To ensure that only users with access to an item can see it in search results, index items with their access control lists (ACLs) from the enterprise repository. You must model the repository ACLs and include them when indexing items. The Content Connector SDK provides methods to model the ACLs of most repositories.
Create an ACL
Creating an ACL is a two-step process:
- Create a
Principalusing static methods in the ACL class. - Use the
Acl.Builderclass to build the ACL using the principal.
This document covers concepts to model and create ACLs, such as inheritance and containment.
Create a principal using an external ID
Google Cloud Search requires users and groups to resolve to Google email
addresses. When indexing repository items, content connectors might not have
these email addresses. However, the Content Connector SDK lets you use an
external ID (an ID granting a user or group access to repository items)
instead of an email address to index an item. Use the
getUserPrincipal
method or the
getGroupPrincipal
method to create principals containing external IDs. The
ACL
class includes several other static methods to build Principal objects.
After remapping an item's identity, you must reindex items for the new identity to take effect. For more information, refer to Remapping identities.
ACL inheritance
ACL inheritance refers to the authorization for a specific item and user based on the combined ACLs of the item and its inheritance chain. The rules for an authorization decision depend on the repository and the item properties.
Set inheritance
Each item can have direct allowed principals and direct denied principals,
specified using the
setReaders
and
setDeniedReaders
methods. A direct allowed principal is a user identified in an ACL with direct
access to an item. A direct denied principal is a user identified in an ACL as
not having access to an item.
An item can also inherit indirect allowed principals and indirect denied
principals using the
setInheritFrom
method. An indirect allowed principal has indirect access to an item through ACL
inheritance. An indirect denied principal is denied access through inheritance.