How to query Solr and only return content items that the current user has permissions to view?

Question

I am building a Sitecore 8.1 / Solr 4.10 site. I want to be able to do a general site content query through the web database and only return content items that the current user has permissions to view. To me this seems like a simple request and should be a no-brainer. However we never figured this out properly. So we built what seems like a convoluted solution where we have 2 different custom fields in our Solr index - one called read_roles that is a list of all of the roles that have read access to the indexed item. And another called denied_roles that is a list of all of the roles that do not have read access to the indexed item. Then in our search method we apply a security filter using the following code:

public static IQueryable<T> ApplySecurityFilter<T>(this IQueryable<T> query) where T : SearchResultItem {

    var userRoles = Sitecore.Context.User.Roles.Select(r => r.Name);

    var readPredicate = PredicateBuilder.False<T>();
    readPredicate = userRoles.Aggregate(readPredicate, (current, role) => current.Or(i => i["read_roles"].Equals(role)));

    var denyPredicate = PredicateBuilder.True<T>();
    denyPredicate = userRoles.Aggregate(denyPredicate, (current, role) => current.And(i => !i["denied_roles"].Equals(role)));

    if (readPredicate.Body.NodeType != System.Linq.Expressions.ExpressionType.Constant) {
        query = query.Filter(readPredicate);
    }
    if (readPredicate.Body.NodeType != System.Linq.Expressions.ExpressionType.Constant) {
        query = query.Filter(denyPredicate);
    }
    return query;
}

This seemed to work in Sitecore v7.5 but now I am having trouble in Sitecore 8.1. Is there some simpler way of restricting the results in a Solr query to only be items that the current user has read access to?

Corey

Answer 1

If you enable security via the SearchSecurityOptions in the CreateSearchContext checking the access rights should be done for you. Although I have heard that the TotalResults property is not ok when doing is and items are filtered out - also heard that paging might not be accurate. But the result set should be ok.

More info also here.

Adding security information inside the index is tempting but very tricky. Security on an item can be changed in so many ways (user changes role, inheritance is broken on a parent, language security changes...) that it is very difficult to keep all the information up to date (without rebuilding the index each time).