Google Workspace Drive Connector

Overview

Used for OneTrust Data Discovery, the Google Workspace Drive connector helps scan Google Drive accounts across domain wide users to retrieve and pull discovered data back to OneTrust for review.

For more information on the credential setup, see OneTrust-Google Workspace Connector Guide.

Note:

This connector is currently under Public Preview. Contact OneTrust Support to request early access.

Pod Residency

storage-scanner

Connection Method

JWT authentication with service account.

Supported Scan Actions

Scan Type

Description

Catalog

This scan type will fetch the list of shared drives and the list of files in the user's My Drive. It returns metadata for every Object, seen below.

Catalog & Scan

This will fetch the list of files and after which the system will be able to download every file.

Credential and System Permissions

OneTrust recommends to adhere to your organization's security and infrastructure policy and include system engineer resources or other qualified subject matter experts to set up credentials on data sources. For specific instructions for how to enable these credentials, refer to your data source's implementation documentation, knowledge base and/or support resources.

This connector requires JWT Google authentication.

  • Service account with enabled domain wide delegation

  • All requests to the Drive API must be authorized by an authenticated user. Google may ask for a particular scope of access when your application needs to access user data. For more information into all permissions see the complete see OneTrust-Google Workspace Connector Guide.

JWT Headers

JSON 
{
   "alg": "RS256",
   "typ": "JWT",
   "kid": "<private_key_from_service_account>"
}

JWT Claims

JSON 
{
  "iss": "<your_workspace>.iam.gserviceaccount.com",
  "sub": "<user_mail_with_service_account",
  "scope": "https://www.googleapis.com/auth/admin.directory.user.readonly",
  "aud": "https://oauth2.googleapis.com/token",
  "exp": 1328554385,
  "iat": 1328550785
}

Vault JSON

For multi domain support (if you would like to scan Drive users across multiple domains), do not include the domain setting in your vault credential. The customer setting should be specified alone in this case.

JSON 
{
"auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
"auth_uri": "https://accounts.google.com/o/oauth2/auth”,
"client_email": "<your_workspace>.iam.gserviceaccount.com",
"client_id": "<your_client_id>",
"client_x509_cert_url": "https://www.googleapis.com/robot/v1/metadata/x509/<your_workspace>.iam.gserviceaccount.com",
"connectionUrl": "na",
"customer": "my_customer",
"domain": "<your_domain>",
"private_key": "-----BEGIN PRIVATE KEY-----
<enter-private_key>=\n-----END PRIVATE KEY-----\n",
"private_key_id": "<private_key_id>",
"project_id": "<project_id>",
"google_admin_user": "<user@your.domain.com>",
"token_uri": "https://oauth2.googleapis.com/token",
"type": "service_account",
"view_type": "domain_public",
"admin_account": "user@your.domain.com"
}

Scan Profile Support

Note:

For additional details on scan profile configuration and management, see Setting Up Scan Profiles.

Limits

  • Max number of shared drives

  • Max number of users, files and folders

Scope

  • As of 6.24, OneTrust supports scanning organization shared drives. You must choose if you are scanning My Drives (user account drives) or organization shared drives from the scan profile.

  • Search for specific files or folders on the user's My Drive.

    Note:

    You can use a query string to filter the files to return.

Collected Objects & Fields

Objects

Fields

Files

  • ID

  • Modified Date

Files

  • ID

  • Name

  • Content Type

  • Description

  • Deleted

  • Modified by User

  • Size on Disk

  • Image and Video Metadata

  • Direct File Link

  • Direct File Webview Link (Google Docs)

  • Location Metadata (True/False if exists)

Access Audit (Shared Access)

For files and folders, we apply the following to the shared access attribute in this priority order:

  • Open Access - If someone can access the file or folder with no restriction with a hyperlink.

  • Shared External - The file or folder is shared externally via collaboration to a user outside your organization.

  • Shared Internal - The file or folder is shared internally via collaboration to a user inside your organization. "Internal" is determined by the internal domain list from the scan profile run at scan time along with discovered domains for My Drive scanning.

  • Private - The file or folder is not shared by the file owner.