Enforcing native access control to indexed documents

• US 20070016583A1
• Filed: 07/14/2005
• Published: 01/18/2007
• Est. Priority Date: 07/14/2005
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Lempel, Ronny, Perez, Justo, Leyba, Todd, McPherson, John
• Granted Patent: US 8,417,693 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/6227 where protection concerns the structure of data, e.g. records, types, queries

Abstract

Techniques are provided for processing a search request. One or more indexed levels of access control list information are stored in a search index for each document identified in the search index. An interim result set is generated by matching the one or more indexed levels of access control list information associated with each said document to one or more security groups associated with the search request. A final result set is generated from the interim result set by performing impersonation.

Claims

1. A method for processing a search request, comprising:

storing one or more indexed levels of access control list information in a search index for each document identified in the search index;

generating an interim result set by matching the one or more indexed levels of access control list information associated with each said document to one or more security groups associated with the search request; and

generating a final result set from the interim result set by performing impersonation.

2. The method of claim 1, further comprising:

retrieving one or more native levels of access control list information for a document;

mapping the retrieved one or more native levels of access control list information to one or more indexed levels of access control list information; and

storing the mapped information in the search index.

3. The method of claim 1, further comprising:

receiving valid user login data for a user; and

determining whether a user profile exists, wherein an existing user profile stores the one or more security groups associated with the user for use in generating the interim result set.

4. The method of claim 3, further comprising:

in response to determining that the user profile does not exist,

receiving user security credentials for one or more backend repositories;

storing the user security credentials in the user profile for the user;

for each of one or more backend repositories associated with the user security credentials stored in the user profile;

(1) logging in to said backend repository; and

(2) in response to determining that the log in is successful,

(a) extracting the one or more security groups for which the user is a member from said backend repository; and

(b) storing the extracted one or more security groups in the user profile; and

generating a security context for the user with the stored one or more security groups.

5. The method of claim 4, further comprising:

in response to determining that the log in is not successful, prompting the user for user credentials to access said backend repository.

6. The method of claim 3, further comprising:

in response to determining that the user profile exists,

for each of one or more backend repositories associated with user security credentials stored in the user profile;

(1) logging in to said backend repository; and

(2) in response to determining that the log in is successful,

(a) extracting the one or more security groups for which the user is a member from said backend repository; and

(b) storing the extracted one or more security groups in the user profile; and

generating a security context for the user with the stored one or more security groups.

7. The method of claim 6, further comprising:

in response to determining that the log in is not successful, prompting the user for user credentials to access said backend repository.

8. The method of claim 1, further comprising:

generating a pre-filtered list of documents by matching terms of the search request by using the search index, wherein the interim result set is generated from the pre-filtered list of documents.

9. The method of claim 1, further comprising:

providing the final result set to the user, wherein the user is enabled to select documents that are then provided by the backend repositories.

10. The method of claim 1, further comprising:

when the final result set contains documents originating from different backend repositories, performing concurrent execution of impersonations with each different backend repository.

11. The method of claim 1, further comprising:

when the final result set contains multiple documents from a backend repository, performing a single impersonation for the multiple documents.

12. The method of claim 1, when a page is capable if displaying a predefined number of results and further comprising:

performing one or more impersonations to display the predefined number of results or fewer than the predefined number of results on the page.

13. The method of claim 12, further comprising:

maintaining a separate offset into the interim result set representing a last successful impersonation.

14. An article of manufacture for processing a search request, wherein the article of manufacture stores instructions, and wherein the article of manufacture is operable to:

store one or more indexed levels of access control information in a search index for each document identified in the search index;

generate an interim result set by matching the one or more indexed levels of access control list information associated with each said document to one or more security groups associated with the search request; and

generate a final result set from the interim result set by performing impersonation.

15. The article of manufacture of claim 14, wherein the article of manufacture is operable to:

retrieve one or more native levels of access control list information for a document;

map the retrieved one or more native levels of access control list information to one or more indexed levels of access control list information; and

store the mapped information in the search index.

16. The article of manufacture of claim 14, wherein the article of manufacture is operable to:

receive valid user login data for a user; and

determine whether a user profile exists, wherein an existing user profile stores the one or more security groups associated with the user for use in generating the interim result set.

17. The article of manufacture of claim 16, wherein the article of manufacture is operable to:

in response to determining that the user profile does not exist,

receive user security credentials for one or more backend repositories;

store the user security credentials in the user profile for the user;

for each of one or more backend repositories associated with the user security credentials stored in the user profile;

(1) log in to said backend repository; and

(2) in response to determining that the log in is successful,

(a) extract the one or more security groups for which the user is a member from said backend repository; and

(b) store the extracted one or more security groups in the user profile; and

generate a security context for the user with the stored one or more security groups.

