LDAP ACLs V2

​

Prerequisites

• The plugin zip file and the connector-plugin-standalone JAR.
• A configured connector backend gRPC endpoint.
• Username and password of a user with a remote-connectors or admin role.
• If the host where the remote connector is running is not configured to trust the server’s TLS certificate, you must configure the file path of the trust certificate collection.

​

Connector compatibility

​

System requirements

• (Fusion 5.9.0-5.9.10) JVM version 11
• (Fusion 5.9.11) JVM version 17
• Minimum of 2 CPUs
• 4GB Memory

​

Enable backend ingress

ingress:
  enabled: false
  pathtype: "Prefix"
  path: "/"
  #host: "ingress.example.com"
  ingressClassName: "nginx"   # Fusion 5.9.6 only
  tls:
    enabled: false
    certificateArn: ""
    # Enable the annotations field to override the default annotations
    #annotations: ""

• Set enabled to true to enable the backend ingress.
• Set pathtype to Prefix or Exact.
• Set path to the path where the backend will be available.
• Set host to the host where the backend will be available.
• In Fusion 5.9.6 only, you can set ingressClassName to one of the following:
  • nginx for Nginx Ingress Controller
  • alb for AWS Application Load Balancer (ALB)
• Configure TLS and certificates according to your CA’s procedures and policies.
  TLS must be enabled in order to use AWS ALB for ingress.

​

Connector configuration example

kafka-bridge:
  target: mynamespace-connectors-backend.lucidworkstest.com:443 # mandatory
  plain-text: false # optional, false by default.  
    proxy-server: # optional - needed when a forward proxy server is used to provide outbound access to the standalone connector
    host: host
    port: some-port
    user: user # optional
    password: password # optional
  trust: # optional - needed when the client's system doesn't trust the server's certificate
    cert-collection-filepath: path1

proxy: # mandatory fusion-proxy
  user: admin
  password: password123
  url: https://fusiontest.com/ # needed only when the connector plugin requires blob store access

plugin: # mandatory
  path: ./fs.zip
  type: #optional - the suffix is added to the connector id
    suffix: remote

​

Minimal example

kafka-bridge:
  target: mynamespace-connectors-backend.lucidworkstest.com:443

proxy:
  user: admin
  password: "password123"

plugin:
  path: ./testplugin.zip

​

Logback XML configuration file example

<configuration>
    <appender name="CONSOLE" class="ch.qos.logback.core.ConsoleAppender">
        <encoder class="com.lucidworks.logging.logback.classic.LucidworksPatternLayoutEncoder">
            <pattern>%d - %-5p [%t:%C{3.}@%L] - %m{nolookups}%n</pattern>
            <charset>utf8</charset>
        </encoder>
    </appender>

    <appender name="FILE" class="ch.qos.logback.core.rolling.RollingFileAppender">
        <file>${LOGDIR:-.}/connector.log</file>
        <rollingPolicy class="ch.qos.logback.core.rolling.SizeAndTimeBasedRollingPolicy">
            <!-- rollover daily -->
            <fileNamePattern>${LOGDIR:-.}/connector-%d{yyyy-MM-dd}.%i.log.gz</fileNamePattern>
            <maxFileSize>50MB</maxFileSize>
            <totalSizeCap>10GB</totalSizeCap>
        </rollingPolicy>
        <encoder class="com.lucidworks.logging.logback.classic.LucidworksPatternLayoutEncoder">
            <pattern>%d - %-5p [%t:%C{3.}@%L] - %m{nolookups}%n</pattern>
            <charset>utf8</charset>
        </encoder>
    </appender>

    <root level="INFO">
        <appender-ref ref="CONSOLE"/>
        <appender-ref ref="FILE"/>
    </root>
</configuration>

​

Run the remote connector

java [-Dlogging.config=[LOGBACK_XML_FILE]] \
  -jar connector-plugin-client-standalone.jar [YAML_CONFIG_FILE]

​

Test communication

java -Dstandalone.connector.connectivity.test=true -jar connector-plugin-client-standalone.jar [YAML_CONFIG_FILE]

​

Encryption

​

Egress and proxy server configuration

• Host. The hosts where the proxy server is running.
• Port. The port the proxy server is listening to for communication requests.
• Credentials. Optional proxy server user and password.

​

Password encryption

1. Enter a user name and password in the connector configuration YAML.
2. Run the standalone JAR with this property:
   Copy

   -Dstandalone.connector.encrypt.password=true
   

3. Retrieve the encrypted passwords from the log that is created.
4. Replace the clear password in the configuration YAML with the encrypted password.

​

Connector restart (5.7 and earlier)

​

Recoverable bridge (5.8 and later)

​

Job expiration duration (5.9.5 only)

​

Use the remote connector

​

Enable asynchronous parsing (5.9 and later)

• ACL documents: Users, Groups, and their Role Assignments.
• Content documents: The SharePoint objects with metadata and content (Sites, Lists, Items). These documents have _lw_acl_ss fields which determines who can see the docs when searching.

