Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

We have integrated a back-end web application into SharePoint 2010 using the BCS and the OOTB Web Services connector.

The data in the backend system is protected by ACLs and we need these ACLs to be applied when displaying results in SharePoint search.

Our back-end web application does not use windows authentication and implements it's own ACL system. This means we cannot generate the necessary binary windows security descriptors to make use of the WindowsSecurityDescriptorField mechanism.

We made use of the run time search trimming by adding an AccessChecker MethodInstance to our Entities

This works perfectly for SharePoint Enterprise Search however the security trimming is not applied when using FAST Search.

According to the FSA Data Flow document it seems that security trimming is supported based on claims.

It might be possible to map our web applications ACLs to claims however I can't find any documentation on how to configure this.

Can any one confirm this is technically possible in the context of the BCS?

share|improve this question
    
I suspect the issue is that FAST does not work with post-filtering trimming, so you have to include your acl's during indexing. This is a known issue, but no fix has yet been released afaik. What is the relationship between your bcs acl's and the windows users/groups? –  Mikael - SharePoint MVP Sep 27 '11 at 11:35
    
They are completely orthogonal. Our backed end web application often runs on Solaris so it has it's own user database and ACL lists completely disjoint from Windows. –  Steve P Sep 28 '11 at 6:49
    
That's fine.. for starters, what property from a user would you like to use against the Solaris items? user<->user mapping, or do you have some claims which could be forwarded? –  Mikael - SharePoint MVP Sep 28 '11 at 9:47
    
We should be able to generate claims and put them into a field of our External Content Type. The problem is how do we tell FAST that this field contains claims and should be used for security trimming. –  Steve P Sep 28 '11 at 18:32
add comment

3 Answers

There is no way to do what you want.

The only way is to convert your ACL to Windows ACL at indexing time. In the connector, you can create any ACL you want. The only thing you need is a way to map user in your app to user or group in AD, and this should be feasible in most cases.

Edit: The FSA data flow is correct, internally the engine is able to security trim on claims. However, there is no way in BCS and custom connector to build claims ACL and feed them to the engine.

share|improve this answer
add comment

Can you create a dynamic filter appended to query that uses the column containing the claim? At a basic level, that is what FAST security trimming is doing.

share|improve this answer
1  
Can you clarify what you mean by a "dynamic filter". I'm not familiar with the term and I couldn't find any references. google.com/search?q=FAST+search+dynamic+filter –  Steve P Nov 8 '11 at 21:33
add comment

I agree with @Nico. See http://www.threewill.com/2011/03/security-trimming-secrets/ for more details.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.