In this video, you’ll learn how to manage document access and permissions in Elastic Workplace Search.
Workplace Search enables you to connect content sources like Google Drive, Dropbox, and GitHub
into one unified search index.
These sources can be set up by an administrative user for the whole organization.
Such sources are referred to as organizational sources.
Content synchronized from organizational sources can either be made available to all users
or only a subset of users belonging to one or more groups in Workplace Search.
Groups are a collection of Workplace Search users to which specific sources and content is shared.
It can be a Marketing, or Sales group, for example.
In order to set up organizational sources, you’ll need to be an administrative user
in Workplace Search.
You’ll also need an account on the source application from which content is synchronized,
such as Google Drive.
It’s also possible to configure the content source to synchronize document-level permission
information so that users have the same level of access to documents in Workplace Search
as they do in the source application.
Let’s take an example.
Alice, Bob, and Charlie are users of Workplace Search.
If we use a Google account that has access to only a certain set of documents to configure
an organizational source, all of the content that this platform account has access to will
be synchronized with Workplace Search.
And by default, all of that content will be searchable by Alice, Bob, and Charlie on Workplace Search.
If the platform supports document-level permissions, like Google Drive, Sharepoint Online, and
others, and an admin account that has access to such permission information, we can configure
the content source to synchronize these permissions along with the content.
So Alice, Bob, and Charlie would have the same level of access to documents in Workplace
Search as they did in the source application.
If document-level permission synchronization is not supported for the source application,
you can restrict access to synchronized content to a subset of users
(say, only Alice and Bob) by creating a group with only those users in it.
You could use multiple platform accounts with access to different sets of content,
synchronize them using multiple content source configurations,
and combine them with groups to establish granular access control.
Let’s take a look at how we could restrict access to content using groups in Workplace Search.
We can start by creating a new group and selecting content sources that we want users in this
group to access.
In order to map this group to a set of users in Workplace Search, we need to define a role
mapping, which is a required and important step for the setup of SSO using SAML.
The role mapping ties an external attribute such as a username, email, or role to management privileges.
By default, all the content sources are added to the Default group.
Ensure you remove sources that you do not want everyone to access from this default group.
Under group assignment, we can pick the group that we created in the previous step.
Now users with the defined attributes will automatically be mapped to the group and in
turn, will only have access to the content sources associated with it.
You could also create a Custom API Source to index documents programmatically
along with corresponding document-level permissions that you need to enforce.
In addition to organizational sources, Workplace Search administrators can allow individual
users to set up sources for their own use.
Those are called private sources.
Private sources give non-administrative users the ability to synchronize their own content
and make the data searchable only for them in Workplace Search.
Thanks for watching this short video on how to manage document access and permissions
in Workplace Search.
If you’d like to learn more, check out our Elastic Workplace Search Quick Start.