AclMapping

Maps a document field to a Google Cloud Search ACL principal.

committer/googlecloudsearchJavadoc: AclMapping

Notes

Each mapping takes the value or values of one document field, reads them as security principals, and adds them to one of an item's three access lists. Several mappings can be declared — one for the users allowed to read, another for a group, another for owners.

Principals must be resolvable in the Google Cloud identity source backing your data source, otherwise the item ends up visible to nobody.

Examples

Grants read access to the principals listed in an acl_readers field, and denies it to those in acl_denied.

YAML

aclMappings:
  - fromField: acl_readers
    principalType: USER
    target: READERS
  - fromField: acl_denied
    principalType: GROUP
    target: DENIED_READERS

JSON

{
  "aclMappings": [
    {
      "fromField": "acl_readers",
      "principalType": "USER",
      "target": "READERS"
    },
    {
      "fromField": "acl_denied",
      "principalType": "GROUP",
      "target": "DENIED_READERS"
    }
  ]
}

XML

<aclMappings>
  <fromField>acl_readers</fromField>
  <principalType>USER</principalType>
  <target>READERS</target>
  <fromField>acl_denied</fromField>
  <principalType>GROUP</principalType>
  <target>DENIED_READERS</target>
</aclMappings>

Usage

Full configuration skeleton, with every option and its default

YAML

fromField: string
principalType: USER
target: READERS

JSON

{
  "fromField": "string",
  "principalType": "USER",
  "target": "READERS"
}

XML

<aclMapping>
  <fromField>string</fromField>
  <principalType>USER</principalType>
  <target>READERS</target>
</aclMapping>

Properties

Property	Type	Required	Default
fromField	string	No	-
principalType	enum	No	USER
target	enum	No	-

Property Details

fromField

Document field holding the principal value or values — the users, groups or customer identifier this entry applies to.

principalType

What the field values represent: USER, GROUP, or CUSTOMER for everyone in the domain. Defaults to USER.

Allowed Values

• USER
• GROUP
• CUSTOMER

target

Which access list the principals are added to: READERS to grant access, DENIED_READERS to deny it, or OWNERS.

Allowed Values

• READERS
• DENIED_READERS
• OWNERS