10

We have integrated a back-end web application into SharePoint 2010 using the BCS and the OOTB Web Services connector.

The data in the backend system is protected by ACLs and we need these ACLs to be applied when displaying results in SharePoint search.

Our back-end web application does not use windows authentication and implements it's own ACL system. This means we cannot generate the necessary binary windows security descriptors to make use of the WindowsSecurityDescriptorField mechanism.

We made use of the run time search trimming by adding an AccessChecker MethodInstance to our Entities

This works perfectly for SharePoint Enterprise Search however the security trimming is not applied when using FAST Search.

According to the FSA Data Flow document it seems that security trimming is supported based on claims.

It might be possible to map our web applications ACLs to claims however I can't find any documentation on how to configure this.

Can any one confirm this is technically possible in the context of the BCS?

Improve this question
4
  • I suspect the issue is that FAST does not work with post-filtering trimming, so you have to include your acl's during indexing. This is a known issue, but no fix has yet been released afaik. What is the relationship between your bcs acl's and the windows users/groups?
    – Mikael Svenson
    Sep 27, 2011 at 11:35
  • They are completely orthogonal. Our backed end web application often runs on Solaris so it has it's own user database and ACL lists completely disjoint from Windows.
    – Steve P
    Sep 28, 2011 at 6:49
  • That's fine.. for starters, what property from a user would you like to use against the Solaris items? user<->user mapping, or do you have some claims which could be forwarded?
    – Mikael Svenson
    Sep 28, 2011 at 9:47
  • We should be able to generate claims and put them into a field of our External Content Type. The problem is how do we tell FAST that this field contains claims and should be used for security trimming.
    – Steve P
    Sep 28, 2011 at 18:32

3 Answers 3

Reset to default
1

There is no way to do what you want.

The only way is to convert your ACL to Windows ACL at indexing time. In the connector, you can create any ACL you want. The only thing you need is a way to map user in your app to user or group in AD, and this should be feasible in most cases.

Edit: The FSA data flow is correct, internally the engine is able to security trim on claims. However, there is no way in BCS and custom connector to build claims ACL and feed them to the engine.

Improve this answer
0

Can you create a dynamic filter appended to query that uses the column containing the claim? At a basic level, that is what FAST security trimming is doing.

Improve this answer
1
0

I agree with @Nico. See http://www.threewill.com/2011/03/security-trimming-secrets/ for more details.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.