> ## Documentation Index
> Fetch the complete documentation index at: https://docs.unstructured.io/llms.txt
> Use this file to discover all available pages before exploring further.
# IBM FileNet
> Connect Unstructured to IBM FileNet as a source to ingest documents and content from your FileNet content repository into Unstructured.
IBM FileNet is an enterprise content management system that enables organizations to store, manage, secure, and automate documents and business content at scale.
First time creating a connector? [Read this first](/pipelines/connector-first-time-reqs).
## Requirements
You will need:
* An [IBM Cloud Pak for Business Automation as a Service](https://www.ibm.com/products/cloud-pak-for-business-automation) account with access to the IBM FileNet [Content Platform Engine server](https://www.ibm.com/docs/en/filenet-p8-platform/5.7.0?topic=architecture-content-platform-engine) object store to which you want to connect. IBM FileNet is a component of IBM Cloud Pak for Business Automation as a Service.
To access the information you'll need to configure the connector:
1. Log into your [account](https://www.automationcloud.ibm.com/auth/index.jsp).
2. Choose the **Navigator** tile.
The [IBM Navigator](https://www.ibm.com/docs/en/content-navigator/3.2.0) launches in a separate browser window, and provides a view of your object stores and content. You can use the IBM Navigator views to find the information necessary to create a connection to Unstructured.
For the URL of your IBM FileNet server:
* The server URL displays in the browser address bar. You only need the base URL that specifies the company and domain. For example, `https://.automationcloud.ibm.com`.
For [object store](https://www.ibm.com/docs/en/filenet-p8-platform/5.7.0?topic=infrastructure-defining-object-stores) names and folder paths:
* Select the folder in the left pane. The full folder path is displayed at the top of the main detail pane, in the following format: `//etc`.
For the document class:
* Right-click the document and select **Properties**.
For the account username:
* Right-click the profile icon on the upper right in the top menu.
## Document permissions metadata
The source connector outputs any permissions information that it can find in the source location about the processed source files, and associates that information with each corresponding element that is generated. This permissions information is output into the `permissions_data` field, which is within the
`data_source` field under the element's `metadata` field (`metadata.data_source.permissions_data`). This information lists the users or groups, if any, that have
permissions to read, update, or delete the element's associated source document. It also lists any users or groups that are explicitly *denied* those permissions.
For more information on how IBM FileNet uses Access Control Lists (ACLs) and Access Control Entries (ACEs) to manage permissions, see [About access rights](https://www.ibm.com/docs/en/filenet-p8-platform/5.7.0?topic=authorization-about-access-rights) in the IBM FileNet Platform documentation.
The permissions metadata Unstructured outputs should not be used for runtime authorization
or access control enforcement.
Unstructured outputs document permissions metadata that is accurate only
at the point in time when Unstructured ingested the corresponding document
to which those permissions applied. Because this metadata is a
point-in-time copy of the permissions in the source location, these
metadata outputs that are sent to your destination location are not
always guaranteed to match the current permissions in the source location.
Also, be aware that Unstructured updates permission metadata for a document only when the document's content has changed.
This is because Unstructured performs incremental processing of documents only when documents' *content* has changed—not when only the documents'
*permissions* have changed. Whenever Unstructured performs incremental processing of documents for a
workflow (in other words, if **Reprocess All Files** is turned off or set
to false for a workflow), that worfklow will not output metadata for any
document permissions that have been added, changed, or removed since the
previous workflow run, *unless* the corresponding documents' content
has also been changed since the previous workflow run.
Always take into account the `deny_users` and `deny_groups` fields when determining the effective permissions a user or group has. Not doing so may result in over-granting permissions.
Unstructured does not resolve groups into users when outputting permissions metadata.
Unstructured derives permissions metadata from the document's ACL, returned inline with the document's metadata via the IBM FileNet GraphQL API.
The document ACL returned by IBM FileNet includes the full effective ACL, including inherited permissions. Because of this, Unstructured does not further query for inherited permissions. For more information, see [ACE source: Default, Direct, Inherited, Template](https://www.ibm.com/docs/en/filenet-p8-platform/5.7.0?topic=rights-ace-source-default-direct-inherited-template) in the IBM FileNet Platform documentation.
