# Is it possible to apply document-level permissions to Google Drive synchronized documents? **URL:** \ **Category:** Elastic Search\ **Tags:** elastic-workplace-search\ **Created:** [May 7, 2024, 12:51pm UTC](https://discuss.elastic.co/t/is-it-possible-to-apply-document-level-permissions-to-google-drive-synchronized-documents/358922 "2024-05-07T12:51:00Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![m-amano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/m-amano/32/62977_2.png) [@m-amano](https://discuss.elastic.co/u/m-amano)\ **Post date:** [May 7, 2024, 12:51pm UTC](https://discuss.elastic.co/t/is-it-possible-to-apply-document-level-permissions-to-google-drive-synchronized-documents/358922/1 "2024-05-07T12:51:00Z")
Hello. I'm using WorkplaceSearch of v.8.12.0 Elastic Cloud. I have connected WorkplaceSearch and Google Drive with Google Drive connector. > **[Connecting Google Drive | Workplace Search documentation \[8.12\] | Elastic](https://www.elastic.co/guide/en/workplace-search/8.12/workplace-search-google-drive-connector.html)** Is there a way to give the WorkplaceSearch user the same permission as the Google Drive account? Therefore the user can only search and get results of permitted documents in the Google Drive account. ---
**Author:** ![Artem\_Shelkovnikov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/artem_shelkovnikov/32/134322_2.png) [@Artem\_Shelkovnikov](https://discuss.elastic.co/u/Artem_Shelkovnikov)\ **Post date:** [May 7, 2024, 1:47pm UTC](https://discuss.elastic.co/t/is-it-possible-to-apply-document-level-permissions-to-google-drive-synchronized-documents/358922/2 "2024-05-07T13:47:41Z")
Hi Mizuki Amano, It should be possible, but you will need to do identity mapping on your side using [this API](https://www.elastic.co/guide/en/workplace-search/current/workplace-search-external-identities-api.html). It can be trivial if your login on Elasticsearch and email in Google Drive are the same - e.g. `johndoe` in Elasticsearch and `johndoe@gmail.com` in Google Drive, but even in this case you'll need to do it on your side via a script. ---
**Author:** ![m-amano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/m-amano/32/62977_2.png) [@m-amano](https://discuss.elastic.co/u/m-amano)\ **Post date:** [May 7, 2024, 2:51pm UTC](https://discuss.elastic.co/t/is-it-possible-to-apply-document-level-permissions-to-google-drive-synchronized-documents/358922/3 "2024-05-07T14:51:03Z")
Hi. I have already done the API but it looks did not work. 😢 The user can still get non-permitted documents as a search result. The return from the API looks like it has no error though. ```auto {"content_source_id":"","external_user_id":"","external_user_properties":[{"attribute_name":"_elasticsearch_username","attribute_value":""}],"permissions":[]} ``` As you said the email of the Elasticsearch user and the email in Google Drive are the same. ---
**Author:** ![m-amano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/m-amano/32/62977_2.png) [@m-amano](https://discuss.elastic.co/u/m-amano)\ **Post date:** [May 7, 2024, 4:37pm UTC](https://discuss.elastic.co/t/is-it-possible-to-apply-document-level-permissions-to-google-drive-synchronized-documents/358922/4 "2024-05-07T16:37:20Z")
@Artem_Shelkovnikov Hi. I also wonder if there are other ways to apply document-level permission and get the search results by not creating new users one by one for Workplacesearch. Because there are many users and the number of users will continue to increase. ---
**Author:** ![Artem\_Shelkovnikov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/artem_shelkovnikov/32/134322_2.png) [@Artem\_Shelkovnikov](https://discuss.elastic.co/u/Artem_Shelkovnikov)\ **Post date:** [May 8, 2024, 8:36am UTC](https://discuss.elastic.co/t/is-it-possible-to-apply-document-level-permissions-to-google-drive-synchronized-documents/358922/5 "2024-05-08T08:36:56Z")
It's good to use [this page](https://www.elastic.co/guide/en/enterprise-search/current/dls-overview.html) as a starting point of investigation. 1. You will need to look at the documents that the user sees that they should not see. What is inside `_allow_access_control` and `_deny_access_control` fields for this documents? Is the user that you are using in these fields? Are these fields even present? 2. How do you query the documents for the user? Do you use UI, do you use API for it? ---
**Author:** ![Artem\_Shelkovnikov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/artem_shelkovnikov/32/134322_2.png) [@Artem\_Shelkovnikov](https://discuss.elastic.co/u/Artem_Shelkovnikov)\ **Post date:** [May 8, 2024, 8:38am UTC](https://discuss.elastic.co/t/is-it-possible-to-apply-document-level-permissions-to-google-drive-synchronized-documents/358922/6 "2024-05-08T08:38:22Z")
There is no other way - identity mapping is not a trivial process and it's really easy to make a mistake there that will cause users see documents that they should not see, if done automatically. This needs to happen on your side - either by having a file with your identity mapping that you store under version control - or by having a script that contains the logic to do the mapping and send API requests to Workplace Search. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [June 5, 2024, 8:38am UTC](https://discuss.elastic.co/t/is-it-possible-to-apply-document-level-permissions-to-google-drive-synchronized-documents/358922/7 "2024-06-05T08:38:27Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.