Re: Permissioning Documents

2004-12-10 Thread Paul Elschot
On Friday 10 December 2004 07:10, Steve Skillcorn wrote:
 Hi;
  
 I'm currently using Lucene (which I am extremely impressed with BTW) to
 index a knowledge base of documents.  One issue I have is that only certain
 documents are available to certain users (or groups).  The number of
 documents is large, into the 100,000s, and the number of uses can be into
 the 1000s.  Obviously, the users permissioned to see certain documents can
 change regularly, so storing the user id's in the Lucene document is
 undesirable, as a permission change could mean a delete and re-add to
 potentially 100s of documents.
  
 Does anyone have any guidance as to how I should approach this?

A typical solution would be to use a Filter for each user group.
Each Filter would be built from categories indexed with the documents.
The moment to build a group Filter could be the first time a user from
a group queries an index after it is opened.
Filters can be cached, see the recent discussion on CachingWrappingFilter
and friends.

Regards,
Paul Elschot


-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]



Re: Permissioning Documents

2004-12-10 Thread mark harwood
Hi Steve,
Possibly the easiest way to handle this is to tag the
documents with a field listing the permitted
roles/groups (not the individual users). 
I would be tempted to keep the information that
associates users to groups outside of the Lucene index
eg in a relational DB. 
This way you do not need to worry about updating the
Lucene index everytime a new user is added or is
granted membership to a group. 

When you search, simply use a QueryFilter which lists
the current user's roles e.g. groups:(admin,
projectManager) - this will restrict the search
results to only those docs associated with the user's
roles.

Cheers
Mark






___ 
Win a castle for NYE with your mates and Yahoo! Messenger 
http://uk.messenger.yahoo.com

-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]