# How to add user / group permission to search Workplace Search using Network data connector as data source **URL:** \ **Category:** Elastic Search\ **Tags:** elastic-workplace-search\ **Created:** [April 17, 2023, 6:25pm UTC](https://discuss.elastic.co/t/how-to-add-user-group-permission-to-search-workplace-search-using-network-data-connector-as-data-source/330157 "2023-04-17T18:25:49Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![aldol](https://avatars.discourse-cdn.com/v4/letter/a/9f8e36/32.png) [@aldol](https://discuss.elastic.co/u/aldol)\ **Post date:** [April 17, 2023, 6:25pm UTC](https://discuss.elastic.co/t/how-to-add-user-group-permission-to-search-workplace-search-using-network-data-connector-as-data-source/330157/1 "2023-04-17T18:25:49Z")
I can add user to have access to Workplace search and search documents from the index created by Network Drive Connector. Basically I add user **SID** and **email** in **identity\_mappings.csv** file and run **ees\_network\_drive permission-sync**. When I do the same with AD group, members in the AD group cannot search. Question: How can I give permission to AD group so member of the AD group can use Workplace Search? ---
**Author:** ![Serena\_Chou](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/serena_chou/32/100087_2.png) [@Serena\_Chou](https://discuss.elastic.co/u/Serena_Chou)\ **Post date:** [April 18, 2023, 2:10pm UTC](https://discuss.elastic.co/t/how-to-add-user-group-permission-to-search-workplace-search-using-network-data-connector-as-data-source/330157/2 "2023-04-18T14:10:41Z")
Hey there. This [GitHub - elastic/enterprise-search-network-drive-connector: Official Enterprise Search | Workplace Search - Network Drives Connector](https://github.com/elastic/enterprise-search-network-drive-connector) is a custom content source type: [Managing document access & permissions for content sources | Workplace Search documentation [8.7] | Elastic](https://www.elastic.co/guide/en/workplace-search/current/workplace-search-sources-document-permissions.html#sources-permissions-custom) So this is the relevant guide to help you with attaching this to the Workplace Search experience. ---
**Author:** ![aldol](https://avatars.discourse-cdn.com/v4/letter/a/9f8e36/32.png) [@aldol](https://discuss.elastic.co/u/aldol)\ **Post date:** [April 19, 2023, 1:00am UTC](https://discuss.elastic.co/t/how-to-add-user-group-permission-to-search-workplace-search-using-network-data-connector-as-data-source/330157/3 "2023-04-19T01:00:11Z")
@Serena_Chou I read all above. My documents has **user** level and **AD group** level permissions. When user gets to workplace search can search document successfully that have user level permission. So far so good. But if other user who is the member of the group cannot search the document. Example: - **Document1** - **Permissions** : _user1_ and _group1_ In above example _user1_ and _group1_ have permission to **Document1** _user2_ is a member of _group1_ If _user1_ searches the document, he can get to the document. Bu if _user2_ (who is the member of _group1_) searches the Document1, cannot find Document1. Basically members of the groups cannot search documents, although their group have permission to the document. ---
**Author:** ![Sean\_Story](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sean_story/32/69987_2.png) [@Sean\_Story](https://discuss.elastic.co/u/Sean_Story)\ **Post date:** [April 19, 2023, 4:53pm UTC](https://discuss.elastic.co/t/how-to-add-user-group-permission-to-search-workplace-search-using-network-data-connector-as-data-source/330157/4 "2023-04-19T16:53:39Z")
@aldol have you added the user's group SIDs (mapped to their email addresses) in your identity\_mappings.csv as well? Note from this document: [GitHub - elastic/enterprise-search-network-drive-connector: Official Enterprise Search | Workplace Search - Network Drives Connector](https://github.com/elastic/enterprise-search-network-drive-connector#map-user-identities) > Copy to your server a CSV file that provides the mapping of user identities. The file must follow this format: > > - First column: network drive user's/group's SID > - Second column: Elastic username ---
