I have a quite delicate issues with SharePoint Search (2013 / 2016 onprem).
The background story
We want to use the SharePoint Search with a discrete Search Service Application to crawl a CoreMedia System. At the moment I have a Content Source with an http crawler, setup with multiple include and exclude rules and a CEWS to grab some additional metadata from remote lists, that are added to crawled documents from that source. There are about 30+ crawled properties (Type Web and Document) which I mapped to custom managed properties. They are partially refinable, multivalue or safe for anonymous usage, depending on their use.
Everything works just fine, except the security trimming aspect. As for the currently existing security concept we have old in-house developed logic which does some custom trimming, depending on the values written in a Header metatag. Until now the trimming has been done by the result page (custom code) in CoreMedia. With the new Content Source, there is a crawled / managed property in each entry in the index, containing a list of ad-group names. Those are the groups which should have access to that url.
My goal would be to replace the existing Google Search Appliance with a SharePoint Search implementation. The self-made result page in CoreMedia will be used to display results and "only" the SharePoint Crawl and Query engine will be consumed via Web service Calls (software architecture decision).
The issue
As I would like to get rid of the custom late binding trimming on the web frontend side and rather use the SharePoint concept it would be great to have a way to do the trimming somewhere in SharePoint. As the crawled items don't have any ACLs in the index (unfortunately CEWS can`t produce ACLs) I tried to use the ISecurityTrimmerPost and / or ISecurityTrimmerPre Interfaces to somehow do the trick.
From my research this far, I found out that the TrimmerPre Interface has two Methods, Initialize and AddAccess. It seems to be impossible to get the filter, refiner, properties… that where called within the user query. The staticProperties in the Initialize method are always empty. As it seems I can only use the TrimmerPre to modify the ACLs which are used for the trimming of the objects in the index. That doesn't help if my index doesn`t have any security objects.
The TrimmerPost on the other hand has an Initialize and a CheckAccess method. I hoped to find not only the URLs of the result set but also the additional information that has been requested by the query (refiner, filter, properties). But as it seems only the List of documentUrls, the userIdentity and the documentACLs are transmitted into the TrimmerPost interface.
My idea was to identify the relevant ad groups the user belongs to in the CustomTrimmerPre (there are only 23 relevant groups in the system), store them in the sessionProperties and use them to trim out results in the CustomTrimmerPost. The transportation of those information work from Pre to Post, but then I realized that I don`t have access to the values of the managed properties belonging to each documentUrl. To run another query in code for each result entry in order to get the managed property value is a bit of an overkill.
The only other option I found was to go a completely different path and write a custom web connector which also seems extremely complex.
Any thoughts or ideas what else I can look into to do trimming of external sources without relying on frontend filtering on the Result Page?
