> ## Documentation Index
> Fetch the complete documentation index at: https://docs.opal.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Google Shared Drive

> Learn how to connect Opal to Google Workspace to manage access to shared drives.

With the Google Shared Drive integration, you can manage access to the shared drives in your Google Workspace from Opal:

* Allow users to request just-in-time access to a shared drive, at the exact role they need, from the web and Slack
* Grant a Google group access to a shared drive
* Review who has access to each shared drive, including access through groups and nested groups
* Set the right resource owners to delegate approvals to those with the most context
* Automatically revoke access when a time-bound grant expires

Opal connects through a Google Cloud service account with domain-wide delegation, acting as a Workspace super admin. Opal uses that admin's domain administrator access, so it sees every shared drive in your Workspace, not only the drives the admin is a member of.

## Supported resources

| Resource | Read | Grant and revoke access |
| - | - | - |
| Shared drives | ✔️ | ✔️ (Users and groups) |
| Google groups (membership) | ✔️ | |

Opal syncs every active user in your Workspace and skips suspended users. Drive and group members from outside your Workspace are matched to Opal users by email. The integration doesn't sync folders or files inside a shared drive, or sharing with a whole domain or with anyone who has the link.

### How shared drive access maps to Opal

* **Access levels**: each shared drive role is an access level: **Viewer**, **Commenter**, **Contributor**, **Content manager**, and **Manager**.
* **One role per drive**: Google allows each user or group one role on a shared drive. Requesting a different role replaces the member's current role. When that grant is revoked or expires, the member loses access to the drive rather than returning to their earlier role.
* **Revoking access**: a revoke removes only the role it names. If the member's role on the drive has changed since the grant, Opal leaves the new role in place. Access a user has through a group isn't affected when you revoke their direct role.
* **Groups**: a group's members, including members of groups nested inside it at any depth, show the group's access to a drive as indirect access.
* **Group membership is read-only**: Google Groups owns group membership, so Opal can't add or remove members from groups in this app, and requests for these groups are turned off. To manage membership in Opal, use the [Google Groups integration](https://docs.opal.dev/integrations/google-groups.md).
* **Notifications**: Opal turns off Google's own sharing email when it grants drive access, because Opal already notifies the requester.

## Requirements

Before you begin, you must:

* Be an Opal Admin
* Have a Google Workspace super admin, who can configure domain-wide delegation and whom the service account acts as
* Have access to a Google Cloud project where you can enable APIs and create a service account key
* Ask the Opal team to enable the Google Shared Drive integration for your organization

## Configuration steps

### 1. Enable the Google APIs

In the [Google Cloud console](https://console.cloud.google.com/), select the project that will hold the service account, and enable the following APIs:

* [Google Drive API](https://console.cloud.google.com/apis/library/drive.googleapis.com)
* [Admin SDK API](https://console.cloud.google.com/apis/library/admin.googleapis.com)

![Google Cloud API Library page for the Google Drive API showing API Enabled](https://mintcdn.com/opalsecurity/_XOIJSP6bulOszqL/images/docs/google-shared-drive-enable-api.png?fit=max\&auto=format\&n=_XOIJSP6bulOszqL\&q=85\&s=659e60011face71bd5bbac38408472c2)

### 2. Create a service account

1. Go to **IAM & Admin** > **[Service accounts](https://console.cloud.google.com/iam-admin/serviceaccounts)** and select **Create service account**.
2. Name the service account, for example `Opal Google Shared Drive`.
3. The service account doesn't need any Google Cloud roles, so skip the optional steps and select **Create and close**.

![Google Cloud Create service account page with the service account named Opal Google Shared Drive](https://mintcdn.com/opalsecurity/_XOIJSP6bulOszqL/images/docs/google-shared-drive-create-service-account.png?fit=max\&auto=format\&n=_XOIJSP6bulOszqL\&q=85\&s=a87362f7cf522db593e91026a8f337ce)

### 3. Create a key and copy the client ID

1. Open the service account and go to the **Keys** tab.
2. Select **Add key** > **Create new key**, choose **JSON**, and select **Create**. Google downloads the key file. You'll enter its contents in Opal in step 5.

