5 ms·

Google's APIs make it easy to audit your groups, and if you don't want to write your own program to do it you can use the GAM command line tool. https://github.

Google's APIs make it easy to audit your groups, and if you don't want to write your own program to do it you can use the GAM command line tool. https://github.com/jay0lee/GAM/wiki https://github.com/jay0lee/GAM/wiki

lvh 8y ago
GAM is awesome for this. We've also had good luck with Google Apps Scripts. The advantage is that it makes it marginally easier to set up credentials: it does so behind the scenes so you never have creds with admin permissions hit disk. The disadvantage is you're now editing an old-ish version of JavaScript in a janky browser editor that saves to some weird bespoke JSON format. You can also use clasp (https://github.com/google/clasp https://github.com/google/clasp) to edit these files from your favorite editor but now you own a Software Engineering Project. Here's roughly what that looks like to get all the mentioned info out: function getGroups(domain) { var groups = [], pageToken, page; do { page = AdminDirectory.Groups.list({ domain: domain, maxResults: 100, pageToken: pageToken }); if (page.groups && page.groups.length > 0) { groups = groups.concat(page.groups); } pageToken = page.nextPageToken; } while (pageToken); return groups; } function getGroupPerms(groups) { var perms = []; for (var i = 0; i < groups.length; i++) { perms.push(AdminGroupsSettings.Groups.get(groups[i].email)); } return perms; } Disclaimer: I'm the author of the linked blog post.
- jmathai 8y ago
  Apps Script has a lot of potential when it comes to Groups (and other resources a company has to manage). As you said, clasp is an alternative to the web UI. What’s an ideal platform you’d like to see for easily executing code on to work with groups (Apps Script, Cloud Functions, or other)?
  - lvh 8y ago
    I mean, I'm me, so I want to write Clojure. I haven't tried ClojureScript -> clasp to see if I can use ClojureScript. Does Google Apps Script document exactly what the runtime is? It looks like Rhino from some of the failure modes, but I don't know the exact modern JS features it supports. The huge benefit to GAS IMO is that creds never hit my disk.
chmars 8y ago
Does it still provide a list of user access rights for single files and directories on Team Drives?
- lvh 8y ago
  FWIW I haven't found a way to get access to unshared files until after you remove access from someone. The Admin SDK only provides usage reports. The Drive SDK allows you to get files et cetera, but only for the current user (!) -- so that doesn't help for anything you don't have access to, which I'm guessing from the phrasing of your question you already knew :) I'm guessing this is a feature? As in Google wants it to be easy to just create local sheets/docs/... without them being shared with your org by default and would rather worry about giving admins better features to manage and audit sharing than give admins access to every document under the sun :)

lvh 8y ago

GAM is awesome for this. We've also had good luck with Google Apps Scripts. The advantage is that it makes it marginally easier to set up credentials: it does so behind the scenes so you never have creds with admin permissions hit disk. The disadvantage is you're now editing an old-ish version of JavaScript in a janky browser editor that saves to some weird bespoke JSON format. You can also use clasp (https://github.com/google/clasp https://github.com/google/clasp) to edit these files from your favorite editor but now you own a Software Engineering Project. Here's roughly what that looks like to get all the mentioned info out: function getGroups(domain) { var groups = [], pageToken, page; do { page = AdminDirectory.Groups.list({ domain: domain, maxResults: 100, pageToken: pageToken }); if (page.groups && page.groups.length > 0) { groups = groups.concat(page.groups); } pageToken = page.nextPageToken; } while (pageToken); return groups; } function getGroupPerms(groups) { var perms = []; for (var i = 0; i < groups.length; i++) { perms.push(AdminGroupsSettings.Groups.get(groups[i].email)); } return perms; } Disclaimer: I'm the author of the linked blog post.

jmathai 8y ago
Apps Script has a lot of potential when it comes to Groups (and other resources a company has to manage). As you said, clasp is an alternative to the web UI. What’s an ideal platform you’d like to see for easily executing code on to work with groups (Apps Script, Cloud Functions, or other)?
- lvh 8y ago
  I mean, I'm me, so I want to write Clojure. I haven't tried ClojureScript -> clasp to see if I can use ClojureScript. Does Google Apps Script document exactly what the runtime is? It looks like Rhino from some of the failure modes, but I don't know the exact modern JS features it supports. The huge benefit to GAS IMO is that creds never hit my disk.

chmars 8y ago

Does it still provide a list of user access rights for single files and directories on Team Drives?

lvh 8y ago
FWIW I haven't found a way to get access to unshared files until after you remove access from someone. The Admin SDK only provides usage reports. The Drive SDK allows you to get files et cetera, but only for the current user (!) -- so that doesn't help for anything you don't have access to, which I'm guessing from the phrasing of your question you already knew :) I'm guessing this is a feature? As in Google wants it to be easy to just create local sheets/docs/... without them being shared with your org by default and would rather worry about giving admins better features to manage and audit sharing than give admins access to every document under the sun :)