Google Drive integration
(Updated: )When enabling the Google Drive integration in Leebry, you'll be asked to enter:
- a Google Workspace admin email
- a service account JSON key
This guide explains how to get them as well as preliminary set up that needs to be done.
Get service account JSON key
Create or select a Google Cloud Platform (GCP) project.
Go to the Google Cloud Console and either:
Use an existing project managed by your organization, or
NoteIf creating a new project, make sure to take note of the Project ID that will be needed to enable APIs in step 3.
Enable billing.
Link a billing account to the GCP project.
This is required by Google Cloud to enable API usage and service account configuration.
No GCP resources are expected to incur significant cost as part of the Leebry integration alone, unless other Google Cloud services are used in the same project.
Enable required APIs.
Enabling an API allows Leebry to use that Google service. The actual data that Leebry can access is further restricted by the OAuth scopes granted during the domain-wide delegation setup.
Go to the following links replacing
[PROJECT_ID]with your Project ID from step 1 and click Enable if not enabled already:API Service name Required for Link Drive API drive.googleapis.comAllows Leebry to discover Google Drive files, retrieve file metadata (such as name, owner, permissions, and modification time), and read document contents for indexing. https://console.developers.google.com/apis/api/drive.googleapis.com/overview?project=[PROJECT_ID]Docs API docs.googleapis.comAllows Leebry to retrieve and parse the contents of Google Docs documents in a structured format for indexing. https://console.developers.google.com/apis/api/docs.googleapis.com/overview?project=[PROJECT_ID]Sheets API sheets.googleapis.comAllows Leebry to retrieve and parse the contents of Google Sheets spreadsheets for indexing. https://console.developers.google.com/apis/api/sheets.googleapis.com/overview?project=[PROJECT_ID]Admin SDK API admin.googleapis.comAllows Leebry to access Google Workspace audit and usage reports. Leebry uses this information to identify recently changed documents and perform incremental indexing instead of re-scanning all content. https://console.developers.google.com/apis/api/admin.googleapis.com/overview?project=[PROJECT_ID]Create a service account and generate a JSON key.
Create a service account in your GCP project by following these steps:
Go to the Create service account page.
Select the project you're using for Leebry.
Enter a service account name.
Optionally, edit the ID and enter a description.
Click Done.
The Service Account page for the project opens, and you should see the newly create account there.
Copy and save the account's 21-digit long OAuth 2 Client ID as you'll need it later.
Click the Actions button next to it (three dots) and click Manage keys.
Click Add key > Create new key. Select the key type JSON and then click Create.
The JSON key will be downloaded to your computer automatically.
NoteIt's this JSON key that Leebry is asking for when setting up the Google Drive Integration.
Set up domain-wide delegation
Leebry uses a service account with domain-wide delegation to access Google Drive data with admin-approved permissions. This allows Leebry to:
- Read files accessible to the organization
- Detect document updates
- Maintain an up-to-date index
To set up domain-wide delegation:
Go to the domain-wide delegation section in Google Admin Console. You have to be signed in as a super admin.
Click Add new and paste the previously saved OAuth 2 Client ID of the service account into the Client ID field.
Copy and paste the following into the OAuth scopes (comma-delimited) field and then click Authorize:
https://www.googleapis.com/auth/drive.readonly,https://www.googleapis.com/auth/admin.reports.audit.readonly,https://www.googleapis.com/auth/admin.reports.usage.readonly.
The table below explains why each scope is required by Leebry.
| OAuth scope | Access level | Required for |
|---|---|---|
https://www.googleapis.com/auth/drive.readonly | Read-only | Allows Leebry to read Drive files and metadata for indexing. No file modifications can be performed. |
https://www.googleapis.com/auth/admin.reports.audit.readonly | Read-only | Allows Leebry to access audit reports used to detect content changes and perform incremental indexing. |
https://www.googleapis.com/auth/admin.reports.usage.readonly | Read-only | Allows Leebry to access usage reports used to support synchronization and operational monitoring. |
Connect Google Drive to Leebry
Go to the Integrations tab of the admin dashboard in Leebry.
Click Connect next to the Google Drive integration.
Read what Leebry can and can't do with your Google Drive and click Continue.
Enter either your Google Workspace super admin email or custom admin email (read below) along with the JSON key. Click Continue.
NoteIf you'd like to create a custom admin role:
Go to
https://admin.google.com/ac/roles. Click Create new role. Name the role Leebry. Click Continue.Select the Reports privilege.
Click Continue and then Create Role.
You should be redirected to a page where you can assign users to the Leebry role you just created. Click Assign members, and add a Google Workspace user. This user needs to have logged in at least once to the Google Workspace and accepted the Terms of Service. Click Assign role.
Select the drives you wish Leebry to index and then click Start indexing.
Once the indexing status changes from Indexing in progress to Active, Google Drive integration is up and running!
