How SkySync interprets G Suite shared content
- Hector Roig (Deactivated)
- Josh Lambright (Deactivated)
- Peter Ransom (Deactivated)
- Andrew Beard
Owned by Hector Roig (Deactivated)
Terminology
Term | What it means |
|---|---|
sharer | the user that shares content |
sharee | the user who receives shared content |
sharing content | to apply permissions to allow or deny access to content by other users in the enterprise |
disinheritance | to override the parent folder's permissions |
sharing explicitly | to add permissions using a user account explicitly |
sharing via link | to add permissions via a url/link |
sharing implicitly | by creating content within a shared folder |
SkySync transfers content then migrates permissions, in that sequence. Applying permissions can have unintended consequences at the destination depending on how the destination platform implements sharing content. Exclude shared content filter gives you some control to prevent duplication at the destination.
Platform: Box
Box supports sharing a folder explicitly by adding a user account and assigning permissions.
Box supports read only sharing sharing a file or folder via link.
Disinheritance is not supported; there is no support for overriding the parent folder's permissions. Box also does not support sharing a file explicitly.
There is no implicitly sharing; content within a shared folder is owned by the sharer.
When a user shares a folder explicitly, the folder appears on the sharee's drive (root).
Platform: G Suite
G Suite supports sharing a file or folder explicitly by adding user account and assigning permissions.
It also supports read and write sharing a file or folder via link.
Disinheritance is supported; the ability to override a parent's folder permissions.
There is implicit sharing; content created or moved to a shared folder is also considered shared and owned, unlike Box, by the content creator and not the sharer.
When a user shares a file or folder explicitly or via link (once accessed by sharee), it appears in their "Shared With Me" bucket. The sharee can then choose to "Add to My Drive". The sharee can drag the shared file or folder to any folder within the sharee's "My Drive", including both private or other shared folders. This means that a shared file or folder can appear in multiple folders in the sharer's "My Drive" or can be orphaned/removed from "My Drive". Since disinheritance is supported, a sharee can create a subfolder on a shared folder then remove the sharer from its permission list. The sharer will no longer see that subfolder in his folder. Only the sharee can.
How SkySync Interprets Shared Folders
SkySync Box Connector:
In SkySync, the sharer sees the folder and its content as not shared, the sharee sees the folder and its content as shared.
SkySync doesn't currently support migrating permissions when sharing via link from/to Box.
There is also no support for migrating permissions to a file.
SkySync G Suite Connector:
In SkySync, the sharee sees a shared file or folder and all its content as shared, even if the sharee created the content within the shared folder.
The sharer; user that shared the file or folder; sees them as not shared.
Files or folders that appear under the shared folder, however, will be seen by the shared as either shared or not shared based on how the content was created and the SkySync configuration setting: GoogleDrive.AllowSharedWithMe.
If the file or folder is implicitly shared (those created or moved to the shared folder hierarchy without previously being shared), the sharer will see them as not shared. (This is consistent with Box.)
If the file or folder was explicitly shared or shared via link with the sharer, the sharer will see them as shared by default. If GoogleDrive.AllowSharedWithMe is set to true, the sharer will see them as not shared.
Example
Lets walk through by using an example.
Transferring "Share by Link" Permissions
To apply share-by-link permissions from G Suite to Box, you will need to create a user group in Box that you can map to your Google domain. You can then add the users
For example, when transferring from G Suite to Box, if your domain in G Suite is mydomain.com, under Group Mappings, create an exception map with mydomain.com as the source group and the group name added to Box as the destination group.
When the job executes, folders with "share-by-link" permissions will transfer to Box as permissions to the mapped Box group.
Summary/Recommendations
For best results, we recommend that jobs of this nature are broken into two parts:
1. Taxonomy Job w/ Permission Migration
2. Copy/Sync Job w/ Author Preservation
Use the "Exclude Shared" filter when you want SkySync to propagate permissions; the destination will not yield the same folder structure because the destination may have a different sharing scheme (e.g. Box shares show up on root only).
To transfer content exactly as shown from G Suite/Box without caring about sharing/permissions, do not use "Exclude Shared" filter and do not enable permission migration.
We have found that certain platforms, such as Box, require this filtering in order to prevent duplication.
Since G Suite allows shared content be located anywhere in a user's drive:
Set GoogleDrive.AllowSharedWithMe to true if you are not transferring entire user drives, otherwise you risk skipping transferring shared content in the destination.
Set GoogleDrive.AllowSharedWithMe to false (default) if you are transferring entire user drives, otherwise you risk duplicating shared content in the destination.
The sharing permissions of explicitly shared files cannot be transferred from G Suite to Box. Only folders.
If you use disinheritance in G Suite to remove a sharer from the permission list, content will most likely be skipped. The sharer cannot transfer the content because it no longer has access to it within his share. The sharee cannot transfer the content because "Exclude Shared" will skip over the parent of the disinherited content.