# Index/search with ACLs and parent/child relationship **URL:** \ **Category:** Elasticsearch\ **Created:** [May 18, 2014, 9:01am UTC](https://discuss.elastic.co/t/index-search-with-acls-and-parent-child-relationship/17577 "2014-05-18T09:01:02Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Manuel\_Vacelet\_2](https://avatars.discourse-cdn.com/v4/letter/m/8491ac/32.png) [@Manuel\_Vacelet\_2](https://discuss.elastic.co/u/Manuel_Vacelet_2)\ **Post date:** [May 18, 2014, 9:01am UTC](https://discuss.elastic.co/t/index-search-with-acls-and-parent-child-relationship/17577/1 "2014-05-18T09:01:02Z")
Hi, I'm struggling with an ES design and I'd like to share with you. I have a set of different documents stored in ES, those documents can be seen only by a set of people. To address this point, for each document, I have a property 'groups' with the list of user groups allowed to access it ('all', 'project\_members', 'designers', etc) On query, I just have to add the list of groups a user belongs to and tada, it works. Great. Now some of those documents are hierarchically stored, so the permissions are. Pretty much like unix folders: - I can have a document that is world readable - but as long as this doc is in a folder that is only readable by one user, only this user can access the doc. How can I map this in ES? I've read > **[Managing Relations Inside Elasticsearch | Elastic](https://www.elastic.co/blog/managing-relations-inside-elasticsearch)** > > Data in the real world is rarely simple - often times it is a jumble of interlocking relations. How do you represent relational data in Elasticsearch? There are a few mechanisms that can be used to pr... Sounds like parent/child might be a solution but: - How do I write the query to have permissions applied ? Thanks for your help; Manuel -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/bf69d9fe-5cb1-4d2b-bf24-8564b3b643c0%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/bf69d9fe-5cb1-4d2b-bf24-8564b3b643c0%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Umit\_Seren](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/umit_seren/32/44933_2.png) [@Umit\_Seren](https://discuss.elastic.co/u/Umit_Seren)\ **Post date:** [May 19, 2014, 8:13am UTC](https://discuss.elastic.co/t/index-search-with-acls-and-parent-child-relationship/17577/2 "2014-05-19T08:13:57Z")
You can check out [https://github.com/salyh/elasticsearch-security-pluginwhich](https://github.com/salyh/elasticsearch-security-pluginwhich) supports authorization and ACLs on document level. If you implement your own ACLs I would recommend to de-normalize the permissions for your hierarchical documents (i.e store only the effective permissions for each document inside the document). Otherwise the queries (if you store the in a client/parent relationship) will quickly become very complex and also it performance might be suffering if you have many documents. On Sunday, May 18, 2014 11:01:02 AM UTC+2, Manuel Vacelet wrote: > Hi, > > I'm struggling with an ES design and I'd like to share with you. > > I have a set of different documents stored in ES, those documents can be > seen only by a set of people. > To address this point, for each document, I have a property 'groups' with > the list of user groups allowed to access it ('all', 'project\_members', > 'designers', etc) > On query, I just have to add the list of groups a user belongs to and > tada, it works. Great. > > Now some of those documents are hierarchically stored, so the permissions > are. > Pretty much like unix folders: > > - I can have a document that is world readable > - but as long as this doc is in a folder that is only readable by one > user, only this user can access the doc. > > How can I map this in ES? > > I've read > [Elasticsearch Platform — Find real-time answers at scale | Elastic](http://www.elasticsearch.org/blog/managing-relations-inside-elasticsearch) > Sounds like parent/child might be a solution but: > > - How do I write the query to have permissions applied ? > > Thanks for your help; > Manuel -- You received this message because you are subscribed to the Google Groups "elasticsearch" group. To unsubscribe from this group and stop receiving emails from it, send an email to [elasticsearch+unsubscribe@googlegroups.com](mailto:elasticsearch+unsubscribe@googlegroups.com). To view this discussion on the web visit [https://groups.google.com/d/msgid/elasticsearch/8ec9e5ac-ee20-4863-bb51-d52c39dbe64b%40googlegroups.com](https://groups.google.com/d/msgid/elasticsearch/8ec9e5ac-ee20-4863-bb51-d52c39dbe64b%40googlegroups.com). For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:28am UTC](https://discuss.elastic.co/t/index-search-with-acls-and-parent-child-relationship/17577/3 "2017-07-06T01:28:37Z")