![Google Cloud Create private key dialog with the JSON key type selected](https://mintcdn.com/opalsecurity/_XOIJSP6bulOszqL/images/docs/google-shared-drive-create-key.png?fit=max\&auto=format\&n=_XOIJSP6bulOszqL\&q=85\&s=9daeb8a7e87dce0c4419db3b7ab12634)

3. Go to the **Details** tab and copy the **Unique ID**. This is the service account's OAuth client ID, which you'll use in step 4.

![Google Cloud service account Details tab showing the Unique ID](https://mintcdn.com/opalsecurity/_XOIJSP6bulOszqL/images/docs/google-shared-drive-unique-id.png?fit=max\&auto=format\&n=_XOIJSP6bulOszqL\&q=85\&s=04c79cf5aef8d1700fbec351dcf17565)

> [!NOTE]
>
> If your organization enforces the `iam.disableServiceAccountKeyCreation` policy, ask a Google Cloud organization admin to allow key creation for this project.

### 4. Set up domain-wide delegation

1. In the [Google Admin console](https://admin.google.com/), go to **Security** > **Access and data control** > **API controls**, and select **Manage Domain Wide Delegation**.
2. Select **Add new**, and enter the **Unique ID** from step 3 as the **Client ID**.
3. Enter the following scopes in **OAuth scopes**, separated by commas, then select **Authorize**:

```text theme={null}
https://www.googleapis.com/auth/drive,https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/admin.directory.group.readonly
```

| Scope | Purpose |
| - | - |
| `drive` | List shared drives and their members, and add and remove drive members |
| `admin.directory.user.readonly` | List the users in your Workspace |
| `admin.directory.group.readonly` | List groups, their members, and the groups nested inside them |

![Google Admin console Add a new client ID dialog with the client ID and the three OAuth scopes, one per field](https://mintcdn.com/opalsecurity/_XOIJSP6bulOszqL/images/docs/google-shared-drive-domain-wide-delegation.png?fit=max\&auto=format\&n=_XOIJSP6bulOszqL\&q=85\&s=a787694689056e03a4848eb5f4461567)

### 5. Create the Google Shared Drive app in Opal

In Opal, go to **Inventory** > **+App** and select **Google Shared Drive**. Fill in the following fields:

| Field | Value |
| - | - |
| App name | A name for the app in Opal, for example `Google Shared Drive`. |
| App admin | The owner who administers the app in Opal. |
| Description | A short description that helps requesters understand what this app is. |
| Visibility | Who in your organization can see the app. |
| Admin email | The email of the Workspace super admin the service account acts as. This isn't the service account's email. |
| Service account key | The full contents of the JSON key file from step 3. |

To manage more than one Google Workspace, create a separate app for each.

### 6. Import shared drives and groups

After you save the app, import the shared drives and groups you want to manage: on the app's **Assets** tab, select **Import assets**, and turn on requests for the shared drives. Opal pulls access only for imported items, so drive and group members appear after the next sync.

## Troubleshooting

Opal shows Google's own error message. Look for the error it contains:

| Error | Fix |
| - | - |
| `invalid service account key` | Paste the entire contents of the JSON key file, including the opening and closing braces. |
| `unauthorized_client` | In the Admin console, check that domain-wide delegation uses the service account's **Unique ID** and includes all three scopes from step 4. |
| `has not been used in project` or `it is disabled` | Enable the Google Drive API and the Admin SDK API in the service account's project, as in step 1, then wait a few minutes and try again. |
| `Not Authorized to access this resource/api` | Check that the **Admin email** belongs to a super admin in your Workspace. |
| **+ Users** is unavailable on a Google group | Group membership is read-only in this app. Manage membership with the [Google Groups integration](https://docs.opal.dev/integrations/google-groups.md) or in Google Groups. |
| A group or user shows as removed and added again | Opal identifies groups and users by email, so changing an email address appears as a new item. Import the renamed group again. |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.