We have two zones - Default is Claims based and Custom is NTLM - this one is used for crawling.

My issue is that when I search under anonymous user - the protected content is returned, even though when I try to click the link - it gives me permission error (which is good).

Any ideas?

  • You can remove the 'protected' content from the search results - But that defeats the purpose of the search when you're a recognized user – TeckniX Sep 6 '11 at 21:03
  • Which zone do you have Anonymous access enabled on? How are you 'protecting' the content? Do you mean a list/library or site that does not have Anonymous access enabled? Is there content that does have Anonymous access enabled? – Jason Jones Sep 7 '11 at 16:06
  • All Zones have Anonymous enabled; but at Doc Library in one case and site in another the permissions are overwritten and anonymous access removed. Again, I can not view the content, but it does show up in the result – IMHO Sep 7 '11 at 23:38
  • Since you are crawling two sites do you have server name mapping for your NTLM URL's to show up as the Claims ones? We have a similar setup and at one point the URL's were not recognized for trimming because they were not the Claim's ones. – MichaelF Sep 9 '11 at 20:32

IMHO - I reproduced the issue you are having on one of our systems except for the use of Claims authentication. My search account does have 'Read' access for the web application. A list was created and anonymous access was initially enabled from inheritance. The search index was already built (it is scheduled to run often) and could query the list as anonymous. Then I removed anonymous access from that list and ran an incremental crawl. I was still able to get results from that list (now restricted content) as an anonymous user, but got the login prompt when trying to access via results.

I then did an index reset and after the rebuild, attempted the same query I did before and no longer saw the 'restricted content'. I could still find the 'restricted content' with an account that does have access to the list.

So I believe you could reset your search index and then do a full crawl and the results should be trimmed correctly. As always, I would recommend you test on your system and understand the implications of an index reset.

  • Nice effort! Always nice to see someone go the distance to help his fellow sharepoint devs / itpro's! – Colin Sep 14 '11 at 21:34
  • I've seen the same issues where until you do the incremental/full the older permissions are not purged from the system. – MichaelF Sep 16 '11 at 14:15
  • +1 for that 'extra mile' and to avoid any doubt on who will won this bounty. I cannot tell if this is right answer but like @Colin pointed before: Nice effort. – Vedran Rasol Sep 16 '11 at 14:39
  • I'll try that; but we have reset the index multiple times...no luck – IMHO Sep 24 '11 at 2:16

It's not a short or simple article but I think it applies to your issue:

Trim SharePoint Search Results for Better Security

Microsoft SharePoint search uses an account that usually has full read access across the repository to index its contents. So it’s important that when a user queries for some content, he should be restricted to view only the documents he has permission to see.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.