Sharepoint security trimming info

sharepoint-security-trimming.md

Here is a picture of sharepoint web architecture: https://pasteboard.co/HkyuMhZ.png

We need to crawl groups at each of the site collections. Each can have unique sharepoint groups.

Example of site collections in a web application

http://example.sharepoint.com/

	Users and Groups:
	
	SpGroup1
		User: Nick
	SpGroup2
		User: Cesar
	...

	Top level site collection
	
		Subsites:
			http://example.sharepoint.com/subsite1
			http://example.sharepoint.com/subsite2

http://example.sharepoint.com/sites/sitecollection1

• NOTE: This site collection has NOTHING TO DO WITH http://example.sharepoint.com/. It is NOT a child of http://example.sharepoint.com/.

	Users and Groups:
	
	SpGroup1
		User: Rdamir
	SpGroup2
		User: Matt
	...

	Top level site collection also

		Subsites:
			http://example.sharepoint.com/sites/sitecollection1/subsite1
			http://example.sharepoint.com/sites/sitecollection1/subsite2

When security trimming we need to:

1) Get a user's ldap groups
2) Get a user's sharepoint groups

Getting sharepoint groups for a user from the API is SLOW! Not horribly slow, but too slow for query time. Getting a user's ldap groups isn't too bad, but some company's even find that is too slow.

The goal

Get this all to be just a query to solr, which is very fast. No third party services used during trimming.

The solution

During the crawl:

1) get a list of all users in the any sharepoint site collections based on the start links you provide.

(we were previously doing this already)

2) for each user:
	for each site collection:
		get all sharepoint groups for this user.
	get all ldap for the user
	
	cache all the user's ldap groups and sharepoint groups to a solr sidecar collection.

During the query:

instead of querying sharepoint and ldap for groups that a user is a part of (very slow), 
we simply query our solr sidecar collection (very fast).

FAQ

How does sharepoint know what site collections are involved in a crawl

Example: We gave it "http://example.sharepoint.com/sites/sitecollection1/subsite2"

It will call SiteData.asmx and say get me all site collections for web application "http://example.sharepoint.com"

http://example.sharepoint.com
http://example.sharepoint.com/sites/sitecollection1

Find what site collection i am part of: 

	http://example.sharepoint.com/sites/sitecollection1/subsite2 = http://example.sharepoint.com/sites/sitecollection1

The site collections users to fetch are http://example.sharepoint.com/sites/sitecollection1

Example: We gave it "http://example.sharepoint.com"

It will call SiteData.asmx and say get me all site collections for web application "http://example.sharepoint.com"

http://example.sharepoint.com
http://example.sharepoint.com/sites/sitecollection1

Find what site collection i am part of: 

	http://example.sharepoint.com = http://example.sharepoint.com

The site collections users to fetch are http://example.sharepoint.com

Are users unique between SharePoint site collections?

Yes. A user is represented by: netbiosdomain\samAccountName

Example: AMR\nick

If AMR\nick is in site collection 1 and site collection 2, they are the same person.

Do we to fetch all users in the entire ldap tree when making the cache?

No. A user will only be in the solr usergroup cache sidecar when they are a member of one or more site collections that we are crawling.