**Author:** ![aldol](https://avatars.discourse-cdn.com/v4/letter/a/9f8e36/32.png) [@aldol](https://discuss.elastic.co/u/aldol)\ **Post date:** [April 19, 2023, 4:58pm UTC](https://discuss.elastic.co/t/how-to-add-user-group-permission-to-search-workplace-search-using-network-data-connector-as-data-source/330157/5 "2023-04-19T16:58:20Z")
@Sean_Story Yes I did. I added the **SID** which is clear what is it and next to it I added the **Name** coming from the Powershell script below: get-adgroup MY-GROUP | Select **Name** ,SID,ObjectGUID | FL So Whatever comes out Select **Name** in above is added with the same format I added individuals. S-1-5-21-212344-4355-3455-81545,MY-GROUP What would be the Second column: Elastic username **Email** of the Group or the Group **Name**? ---
**Author:** ![Sean\_Story](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sean_story/32/69987_2.png) [@Sean\_Story](https://discuss.elastic.co/u/Sean_Story)\ **Post date:** [April 19, 2023, 6:19pm UTC](https://discuss.elastic.co/t/how-to-add-user-group-permission-to-search-workplace-search-using-network-data-connector-as-data-source/330157/6 "2023-04-19T18:19:47Z")
@aldol it sounds like you added extra columns, instead of extra rows. In your above example of `user1` and `user2` who are both in `group1`, your CSV should look like: ```auto user1,elastic-user1 group1,elastic-user1 user2,elastic-user2 group1,elastic-user2 ``` NOT ```auto user1,group1,elastic-user1 user2,group1,elastic-user2 ``` ---
**Author:** ![aldol](https://avatars.discourse-cdn.com/v4/letter/a/9f8e36/32.png) [@aldol](https://discuss.elastic.co/u/aldol)\ **Post date:** [April 19, 2023, 6:57pm UTC](https://discuss.elastic.co/t/how-to-add-user-group-permission-to-search-workplace-search-using-network-data-connector-as-data-source/330157/7 "2023-04-19T18:57:51Z")
@Sean_Story I have 2 users and 1 group as below: **USER | SID | Email** USER1 | SID1 | [USER1@aaa.com](mailto:USER1@aaa.com) USER2 | SID2 | [USER2@aaa.com](mailto:USER2@aaa.com) GROUP1| SID3 | [GROUP1@aaa.com](mailto:GROUP1@aaa.com) On each row I have USER , SID and email. USER2 is a member in GROUP1 What would be my identity\_mappings.csv? I have below for user one and it is working: [SID1,USER1@aaa.com](mailto:SID1,USER1@aaa.com) For GROUP1 what should I add? SID3,GROUP1 or [SID3,USER2@aaa.com](mailto:SID3,USER2@aaa.com) or [GROUP1@aaa.com](mailto:GROUP1@aaa.com),USER2@aaa.com Or something else Please write the identity\_mapping for above 3 rows so USER2 which is the member of GROUP1 can see documents permitted for GROUP1 Remember GROUP1 is Windows AD group and USER1, USER2 are Windows AD users. ---
**Author:** ![Sean\_Story](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sean_story/32/69987_2.png) [@Sean\_Story](https://discuss.elastic.co/u/Sean_Story)\ **Post date:** [April 19, 2023, 7:28pm UTC](https://discuss.elastic.co/t/how-to-add-user-group-permission-to-search-workplace-search-using-network-data-connector-as-data-source/330157/8 "2023-04-19T19:28:09Z")
As explained above, it would not be 3 rows, it would be 4. A single user will have multiple rows - one row for their user SID, and another row for each group they are a part of. For the example you've given in your latest message, your CSV should be: ```auto SID1,USER1@aaa.com SID3,USER1@aaa.com SID2,USER2@aaa.com SID3,USER2@aaa.com ``` ---
**Author:** ![aldol](https://avatars.discourse-cdn.com/v4/letter/a/9f8e36/32.png) [@aldol](https://discuss.elastic.co/u/aldol)\ **Post date:** [April 20, 2023, 1:45pm UTC](https://discuss.elastic.co/t/how-to-add-user-group-permission-to-search-workplace-search-using-network-data-connector-as-data-source/330157/9 "2023-04-20T13:45:54Z")
@Sean_Story The issue is resolved by the above example. The statement below in site was not very clear: \*Copy to your server a CSV file that provides the mapping of user identities. The file must follow this format: \* \*First column: network drive user's/group's SID \* _Second column: Elastic username_ Some samples next to the statement could help a lot 🙂 Thanks for your help 🙂 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 18, 2023, 1:46pm UTC](https://discuss.elastic.co/t/how-to-add-user-group-permission-to-search-workplace-search-using-network-data-connector-as-data-source/330157/10 "2023-05-18T13:46:25Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.