Specifying ACLs using the FAST Content API

Question

I'm using the deprecated content API to push data into the FAST Search Server for Sharepoint 2010 index. Migrating to BCS is on the roadmap, but in the meantime I want to add ACL information to the documents I'm pushing into the index.

I know that for the old FAST ESP server ACL information was specified using the docacl and docaclsystemid properties, but I have found no definite information regarding

• if these properties are still available in the 2010 version
• how these properties are encoded

How can I specify ACLs when when submitting documents using the FAST Content API ?

Answer 1

docacl is still persisted in 2010, but appropriate managed property has [SummaryType] set to Disabled. To see the value of this property you must set SummaryType to Static or Dynamic. I don't know how they encoded, usually single value looks like this:

winaecqaaaaaaaakfiaaaadf4pmsee5mubf43xwubpiamaaa 

you can extract value of this property using powershell (Get-FASTSearchSecurityEncodedSid, Get-FASTSearchSecurityDecodedSid) or .net code. Some more info here.

If using content api, you can specify acl in this way:

//To allow access for specic groups/users, the NTAccount class can be used
string userName = @"username|group";
NTAccount account = new NTAccount(userName);
SecurityIdentifier sid = (SecurityIdentifier)account.Translate(typeof(SecurityIdentifier));
DiscretionaryAcl dacl = new DiscretionaryAcl(false, false, 1);
dacl.AddAccess(AccessControlType.Allow, sid, 0x7, InheritanceFlags.None, PropagationFlags.None);
CommonSecurityDescriptor sd = new CommonSecurityDescriptor(false, false, ControlFlags.DiscretionaryAclPresent,
                                                              sid, sid, null, dacl);
doc.SecurityDescriptor = sd.GetSddlForm(AccessControlSections.All);

or

doc.SecurityDescriptor = Document.VISIBLE_TO_ALL;

to make it visible to all users. This code is from samples of content api for fast search for sharepoint.