Unstructured does not include the following permission values in the `permissions_data` field:
* MARKING
Marking is a security classification system layered on top of standard ACL permissions. For more information, see [Markings overview](https://www.ibm.com/docs/en/filenet-p8-platform/5.7.0?topic=markings-overview) in the IBM FileNet Platform documentation.
* PROXY
Permissions granted to a principal to act on behalf of another principal.
Unstructured writes a maximum of 1000 permission entries (ALLOW and DENY) per file.
### Permissions evaluation
IBM FileNet supports explicit DENY ACEs and evaluates them with DENY-wins semantics. This means that if a user has both an ALLOW and a DENY ACE for the same action, whether directly or through group membership, the DENY takes
precedence. For more information, see [Allow or Deny and order of evaluation](https://www.ibm.com/docs/en/filenet-p8-platform/5.7.0?topic=permissions-allow-or-deny-and-order-of-evaluation) in the IBM FileNet Platform documentation.
### Identifier formats
The connector takes the `granteeName` value that IBM FileNet returns and writes it directly into `users`, `groups`, `deny_users`, or `deny_groups` without any modification. The format of that identifier depends entirely on how your specific IBM FileNet instance is connected to its directory service.
* IBM FileNet SaaS (IBM Cloud Identity)
LDAP distinguished names are used. For example:
Users:`uid=alice.smith,cn=users,O=IBM,C=US`
Groups: `cn=Finance,cn=groups,O=IBM,C=US`
* On-premises with Active Directory
Several possible formats are possible. For example:
* A CN=.../DC=... distinguished name:
`CN=Alice Smith,OU=Staff,DC=contoso,DC=com`
* A DOMAIN\user short name:
`CONTOSO\alice.smith`
* A Windows SID:
`S-1-5-21-3623811015-3361044348-30300820-1013`
* A userPrincipalName:
`alice.smith@contoso.com`
If you're building a
downstream system that filters on these values, you will need to verify which format your instance
uses before writing that logic. We recommend running a sample query against your instance to check.
### Metadata output example
The following example shows what the output looks like. Ellipses indicate content that has been omitted from this example for brevity. This example uses IBM FileNet SaaS (IBM Cloud Identity) with LDAP distinguished names.
```json theme={null}
[
{
"...": "...",
"metadata": {
"...": "...",
"data_source": {
"...": "...",
"permissions_data": [
{
"read": {
"users": ["uid=alice,cn=users,O=IBM,C=US"],
"groups": ["cn=Finance,cn=groups,O=IBM,C=US"],
"deny_users": ["uid=contractor,cn=users,O=IBM,C=US"],
"deny_groups": []
}
},
{
"update": {
"users": ["uid=alice,cn=users,O=IBM,C=US"],
"groups": [],
"deny_users": [],
"deny_groups": []
}
},
{
"delete": {
"users": [],
"groups": [],
"deny_users": [],
"deny_groups": []
}
}
],
"...": "..."
}
}
}
]
```
## Creating the connector
To create the source connector:
1. On the sidebar, click **Connectors**.
2. Click **Sources**.
3. Click **New** or **Create Connector**.
4. For **Name**, enter a unique name for this connector.
5. In the **Provider** area, click **IBM FileNet**.
6. Click **Continue**.
7. Follow the on-screen instructions to fill in the fields as described later on this page.
8. Click **Save and Test**.
Fill in the following fields:
* **Name** (*required*): A unique name for this connector.
* **Server URL** (*required*): The base URL of your Content Platform Engine, containing both the IBM domain and your company's subdomain. For example, `https://.automationcloud.ibm.com`.
* **Object Store** (*required*): The name of the object store to connect within the server.
* **Folder Path** (*required*, source connector only): The path to the folder within the object store to use as the source.
* **Target Folder** (*required*, destination connector only): The path to the folder within the object store to use as the upload destination.
* **Document Class**: The class of documents to include.
* **Recursive**: (Source connector only) Select to include documents contained in any subfolders.
* **Username** (*required*): The username of the IBM Cloud Pak for Business Automation as a Service account to use.
* **Password** (*required*): The password for the corresponding username.