Modeling Google Drive permissions with OpenFGA

This tutorial explains how to represent Google Drive permissions model with OpenFGA.

​

Before you start

In order to understand this guide correctly you must be familiar with some OpenFGA concepts and know how to develop the things that we will list below. It would be helpful to have an understanding of some concepts of OpenFGA before you start.

OpenFGA concepts

Modeling concentric relationships

You need to know how to update the authorization model to allow having nested relations such as all writers are readers. Learn more →

Modeling object-to-object relationships

You need to know how to create relationships between objects and how that might affect a user’s relationships to those objects. Learn more →Used here to indicate that users who have access to view a folder have access to view all documents inside it.

Modeling public access

You need to know how to add a relationship tuple to indicate that a resource is publicly available. Learn more →

Concepts & configuration language

• The OpenFGA Concepts
• Configuration Language

​

What you will be modeling

Google Drive is a system to store, share, and collaborate on files and folders. Source In this tutorial, you will build a subset of the Google Drive permission model (detailed below) in OpenFGA, using some scenarios to validate the model.

Note: For brevity, this tutorial will not model all of Google Drive’s permissions. Instead, it will focus on modeling for the scenarios outlined below

​

Requirements

Google Drive’s permission model is represented in their documentation. In this tutorial, you will be focusing on a subset of these permissions. Requirements:

• Users can be owners, editors, commenters and viewers of documents
• Documents can be shared with all users in a domain
• Folders can contain documents and users with a certain permission on a folder have that same permission to a document in that folder
• Documents and folders can be shared publicly

​

Defined scenarios

There will be the following users:

• Anne, who is in the xyz domain
• Beth, who is in the xyz domain
• Charles, who is in the xyz domain
• Diane, who is NOT in the xyz domain
• Erik, who is NOT in the xyz domain

There will be:

• a 2021-budget document, owned by Anne, shared for commenting with Beth and viewable by all members of the xyz domain.
• a 2021-planning folder, viewable by Diane and contains the 2021-budget document
• a 2021-public-roadmap document, owned by Anne, available for members xyz domain to comment on and is publicly viewable

​

Modeling Google Drive’s permissions

​

01. Individual permissions

To keep thing simple and focus on OpenFGA features rather than Google Drive complexity we will model only four roles (Viewer, Commenter, Writer, Owner). At the end of this section we want to have the following permissions represented: To represent permissions in OpenFGA we use relations. For document permissions we need to create the following authorization model: The OpenFGA service determines if a user has access to an object by checking if the user has a relation to that object. Let us examine one of those relations in detail: If we want to say beth is a commenter of document:2021-budget we create this relationship tuple: We can now ask OpenFGA “is beth a commenter of repository document:2021-budget?” We could also say that anne is an owner of the same document: And ask some questions to OpenFGA: The first reply makes sense but the second one does not. Intuitively, if anne was an owner, she was also be a writer. In fact, Google Drive explains this in their documentation To make OpenFGA aware of this “concentric” permission model we need to update our definitions: With this update our model now supports nested definitions and now:

​

02. Organization permissions

Google Drive allows you to share a file with everyone in your organization as a viewer, commenter or writer/editor. At the end of this section we want to end up with the following permissions represented: To add support for domains and members all we need to do is add this object to the OpenFGA authorization model. In addition, update the model to allow domain member to be assigned to document: Let’s now create a domain, add members to it and make all members viewers of document:2021-budget. The last relationship tuple introduces a new OpenFGA concept. A userset. When the value of a user is formatted like this objectType:objectId#relation, OpenFGA will automatically expand the userset into all its individual user identifiers:

​

03. Folder permission propagation

Permission propagation happens between folders and files: if you are a viewer in a folder, you can view its documents. This applies even when you are not explicitly a viewer in a document. At the end of this section we want to end up with the following permissions represented. Note that a folder is an object in the document type, as we do not need a separate type: We need to add the notion that a document can be the parent of another document. We know how to do that: We can indicate this relation by adding the following relationship tuples What we still lack is the ability to propagate permissions from parent to children. We want to say that a user is a viewer of a document if either:

• [done] they have a viewer relationship (directly or through domain membership)
• [pending] they have a viewer relationship with the parent document

We need a way to consider the parent viewers, not just direct viewers of the document when getting a check for: More details on this technique can be found in the section Modeling Parent-Child Objects. We express it like this: The updated authorization model looks like this:

​

04. Sharing files and folders publicly

Google Drive has a feature which allows sharing a file or folder publicly, and specifying the permissions a public user might have (writer/commenter/viewer). Assume that Anne has created a new document: 2021-public-roadmap, has shared it with commenter permissions to the xyz.com, and has shared it as view only with the public at large. Here’s where another OpenFGA feature, type bound public access (as in everyone), would come in handy. First, we will need to update our model to allow for public access with type user for viewer relation. To mark Anne as the owner, the domain members as commenters and the public as viewers, we need to add the following relationship tuples: Anne is an owner of the document Beth is a member of the xyz.com domain, and so can comment but cannot write Erik is NOT a member of the xyz.com domain, and so can only view the document

​

Related Sections

Take a look at the following sections for more information.