I have a BDC / BCS model that I use for indexing content with SharePoint Search. In the model, I assign item-level security using the method described on this MSDN article: http://msdn.microsoft.com/en-us/library/office/gg294169(v=office.15).aspx.
This method gets the NTAccount object for each user and then adds it's SID (Security Identifier) to the access control list and returns the byte array for it. This works in cases where an item doesn't have a lot of unique users assigned to it. However, when there are too many users, the following exception is thrown:
Error mapping username 'DOMAIN\username': System.OverflowException: Length of the access control list exceed the allowed maximum. at System.Security.AccessControl.RawAcl.InsertAce(Int32 index, GenericAce ace) at System.Security.AccessControl.CommonAcl.AddQualifiedAce(SecurityIdentifier sid, AceQualifier qualifier, Int32 accessMask, AceFlags flags, ObjectAceFlags objectFlags, Guid objectType, Guid inheritedObjectType)
In the environment I am working with, I am limited to two ways to identify who should see an item: 1) by individual user, or 2) by the SharePoint groups from the SharePoint web these items are associated with. (The data is from an external system, but the items relate to specific SPWebs, and therefore the permissions to the item could be correlated to the permissions on the SPWeb).
The only ways I have found to assign permissions in the search BDC model is by the SID from the NTAccounts or the SID for an AD group. AD groups aren't much help to me here.
In a nutshell, I am looking for a way to either 1) increase the maximum length of the ACL for an item (probably not idea) or 2) use a SharePoint group to define who has permissions. With option #2 being preferable, is there anyway to use a SharePoint group in a custom BDC model for the item-level security? If not, is there anyway to increase the length of the ACLs for the BDC model?
Also, what is the maximum number of records I can add to the ACL in this situation? For the interim, I will just limit the number of users added to the record, but I need to figure out what the maximum should be.