Skip to main content
Oleria provides identity security and access management teams with visibility and intelligence into who has access to what, where they got that access, how they use it, and whether they should even have it. As part of that promise, we deeply integrate your OTRS (or Znuny) instance into the Oleria platform. This document provides step-by-step guidance for integrating OTRS with your Oleria workspace. A single Oleria connection covers your entire OTRS instance - Oleria discovers every agent, group, and role the connection can reach.

​
Prerequisites

  • An OTRS or Znuny instance reachable over HTTPS, with the GenericInterface framework enabled.
  • An OTRS administrator who can configure a GenericInterface webservice and generate a Bearer token.
  • Optional, for ticket activity: a dedicated ticket agent login and password. This is a separate, session-based webservice from the Bearer-token webservice used for everything else.
Use a dedicated service agent (not a named employee account) for both the Bearer token and the optional ticket agent credentials, so the integration keeps working through personnel changes.

​
What Oleria discovers

​
Set up the integration

OTRS authentication uses a Bearer token for the Agent/Group/Role webservice, and (optionally) a separate session-based login for ticket history.
1

Generate a Bearer token for the Agent/Group/Role webservice

In your OTRS admin panel, configure the GenericInterface webservice that exposes the Agent, Group, and Role operations Oleria calls, and generate a Bearer token for it. Consult your OTRS/Znuny administration documentation for your version - token generation is done through the admin UI or the underlying Perl API, not through a customer-facing page.Copy the token - you will enter it in Oleria.
2

Create a ticket agent for activity (optional)

If you want Oleria to collect ticket activity, create (or designate) an agent OTRS can authenticate with a login and password against the Ticket GenericInterface webservice. This webservice authenticates by session (login and password), not by the Bearer token from Step 1.
Ticket agent login and password are optional and independent of the Bearer token. Provide both together or leave both blank - a login without a password (or vice versa) is rejected.

​
Connect OTRS to Oleria

1

Open the integration

Go to your Oleria workspace, select Integrations -> select OTRS.
2

Complete the connection form

Select Continue and fill in the connection form:
3

Save the integration

Select Authenticate to validate and save the integration.

​
Verify the integration

Confirm OTRS appears in your Oleria workspace connected integrations. After the first sync completes, you can review the discovered agents, groups, and roles in your Oleria workspace. If ticket agent credentials were provided, ticket activity appears alongside them.

​
Supported remediation actions

​
Notes and limitations

  • Activity is optional: ticket history requires the ticket agent credentials from Step 2. Without them, Oleria still collects agents, groups, and roles normally.
  • Group hierarchy is inferred from group naming conventions, not a native OTRS parent/child relationship.
  • No dynamic tenant discovery: one connection maps to exactly one OTRS instance.
  • No bulk operations: remediation actions operate on one agent at a time.
  • No group-scoped roles: OTRS roles are assigned instance-wide, not per group.

​
Contact us

For questions about this integration, contact us at support@oleria.com.