Tell me more ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.
up vote -1 down vote favorite

The windows account the Sharepoint search service runs under neither needs to be administrator nor farm account.

How does the search crawler access the content dbs? Which identity does it use to log in to the sql server databases? Where does it get the credentials for the impersonation?

I am not talking about SharePoint ACLs and the web application policy which enables the search account to access the SharePoint objects ... just the windows identity used for the SQL Server login/authentication.

share|improve this question

migrated from stackoverflow.com Apr 27 '12 at 21:14

2 Answers

up vote 2 down vote accepted

The search crawler does not access Content Databases at all. The search crawler uses the SharePoint Object Model to crawl SharePoint content in a similar fashion to how a user would view the content.

share|improve this answer
If you are talking about how the Search Service Application authenticates to the SQL databases for the Search databases (the crawl DB, store DB, etc.), it uses the account you specify on the Search Service Application settings. – John Chapman Apr 27 '12 at 22:28
The object model is simply an abstraction and uses a database connection to access the content databases. Since connecting to the content databases uses integrated authentication, it needs an identity with appropriate permissions at SQL Sever level – foobarfoofoo Apr 27 '12 at 23:13
"in a similar fashion to how a user would view the content. " ... users access the SharePoint sites using the IIS web applications (wcf services also hosted in iis) ... the application pool identity always has access to the content dbs. This is the difference between the search service, which runs under a different identity. – foobarfoofoo Apr 27 '12 at 23:44
1  
I don't think you are understanding how this works. The search crawler accesses the SharePoint content via the SharePoint application layer, not the SharePoint Content Databases directly. When a particular item is being crawled, the search service requests the item from the SharePoint application layer which then retrieves the content like it would as if a user were requesting it (the SharePoint application, running under the current App Pool service account, accesses the database and returns the item). – John Chapman Apr 28 '12 at 0:33
1  
The actual SQL query to retrieve the item is done by the SharePoint Web Application being crawled. This means that the credentials used to get the item from SQL are the ones for the Application Pool of the Web Application being crawled. Again, the search crawler NEVER touches the SharePoint Web Content databases. – John Chapman Apr 28 '12 at 0:35
up vote 0 down vote

The Search Service crawls the object model, not the SQL server directly. Thus, the SQL authentication is occurring using the normal farm/app pool account.

The Search service account is used to connect to the search db, but it never actually connects to the content databases directly.

See http://technet.microsoft.com/en-us/library/cc678863.aspx#Section3.

SharePoint Server search service account

The SharePoint Server 2010 Search service account is used as the service account for the SharePoint Server 2010 Search service. The SharePoint Server Search Service is an NT Service, which is used by all Search Service Applications. For any given server, there is only one instance of this service. The SharePoint Server 2010 search service account requires the following permission configuration setting: The SharePoint Server 2010 search service account is granted access to the propagation location share (or shares) on all search query servers in a farm.

The following machine-level permission is configured automatically: The SharePoint Server 2010 search service account is a member of WSS_WPG.

The following SQL Server and database permissions are configured automatically:

  • This account is assigned to the WSS_CONTENT_APPLICATION_POOLS role associated with the farm configuration database.

  • This account is assigned to the WSS_CONTENT_APPLICATION_POOLS role associated with the SharePoint_Admin content database.

share|improve this answer
Yes and no ... yes, the crawler uses the OM. The OM uses the process identity to access the content db, which, in case of the search crawler, is either a windows service (osearch14) or the mssdmn.exe process spawned from the osearch14 service ... both run under the Search Service process account. No apppool accounts here, and RevertToSelf/RunAsElevated won't work – foobarfoofoo Apr 27 '12 at 21:00
BTW, this is a question regarding programming for the SharePoint API. – foobarfoofoo Apr 27 '12 at 21:25
What part of "Which identity does it (the search crawl process) use to log in to the sql server databases" is difficult to understand? To access the content db, you need to login to the Sql Server database. We are talking about the content databases, on which the search service account (which happens to be the identity under which the crawl process executes) does not have any permissions. WHAT IDENTITY does it use/impersonate, so that it can access the sql server content db? And where does it get these credentials from? – foobarfoofoo Apr 27 '12 at 21:34
The excerpt I pasted says that those permissions are automatically assigned to the service account when it is configured. Good luck getting an answer that satisfies you. – Kyle Trauberman Apr 27 '12 at 21:40
Did you realize that the search service account does not have any permissions on the content databases? It does not say that in your excerpt, nor in the article you linked. It does use other identities to access these dbs and I want to know how that works (without disassembling the whole crawler code). – foobarfoofoo Apr 27 '12 at 21:42

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.