1

We have a custom Solr index which includes read and deny roles. Both are added as predicates using the following code:

protected virtual IQueryable<TIndexable> ApplyDenyUserRules<TIndexable>
(IQueryable<TIndexable> queryable) where TIndexable : IEntity
{
  if (Context.User == null || Context.User.IsAdministrator || 
      string.IsNullOrEmpty(Context.User.Name))
  {
      return queryable;
  }

  bool includeIndirectRoles;

  if       
  (!bool.TryParse(
   Settings.GetSetting("DFS.Membership.IncludeIndirectRoles"), out 
   includeIndirectRoles))
  {
    includeIndirectRoles = false;
  }

  var roles = RolesInRolesManager.GetRolesForUser(Context.User, 
              includeIndirectRoles);
  var userRoles = roles.Select(r => r.Name.
                  Replace("\\", string.Empty).Replace("™", string.Empty).
                  Replace(" ",string.Empty));

  var predicate = PredicateBuilder.True<TIndexable>();
  var subPredicate = PredicateBuilder.True<TIndexable>();

  subPredicate = userRoles.Aggregate(subPredicate, (current, role) => 
                 current.And(i => !i.DenyRules.Contains(role)));

  predicate = predicate.And(subPredicate);

  if (predicate.Body.NodeType != ExpressionType.Constant)
  {
    queryable = queryable.Filter(predicate);
  }

  return queryable;
}

protected virtual IQueryable<TIndexable> ApplyReadRoles<TIndexable>
(IQueryable<TIndexable> queryable) where TIndexable : IEntity
{
  if (Context.User == null || Context.User.IsAdministrator || 
     Context.User.Roles == null || !Context.User.Roles.Any())
     {          
       return queryable;
     }

     bool includeIndirectRoles;

     if (!bool.TryParse(
         Settings.GetSetting("DFS.Membership.IncludeIndirectRoles"), out 
         includeIndirectRoles))
     {
       includeIndirectRoles = false;
     }

     var roles = RolesInRolesManager.GetRolesForUser(Context.User, 
                 includeIndirectRoles);

     var userRoles = roles.Select(r => r.Name.Replace("\\", 
                     string.Empty).Replace("™", string.Empty).Replace(" ", 
                     string.Empty));
     var predicate = PredicateBuilder.True<TIndexable>();
     var subPredicate = userRoles.Aggregate(predicate, (current, role) => 
                        current.Or(i => i.ReadRoles.Contains(role)));
     predicate = predicate.And(subPredicate);
     if (predicate.Body.NodeType != ExpressionType.Constant)
     {
       queryable = queryable.Filter(predicate);
     }

     return queryable;
}

This returns the following Solr query:

fq=((-denyrules_sm:(sitecoregruppe) AND -denyrules_sm:
   (sitecoreDigizuiteDAMforSitecoreAdministrators)) AND (readroles_sm:
   (sitecoregruppe) OR readroles_sm:
   (sitecoreDigizuiteDAMforSitecoreAdministrators)))

which to me looks valid, but for some reason does not work. If I use the exact same code with lucene indexing then it works just fine. One thing I have noticed is that my field is in the Solr index, but as I am actually not using deny roles in my installation, then it is always empty.

Any help would be appreciated.

Thanks in advance

Magnus

  • Are you getting any error message why the query is rejected? You could try running the same query from Solr UI. – grg Nov 20 '17 at 12:10
  • Could show us what values are stored in readroles_sm and denyrules_sm fields in the Solr? – Artsem Prashkovich Nov 20 '17 at 20:29
  • @grg, no error message at all and running it from solr ui yield no results, however if i remove the denyrules part, then I get results – M.frank Nov 21 '17 at 9:18
  • @ArtsemPrashkovich, the readroles looks like this: "readroles_sm": [ "sitecoreDigizuiteDAMforSitecoreContributors", "extranetanonymous", "sitecoreDigizuiteDAMforSitecoreEditors", "sitecoreDigizuiteDAMforSitecoreAdministrators" ], the denyrules are not set in sitecore and hence are not even there. Perhaps this is the problem? – M.frank Nov 21 '17 at 9:19
  • Yes, I think so. Try to remove the condition which related with denyrules_sm and see if you get any results. – Artsem Prashkovich Nov 21 '17 at 9:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.