# Custom connector with a combination of attribute and group security?
**URL:** https://discuss.elastic.co/t/custom-connector-with-a-combination-of-attribute-and-group-security/279008
**Category:** Elastic Search
**Tags:** elastic-workplace-search
**Created:** [July 19, 2021, 2:48am UTC](https://discuss.elastic.co/t/custom-connector-with-a-combination-of-attribute-and-group-security/279008 "2021-07-19T02:48:02Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@catmanjan](https://discuss.elastic.co/u/catmanjan)
#### Post date: [July 19, 2021, 2:48am UTC](https://discuss.elastic.co/t/custom-connector-with-a-combination-of-attribute-and-group-security/279008/1 "2021-07-19T02:48:02Z")
Hello, I want to build a custom connector, but the source repository uses attribute based security (e.g. [Document-level security - OpenSearch documentation](https://opensearch.org/docs/security-plugin/access-control/document-level-security/#attribute-based-security))
So for a user to see a document they would need all of the permissions listed in \_allow\_permissions for example.
Is this possible out of the box?
---
### Author:  [@ross.bell](https://discuss.elastic.co/u/ross.bell)
#### Post date: [July 19, 2021, 3:46pm UTC](https://discuss.elastic.co/t/custom-connector-with-a-combination-of-attribute-and-group-security/279008/2 "2021-07-19T15:46:30Z")
Hey @catmanjan,
The permissions matching uses intersection logic, with an intersection of _deny_ permissions taking precedence over _allow_ permissions. I believe you should be able to get the result you're looking for.
I also want to point out that you've linked to some documentation that isn't specific to Workplace Search. I think this documentation should be a little more relevant: [Defining Document Permissions for custom sources | Workplace Search Guide [7.13] | Elastic](https://www.elastic.co/guide/en/workplace-search/current/workplace-search-document-permissions.html).
I hope that helps!
Ross
---
### Author:  [@catmanjan](https://discuss.elastic.co/u/catmanjan)
#### Post date: [July 19, 2021, 10:00pm UTC](https://discuss.elastic.co/t/custom-connector-with-a-combination-of-attribute-and-group-security/279008/3 "2021-07-19T22:00:27Z")
Thanks, does anyone know specifically if there is a way to say a user requires all listed permissions to see a document?
Using deny will be difficult as it isn't known ahead of time all of the possible permission permutations that exist
---
### Author:  [@ross.bell](https://discuss.elastic.co/u/ross.bell)
#### Post date: [July 20, 2021, 1:34pm UTC](https://discuss.elastic.co/t/custom-connector-with-a-combination-of-attribute-and-group-security/279008/4 "2021-07-20T13:34:15Z")
Interesting, I think you'd have to set the permissions on the documented as a single value of the combined permission attributes. Then make sure that single combined value is set on the user. It would be a little awkward, especially since I'm assuming there would be other attribute combinations from other documents to account for as well. However, it should achieve the requirement that the user have _all_ permissions attributes, not just an intersection. This would probably require using a [custom API source](https://www.elastic.co/guide/en/workplace-search/current/workplace-search-custom-api-sources.html).
Elastic is introducing some functionality in an upcoming release that would let you selectively index a subset of content in case you would actually just prefer to index a more commonly accessed set of documents that aren't subject to complex attribute based permissions.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 4, 2022, 8:31am UTC](https://discuss.elastic.co/t/custom-connector-with-a-combination-of-attribute-and-group-security/279008/6 "2022-11-04T08:31:31Z")