Skip to main content
Connect Metabase to Oleria to see who can sign in to your Metabase instance, which permission groups they belong to, who administers it, and which API keys can act on it. Metabase is a business intelligence platform. Oleria reads one Metabase instance at a time with an API key, so you can review access to Metabase and take action directly from Oleria. Both self-hosted Metabase and Metabase Cloud work. Oleria reads who has access to the instance itself. It doesn’t import collections, dashboards, questions, or databases, and it doesn’t read the data and collection permissions that you set for each group.

​
What Oleria discovers

Once connected, Oleria continuously discovers and maps the following from your Metabase instance:
  • Accounts - every user, including deactivated users (shown as disabled), with their name, email address, the date they joined, their last sign-in, and whether they are an administrator. Oleria also shows how each user signs in: with a password, or through the single sign-on provider that created the account (Google, LDAP, SAML, JWT, or OpenID Connect). Two-factor authentication and single sign-on show the instance’s own settings: Oleria shows single sign-on as required when you turn off password sign-in, and, if your plan includes two-factor authentication (a paid Metabase feature), two-factor authentication as required when your instance enforces it.
  • Groups - every permission group, including the built-in Administrators and All Users groups, and each user’s group memberships. If your plan includes group managers (Metabase Pro and Enterprise), Oleria also shows which users are group managers of a group.
  • Non-human identities and credentials - every API key. Metabase creates an API-only user for each key, and Oleria shows that user as a non-human identity with the key as its credential. Oleria shows the key’s name, its creation date, the group it belongs to, and whether it has full administrator authority or is limited to its group. Oleria never reads or stores a key’s secret.
  • Activity - if your plan includes Usage analytics (Metabase Pro and Enterprise), events from its activity log, such as users invited, joining, updated, deactivated, or reactivated, password resets, two-factor authentication changes, and group membership changes. Each event shows who did it, including events done with an API key, and the user, group, or API key it concerned. Events that Metabase records for itself, or for a user or key that no longer exists, are shown without that account. Metabase keeps usage analytics for 720 days by default. Without Usage analytics, Oleria imports no activity and the rest of the sync still completes (see Known limitations).
Oleria refreshes this data on its regular sync schedule.
Metabase has no roles. Access comes from group membership, and an administrator is a member of the Administrators group, so Oleria shows administrators through that group and each account’s administrator flag.

​
Prerequisites

  • A Metabase instance on version 0.47 or later, the first version with API keys. Use a current release for the best results.
  • A Metabase administrator account to create the API key.
  • A Metabase instance that Oleria can reach over HTTPS at a public address. Self-hosted instances that are only reachable on a private network or VPN, or whose address resolves to a private IP, can’t be connected. Metabase Cloud instances (https://<your-team>.metabaseapp.com) work as they are.
  • If a firewall, reverse proxy, or web application firewall in front of a self-hosted instance only allows known IP addresses, allow Oleria’s IP addresses. To get them, contact support@oleria.com.
  • Admin access to the Oleria workspace.
Metabase has no read-only API scope. A key acts with the permissions of the one group you put it in, and the lists of users, groups, group memberships, and API keys that Oleria reads are available only to administrators. The key must therefore belong to the Administrators group, and Oleria uses the same key for remediation actions. Store the key as an administrative credential. Create it for this purpose, name it clearly (for example Oleria), and don’t delete it in Metabase while the integration is connected.

​
Create an API key in Metabase

1

Open the API keys settings

Sign in to Metabase as an administrator. Select the grid icon in the upper right and select Admin. Go to Settings > Authentication, scroll to API Keys, and select Manage.
2

Create the key

Select Create API Key. Enter a name, for example Oleria, and select the Administrators group. Metabase doesn’t allow two keys with the same name.
3

Copy the key

Select Create, then copy the key. It starts with mb_. Metabase shows the key only once, so store it securely until you have connected Oleria. If you lose it, create a new key and update the integration.

​
Permissions Oleria needs

Oleria checks this when you connect: it refuses a key that isn’t in the Administrators group and tells you why. The Capabilities tab of the integration shows the same requirement for each read and action.

​
Connect Metabase to Oleria

1

Open the integration

Go to your Oleria workspace, select Integrations -> select Metabase.
2

Complete the connection form

Select Continue and provide the following:
3

Authenticate

Select Authenticate. Oleria checks that the key is accepted and belongs to an administrator, then saves the integration.
Each Oleria integration covers one Metabase instance. If you have several instances, add one integration for each.

​
Verify the integration

Confirm the Metabase instance appears on the Connected tab of your Oleria Integrations page with a status of Healthy. After the first sync completes, you can review the discovered users, groups, and API keys in your Oleria workspace.
If you rotate the API key in Metabase, edit the integration in Oleria and enter the new key. If someone deletes the key in Metabase, the integration stops syncing until you enter a new one.

​
Remediation actions

If remediation is enabled for your Metabase integration, Oleria can take these actions in Metabase: Oleria never changes the API key that the integration connects with or the user that key acts as (if it can’t tell which key that is, it deletes no key), and Metabase doesn’t let you add users to or remove them from the built-in All Users group, because every user belongs to it. An action that finds the user or group already in the target state does nothing. Deleting an API key can’t be undone: Metabase shows a key’s secret only when you create it, so create a new key if you need one again.

​
Known limitations

  • Activity needs Usage analytics. Metabase’s audit log is part of Usage analytics, which is available only on the Pro and Enterprise plans. On the open-source edition and on plans without it, Oleria imports no activity. Usage analytics has no sign-in event, so Oleria shows each user’s last sign-in on the account instead, which supports dormant account detection.
  • Group permissions aren’t imported. Oleria shows who is an administrator and which groups each user is in, but not the data and collection permissions each group holds. A user’s access to specific databases, collections, or dashboards doesn’t appear in Oleria.
  • Limited sign-in details. Metabase doesn’t report when a user last changed their password, whether an individual user has enrolled in two-factor authentication, or when an API key was last used, so Oleria doesn’t show them. Two-factor authentication is a paid Metabase feature, so an instance without it shows two-factor authentication as not required.
  • API keys have no owner. Metabase doesn’t record who owns an API key, so Oleria shows no owner for it.
  • Group managers need a paid plan. Group managers are a Metabase Pro and Enterprise feature. On other plans, Oleria shows memberships without a manager role.

​
Existing SCIM connections

Earlier versions of this integration connected through Metabase’s SCIM provisioning with a SCIM base URL and token. This integration replaces it and connects with an API key instead. A connection that you created with a SCIM token doesn’t carry over: add the integration again with a Metabase URL and an API key, then remove the old connection.

​
Contact us

For questions about this integration, contact us at support@oleria.com.