Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

I'm implementing a custom BCS Model to get data from a backend system. As the backend uses it's own user management, I'm accessing it through a service account.

All of this works well and allows me to pull data into SharePoint. However because it's channeled through the service account, everyone can access it, which is bad.

Can anyone give me some tips which method to implement? The backend does not give me NT ACLs, but I wonder if I could just "fake" them somehow? (Essentially saying "This NT Group has Read Access" is good enough).

I am aware of ISecurityTrimmer2 for Search Results, but ideally I want to cover security inside the BCS Model so that it applies to external lists as well. I want to avoid using Secure storage and mapping each individual user to the backend.

share|improve this question
add comment

2 Answers

It looks like you got a pretty good answer here. Also, there's no such thing as a "fake" ACL. Even if your back-end system doesn't have the notion of true ACLs, as long as the security is representable by ACLs, you can use them. SharePoint doesn't know/care where the ACLs came from.

share|improve this answer
add comment

One option as you say is to leverage the Secure Store Service (SSS) and allow users to map their credentials of the account they use to access SharePoint your backend system. This mapping is done by the user in a self-service way if it can't find a match, not by an admin.

However if you don't want to do that, you could implement a custom .NET Assembly Connector and within it implement the BinarySecurityDescriptorAccessor operator.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.