What Oleria discovers
Once connected, Oleria continuously discovers and maps the following from your Vault:- Accounts - every user of the Vault, with their name, email address, user name, status, created date, and last login. Users with an External User license are marked as external. Users with the Vault Owner or System Admin security profile, and Domain Admins, are marked as administrators.
- Roles - the user’s security profile, license type, and Domain Admin status. Oleria also imports the catalog of application roles, without per-document assignments.
- User groups - system-provided, user-managed, and auto-managed groups with their members. Members that a group gains through a security profile are marked as implied members.
- Non-human identities - API access tokens, each linked to the user it authenticates as when Vault reports the token’s owner, and Vault system users, which are marked as machine accounts.
- Single sign-on - whether each user signs in with single sign-on or a Vault password, based on the user’s security policy.
- Activity - login, domain, system, and user-record audit events from the Vault audit trails.
Oleria doesn’t import documents, binders, or object records, or the sharing roles on them. This integration covers identity and access governance for people, groups, and tokens only.
Prerequisites
- A Vault user with access to the Vault API and the System Admin or Vault Owner security profile, or a custom profile that can read users, groups, security policies, and audit trails. When you connect, Oleria rejects a token whose user can’t read the Vault’s users, groups, and security policies.
- Admin access to the Oleria workspace.
- Optional: access to the domain audit trail, if you want Oleria to import domain-level changes. If the token’s user can’t read it, Oleria skips that trail and still imports everything else.
Create an API access token in Veeva Vault
1
Sign in as the integration user
Sign in to the Vault you want to connect as the integration user that will own the token.
2
Open API access tokens
Open your user profile, then find API Access Tokens.
3
Generate the token
Create a new token with a name such as
Oleria Integration. Leave the expiration date empty only if your security profile allows non-expiring tokens. Each user can hold up to 25 active tokens.4
Copy the token
Copy the token somewhere secure. It starts with
veeva-vault-.An API access token works only for the Vault it was generated in. Generate a separate token in each Vault you want to connect. The exact location of these settings can change over time. If the steps above don’t match what you see, refer to Veeva’s Vault API documentation.
Connect Veeva Vault to Oleria
1
Open the integration
Go to your Oleria workspace, select Integrations -> select Veeva Vault.
2
Complete the connection form
Select Continue and provide the following:
3
Confirm the connection
Select Authenticate to validate the token. Oleria rejects tokens whose user can’t read the Vault’s users, groups, and security policies. Find the newly connected Vault on the Connected tab of your Oleria Integrations page.
Add one integration for each Vault. You can connect each Vault to Oleria once. To use a token from a different Vault, add a new integration.
Verify the integration
Confirm the Vault appears on the Connected tab of your Oleria Integrations page with a status of Healthy. After the first sync completes, you can review the discovered accounts, roles, groups, and tokens in your Oleria workspace.If you delete or replace the token in Vault, update it in Oleria by editing the integration and entering the new token. A deleted or expired token causes the sync to fail. You can’t change the Vault DNS of an existing integration; add a new integration instead.
Remediation actions
Oleria can take these actions in Veeva Vault. Each one runs with the permissions of the token’s user. With a custom security profile, the actions also need edit permission on users (to disable and re-enable) and on groups (to change membership):- Disable a user and re-enable a user in the connected Vault. Disabling keeps the user’s security profile and license type, so re-enabling restores the same access. The user stays active in your other Vaults.
- Add a user to a group and remove a user from a group.
- Oleria won’t disable the user that owns the connection’s token, because that would disconnect the integration.
- Vault manages the membership of auto-managed groups, so Oleria can’t change it.
- If a user belongs to a group because their security profile is attached to the group, Oleria can’t remove them from it, even if they were also added to the group directly. Change the user’s security profile or the group’s security profiles in Vault instead.
Known limitations
- The Vault API doesn’t expose MFA settings. Your identity provider enforces MFA for users who sign in with single sign-on.
- Oleria doesn’t import password change dates.
- Last login reflects sign-ins to the Vault UI. Sign-ins through the API appear in activity, not in last login.
- Oleria imports the last 30 days of audit history when you connect, then keeps it current. Vault’s audit query API reaches back only 30 days; older history is available from Vault as a full audit trail export, which Oleria doesn’t import.
- Oleria can’t tell when a custom security profile grants administrator permissions, so only the Vault Owner and System Admin profiles, and Domain Admins, are marked as administrators.