18. The article of manufacture of claim 17, wherein the article of manufacture is operable to:

in response to determining that the log in is not successful, prompt the user for user credentials to access said backend repository.

19. The article of manufacture of claim 16, wherein the article of manufacture is operable to:

in response to determining that the user profile exists,

for each of one or more backend repositories associated with user security credentials stored in the user profile;

(1) log in to said backend repository; and

(2) in response to determining that the log in is successful,

(a) extract the one or more security groups for which the user is a member from said backend repository; and

(b) store the extracted one or more security groups in the user profile; and

generate a security context for the user with the stored one or more security groups.

20. The article of manufacture of claim 19, wherein the article of manufacture is operable to:

in response to determining that the log in is not successful, prompt the user for user credentials to access said backend repository.

21. The article of manufacture of claim 14, wherein the article of manufacture is operable to:

generate a pre-filtered list of documents by matching terms of the search request by using the search index, wherein the interim result set is generated from the pre-filtered list of documents.

22. The article of manufacture of claim 14, wherein the article of manufacture is operable to:

provide the final result set to the user, wherein the user is enabled to select documents that are then provided by the backend repositories.

23. The article of manufacture of claim 14, wherein the article of manufacture is operable to:

when the final result set contains documents originating from different backend repositories, perform concurrent execution of impersonations with each different backend repository.

24. The article of manufacture of claim 14, wherein the article of manufacture is operable to:

when the final result set contains multiple documents from a backend repository, perform a single impersonation for the multiple documents.

25. The article of manufacture of claim 14, when a page is capable if displaying a predefined number of results and wherein the article of manufacture is operable to:

perform one or more impersonations to display the predefined number of results or fewer than the predefined number of results on the page.

26. The article of manufacture of claim 25, wherein the article of manufacture is operable to:

maintaining a separate offset into the interim result set representing a last successful impersonation.

27. A system for processing a search request, comprising:

logic capable of causing operations to be performed, the operations comprising;

storing one or more indexed levels of access control list information in a search index for each document identified in the search index;

generating an interim result set by matching the one or more indexed levels of access control list information associated with each said document to one or more security groups associated with the search request; and

generating a final result set from the interim result set by performing impersonation.

28. The system of claim 27, wherein the operations further comprise:

retrieving one or more native levels of access control list information for a document;

mapping the retrieved one or more native levels of access control list information to one or more indexed levels of access control list information; and

storing the mapped information in the search index.

29. The system of claim 27, wherein the operations further comprise:

receiving valid user login data for a user; and

determining whether a user profile exists, wherein an existing user profile stores the one or more security groups associated with the user for use in generating the interim result set.

30. The system of claim 29, wherein the operations further comprise:

in response to determining that the user profile does not exist,

receiving user security credentials for one or more backend repositories;

storing the user security credentials in the user profile for the user;

for each of one or more backend repositories associated with the user security credentials stored in the user profile;

(1) logging in to said backend repository; and

(2) in response to determining that the log in is successful,

(a) extracting the one or more security groups for which the user is a member from said backend repository; and

(b) storing the extracted one or more security groups in the user profile; and

generating a security context for the user with the stored one or more security groups.

31. The system of claim 30, wherein the operations further comprise:

in response to determining that the log in is not successful, prompting the user for user credentials to access said backend repository.

32. The system of claim 29, wherein the operations further comprise:

in response to determining that the user profile exists,

for each of one or more backend repositories associated with user security credentials stored in the user profile;

(1) logging in to said backend repository; and

(2) in response to determining that the log in is successful,

(a) extracting the one or more security groups for which the user is a member from said backend repository; and

(b) storing the extracted one or more security groups in the user profile; and

generating a security context for the user with the stored one or more security groups.

33. The system of claim 32, wherein the operations further comprise:

in response to determining that the log in is not successful, prompting the user for user credentials to access said backend repository.

34. The system of claim 27, wherein the operations further comprise:

generating a pre-filtered list of documents by matching terms of the search request by using the search index, wherein the interim result set is generated from the pre-filtered list of documents.

35. The system of claim 27, wherein the operations further comprise:

providing the final result set to the user, wherein the user is enabled to select documents that are then provided by the backend repositories.

36. The system of claim 27, wherein the operations further comprise:

when the final result set contains documents originating from different backend repositories, performing concurrent execution of impersonations with each different backend repository.

37. The system of claim 27, wherein the operations further comprise:

when the final result set contains multiple documents from a backend repository, performing a single impersonation for the multiple documents.

38. The system of claim 27, when a page is capable if displaying a predefined number of results and wherein the operations further comprise:

performing one or more impersonations to display the predefined number of results or fewer than the predefined number of results on the page.

39. The system of claim 35, wherein the operations further comprise:

maintaining a separate offset into the interim result set representing a last successful impersonation.