First some background to my question.

  • Individual entities can have read Permissions.
  • If a user fails a read permission check they cant see that instance.

The probelm relates to introducing Lucene and performing a search which simply returns a list of matching entity instances. My code would then need to filter entities one by one. This approach is extremely inefficient as the situation exists that a user may only be able to see a small minority and checking many to return a few is less than ideal.

What approaches or how would developers solve this problem - keeping in mind that indexing and searches are performed using Lucene ?

EDIT

Definitions

  • A User may belong to many Groups.
  • A Role may have many Groups - these can change.
  • A Permission has a Role - (indirection).
  • X can have a read Permission.
  • It is possible for the definition of a Role to change at any time.

Indexing

  • Adding the set of Groups (expanding a Permmission) at index time may result in the definition becoming out of sync when the list of member groups for a Role change.
  • I am hoping to avoid having to reindex X whenever the definition of a Permission/Role changes.

Security Check

  • To pass a Permission check a User must belong to a group that is within the set of groups belong to the Role for a given Permission.
security lucene
Edit
Report