1. Home
  2. Development
  3. Search Engine - handling permissions

Search Engine - handling permissions

Jan Tošovský, modified 6 Years ago.
Search Engine - handling permissions
Liferay Master Posts: 576 Join Date: 7/22/10 Recent Posts
In 6.2 I found the reason of slow search in our case is not Lucene, but subsequent permission checks (our permission logic is quite complex).

For 7.x, after migrating, I planned to simplify that permission logic to be even able to pass all the necessary into Search Engine directly so no permission checking is needed afterwards.

But reading 7.1 documentation I am discovering completely different world.

Especially this is quite unclear:

In previous versions of Liferay Portal, search was only permissions aware (indexed with the entity’s permissions and searched with those permissions intact) if the application developer specified this line in the 
Indexer
class’s constructor:
[code]setPermissionAware(true);
Now, search is permissions aware by default if the new permissions approach, as described in these tutorials, is implemented for an application.
https://dev.liferay.com/es/develop/tutorials/-/knowledge_base/7-1/indexing-framework#permissions-aware-searching-and-indexing

Does it mean that permission checks cannot be disabled? Or is that permission check performed directly by the search engine, not afterwards by Liferay Engine?

Has anybody some insights how search results permission checks are done in the context of the new Search API?

Thanks,

Jan
thumbnail
Jorge Díaz, modified 6 Years ago.
RE: Search Engine - handling permissions
Liferay Master Posts: 753 Join Date: 1/9/14 Recent Posts
Hi Jan,

Indexer framework has changed since 7.1 and now instead of having a big *Indexer class that extends BaseIndexer, you have to create several smaller classes as explained here:
With this new approach,  setPermissionAware(true/false) is not longer necessary as it relies in the new permissions framework explained here:
It is not necessary to define "permission aware", as index/search behavior is automatic: in case you define a ModelResourcePermission service for your entity, permission info will be used during indexation and search.

In case ModelResourcePermission service doesn't exists, it won't be applied. See:
If you consider all this stuff is very complicated, for now you can still creating your Indexer class extending BaseIndexer.java as it is still supported, but sooner or later this kind of Indexers will be deprecated and removed.

Regards,
Jorge