Win a copy of The Java Performance Companion this week in the Performance forum!
  • Post Reply
  • Bookmark Topic Watch Topic
  • New Topic

Can Lucene be used with a mix of password protected data and nonpassword protected data?

 
Grae Cullen
Greenhorn
Posts: 19
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
Hi,

I guess at first glance it seems like Lucene would return all results from a group of data, even if a particular user was only allowed to view half of the data.

For example, suppose "User A" could view files 1, 5 and 7 and "User B" could view files 1, 2, 3 and 4. If the search term occurs in file 3, will "User A" see that result. Of course, he should not see the result, but since Lucene scans all the files, how does Lucene mark that User A should not see certain files.

Grae
 
David Newton
Author
Rancher
Posts: 12617
IntelliJ IDE Ruby
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
It doesn't, but one thing you could do is add an "access" field (or roles, or whatever) and use that as part of your search query.

Lucene has no concept of "users"--it's an index. (Unless that's changed.)
 
Michael McCandless
author
Greenhorn
Posts: 20
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
Lucene provides the facilities for implementing entitlements, eg providing a Filter to restrict the search results, allowing for security tokens to be directly indexed and then AND'd with the query, etc.

But it's up to your app to tap into these capabilities to implement the security it requires.
 
Gian Franco
blacksmith
Ranch Hand
Posts: 979
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
Hi,

In one project we solved a similar case by
adding an index field containing the String
for managing the access.

In every search a hidden search clause
was added to filter the search results...

Cheers,

Gian
 
  • Post Reply
  • Bookmark Topic Watch Topic
  • New Topic