthy**. Oleria's connection check reads your members, machine identities, roles, and groups. If Infisical denies one of these reads, the error names the permission the machine identity is missing. ## Remediation actions | Action | What it does | Revert | Infisical permission | | :- | :- | :- | :- | | Disable user account | Deactivates the user's organization membership. A user who is already deactivated is left unchanged. | Yes, reactivates the user | `member:read`, `member:edit` | | Enable user account | Reactivates a deactivated organization membership. A user with a pending invitation can't be enabled; the account becomes enabled when the user accepts the invitation. | Yes, deactivates the user again | `member:read`, `member:edit` | | Delete user | Removes the user from the Infisical organization. | No | `member:read`, `member:delete` | | Add user to group / Remove user from group | Adds or removes a user in an Infisical group. | Yes | `groups:read`, `member:read`, `groups:add-members` / `groups:remove-members` | | Add user to role | For an organization role, replaces the user's organization role, since an Infisical member holds exactly one. For a project role, adds the role to the user's roles on that project and keeps their other project roles; the user must already be a member of the project. A user who already holds the role is left unchanged. | Yes, restores the previous organization role or removes the added project role | Organization role: `member:read`, `member:edit`, `member:grant-privileges`, `role:read`. Project role: `member:read`, `role:read`, plus `member:edit` and `member:grant-privileges` on the project | | Remove user from role | Removes a project role from the user and keeps their other project roles. Organization roles can't be removed; use **Add user to role** to assign a different one. Removing the user's only role on a project is refused, because Infisical requires at least one. | Yes, adds the project role back, including the time window of a temporary role | `member:read`, `role:read`, plus `member:edit` and `member:grant-privileges` on the project | | Create group | Creates an organization group with the name you give. If a group with that name already exists, nothing changes. Needs Infisical's Enterprise plan. | Yes, deletes the group the action created, even if members or roles were added since | `groups:read`, `groups:create`, `groups:delete` | | Disable NHI | Revokes a Universal Auth client secret or a Token Auth token. A credential that is already revoked is left unchanged. | No | Client secret: `identity:get-token`, `identity:delete-token`. Token: `identity:read`, `identity:edit` | Every action also needs `identity:read` and `role:read`, which Oleria uses to check the machine identity's own permissions before it acts. Revert only undoes a change the action made. Reverting a user or membership change skips it if the user or membership changed since. Oleria never revokes a credential of the machine identity the connection itself uses. ## Known limitations * Infisical keeps audit logs on its Pro, Advanced and Enterprise plans, for as long as your plan's retention. On other plans Infisical returns no audit events, and Oleria syncs everything else without activity. * Groups appear on Infisical plans that include groups (Enterprise). On other plans, Oleria syncs everything else without groups, and **Create group** fails with a message that it needs the Enterprise plan. * Oleria reads project roles and members only for projects the machine identity is a member of. Add the identity to every project you want governed. * Machine identities have no disabled state in Infisical. To disable one, revoke its client secrets and tokens with **Disable NHI**. Machine identities that sign in with other methods (for example JWT, LDAP, Kubernetes, AWS, or OIDC auth) have no Infisical-issued credential to revoke. * Infisical's API doesn't expose users' MFA status, whether SSO is enforced, account creation dates, or password change dates. Oleria shows SSO as configured when your organization has an active SAML, OIDC or LDAP configuration. A user's sign-in methods come from their last login, plus the methods Infisical lists for the user when it returns them. * Oleria shows up to 200 Token Auth tokens per machine identity. Legacy service tokens aren't in Infisical's API, so they aren't shown. * Infisical's assume privileges permission is part of a project role's permissions, not a list of grants, so Oleria doesn't show who can assume another member's privileges. * Infisical records no owner or creator for machine identities, client secrets or tokens, so none is shown. * Infisical's API has no endpoint to send an invitation, so **Delete user** can't be reverted. Re-invite the user in Infisical. * Oleria connects to one Infisical organization per integration. Connect each sub-organization separately. Instance administrators of a self-hosted Infisical aren't visible to an organization's machine identity. * For a self-hosted instance, Oleria must be able to reach your instance URL. Contact [support@oleria.com](mailto:support@oleria.com) to allow your instance's address. ## Contact us For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.