​

Set up the SharePoint datasource

1. Navigate to Indexing > Datasources.
2. Install the datasource connector if not already installed.
3. Click Add and select SharePoint Optimized V2.
4. Fill in all required fields.
5. Configure only one authentication method. Enable NLTM Authentication Settings or SharePoint Online Authentication and configure the fields as explained below.

​

NTLM Authentication

• User
• Password
• Domain
• Workstation

​

SharePoint Online Authentication

​

Basic

• SharePoint online account
• Password

​

App only (OAuth protocol)

• Azure AD client ID
• Azure AD tenant
• Azure AD Client Secret
• Azure AD login endpoint (advanced)
• Azure AD Refresh Token (advanced)

​

App only with private key

• Azure AD client ID
• Azure AD tenant
• Azure AD login endpoint
• Azure AD PKCS12 Base64 Keystore
• Azure AD PKCS12 Keystore Password

​

Set up the LDAP datasource

1. Navigate to Indexing > Datasources.
2. Install the datasource connector if not already installed.
3. Click Add and select LDAP and Azure ACLs Connector (V2).
4. Fill in all required fields.
5. Configure authentication methods. Enter LDAP login credentials and/or enable Azure AD Properties and configure the fields as explained below.

​

LDAP Authentication

• Login User Principal
• Login Password

​

Azure AD Authentication

• Azure AD Tenant ID
• Azure AD Client ID
• Azure AD Client Secret

​

Supported authentication methods for security trimming

​

Configure ACL collection

​

If using SharePoint-Optimized and LDAP-ACLs < v2.0.0

1. Navigate to Indexing > Datasources.
2. Open your SharePoint Optimized V2 or LDAP ACLs V2 datasource.
3. Under Security, update the configuration to use contentCollection as the ACL Collection ID.
   The Security checkbox must be checked for this field to appear.
4. Save the configuration.

​

If using SharePoint-Optimized and LDAP-ACLs >= v2.0.0

1. Navigate to Indexing > Datasources.
2. Open your SharePoint Optimized V2 or LDAP ACLs V2 datasource.
3. Under Graph Security Filtering Configuration, select Enable security trimming.

​

Set up Graph Security Trimming

1. Navigate to Querying > Query Pipelines.
2. Open the query pipeline associated with your SharePoint Optimized V2 or LDAP ACLs V2 data.
3. Click Add a new pipeline stage and select Graph Security Trimming.
4. Configure the stage with the following settings:

   Field	Value
   User ID source	query_param or header
   User ID key	The key that contains the User ID

​

Test the configuration

1. First, run the SharePoint Optimized V2 and LDAP ACLs V2 datasources.
2. Run a series of queries to test user permissions are working as intended:
   1. Run a query using a User ID key with no permissions. You should see no search results.
   2. Run a query using a User ID key that has access to some documents. You should see some search results.
   3. Run a query using a User ID key that has access to all documents. You should see all documents.
      Facet by _lw_document_type_s: contentDocument to see only the SharePoint docs, otherwise aclDocuments will be also shown.

​

Configuration parameters

• Azure AD Tenant ID
• Azure AD Client ID
• Azure AD Client Secret

​

Find your Tenant ID and Client ID

1. Visit the Azure portal.
2. Click App registrations.
3. Click New registration. The new application registration screen will appear:
4. Enter a name for the application.
5. Choose the Single Tenant supported account type.
6. Leave the Redirect URI value blank.
7. Click Register.

• Azure AD Tentant ID. Listed as “Directory (tenant) ID”
• Azure AD Client ID. Listed as “Application (client) ID”

​

Configure your application permissions

1. Click View API permissions.
2. Add the following as Application permissions under Microsoft Graph.
   You must use _Application permissions_. Failure to use Application permissions will result in 403 errors from the Graph API when attempting to crawl the Azure groups. Do not use the _Delegated permissions_ option.
   1. GroupMember.Read.All Allows the application to read general information about associated groups, such as the list of members and basic group properties. See Microsoft Graph Group Application permissions for more information.
   2. User.Read.All Allows the application to read all user profile information, such as properties and group membership. See Microsoft Graph User Application permissions for more information.
3. Select Grant admin consent.

​

Find your Client Secret

1. Click Clients & Secrets.
2. Create a New client secret.

​

Troubleshooting

param (
    [Parameter(Mandatory)]$AzureTenantId,
    [Parameter(Mandatory)]$AzureClientId,
    [Parameter(Mandatory)]$AzureClientSecret
)

# first we get the bearer token

$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
$headers.Add("Content-Type", "application/x-www-form-urlencoded")

$body = "client_id=${AzureClientId}&client_secret=${AzureClientSecret}&scope=https%3A%2F%2Fgraph.microsoft.com%2F.default&grant_type=client_credentials"

$response = Invoke-RestMethod "https://login.microsoftonline.com/${AzureTenantId}/oauth2/v2.0/token" -Method 'POST' -Headers $headers -Body $body
$access_token = $response.access_token

Write-Host "Successfully got access token ${access_token}"

# now that we got the token, use it to get the groups

$headers2 = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
$headers2.Add("Authorization", "Bearer ${access_token}")

$response2 = Invoke-RestMethod 'https://graph.microsoft.com/v1.0/groups' -Method 'GET' -Headers $headers2
$response2 | ConvertTo-Json