The following tutorial demonstrates mapped security and shows how to check whether documents are returned successfully when a user submits a query with a valid security token.
Before starting ensure that you have completed the following steps:
The following steps include example action commands. These use the standard ports for the relevant IDOL components. If you have configured the components to use different ports, change the following examples accordingly. Some action commands are split over several lines for readability.
To confirm that Mapped Security is configured successfully
Instruct the connector to start retrieving documents by running the fetch
action:
http://connector:7130/action=fetch&fetchaction=synchronize&tasksections=MyTask
where MyTask
is the name of the fetch task that you configured in the connector's configuration file.
To check that the documents were indexed successfully, run the following actions:
Check the status of the fetch
action by sending the QueueInfo
action to the connector:
http://connector:7130/action=queueinfo&queueaction=getstatus &queuename=fetch &token=token
where token
is the token returned by the fetch
action you sent in the previous step.
The connector returns a response that shows new documents were ingested:
<action> <status>Finished</status> <queued_time>2017-Apr-06 05:52:31</queued_time> <time_in_queue>0</time_in_queue> <process_start_time>2017-Apr-06 05:52:31</process_start_time> <time_processing>3</time_processing> <process_end_time>2017-Apr-06 05:52:34</process_end_time> <documentcounts> <documentcount task="MYTASK" errors="0" ingestadded="15" added="15"/> </documentcounts> <fetchaction>SYNCHRONIZE</fetchaction> <tasks> <success>MYTASK</success> </tasks> <tasksection>MyTask</tasksection> <token>...</token> </action>
Check whether the documents were indexed into the IDOL index:
http://content:9100/action=list
The IDOL Content component returns a list of documents. Notice the AUTONOMYMETADATA
and SECURITYTYPE
fields that were added by the connector.
<autn:hit> <autn:content> <DOCUMENT> <DREREFERENCE>http://10.11.12.13/DynamicsCRM/api/...</DREREFERENCE> <UUID>d49a97506694b06fa712fb4f00a448ef</UUID> <ACCOUNTNUMBER>AFFSE9IK</ACCOUNTNUMBER> <AUTN_GROUP>Connector</AUTN_GROUP> <AUTN_IDENTIFIER>...</AUTN_IDENTIFIER> <AUTN_TASK_BATCH_ID>MYTASK_bcf2c173384f881006b0ed...</AUTN_TASK_BATCH_ID> <AUTONOMYMETADATA>U:9u7i4+Po7vni...</AUTONOMYMETADATA> <DESCRIPTION>NULL</DESCRIPTION> <DOCUMENT_METADATA_STANDARDIZED>1</DOCUMENT_METADATA_STANDARDIZED> <DREDBNAME>Dynamics</DREDBNAME> <IMPORTVERSION>1287656</IMPORTVERSION> <NAME>Fabrikam, Inc. (sample)</NAME> <SECURITYTYPE>DYNAMICS</SECURITYTYPE> <WEBSITEURL>http://www.fabrikam.com/</WEBSITEURL> </DOCUMENT> </autn:content> </autn:hit>
If the IDOL Content component does not return any documents, check that the documents reached CFS and then Content. If you run action=grl
to see the CFS request log you should see an ingest
action from the connector. You can check that CFS issued a DREADD
index command to the IDOL Content component by looking for the DREADD
command in the Content component index log.
Instruct OmniGroupServer to retrieve user and group information for the Dynamics repository:
http://ogs:3057/a=StartJob&Repository=Dynamics
where Dynamics
is the name of the job (repository) that you configured in the OmniGroupServer configuration file.
Check that OmniGroupServer has successfully retrieved the user information by running the GetAllUsers
action:
http://ogs:3057/a=GetAllUsers&Repository=Dynamics
OmniGroupServer returns the users:
<action>GETALLUSERS</action> <response>SUCCESS</response> <responsedata> <Users>CONNECTOR\ADMINISTRATOR</Users> <Users>CONNECTOR\DYNAMICSCRMUSER</Users> <UserCount>2</UserCount> </responsedata>
Check that OmniGroupServer has successfully retrieved the group information. Run the GetGroups
action with a user name that was returned by the GetAllUsers
action in the previous step.
http://ogs:3057/a=GetGroups&Username=CONNECTOR%5CDYNAMICSCRMUSER
OmniGroupServer returns a response similar to:
<action>GETGROUPS</action> <response>SUCCESS</response> <responsedata> <Groups>ENT>ACCOUNT>GLOBAL>61620DEE-BF64-4F06-A5E1-A3D5C1DF09DE</Groups> <Groups>ENT>ACTIVITY>GLOBAL>61620DEE-BF64-4F06-A5E1-A3D5C1DF09DE</Groups> ... ... <Groups>T>56190777-3B32-E611-80C4-0050569248A7</Groups> <GroupCount>164</GroupCount> <UserName>CONNECTOR\DYNAMICSCRMUSER</UserName> </responsedata>
Groups that begin with "ENT>" are used to determine access to entities, and groups that begin with "T>" correspond to teams in your Dynamics instance. In "ENT>" groups, "Global", "Deep" and "Local" correspond to the privilege depth in the Dynamics CRM system and the trailing GUID corresponds to the business unit to which the group access applies.
Add your users (as returned by OmniGroupServer in step 4) to the IDOL Community component by using the UserAdd
action, for example:
http://community:9030/a=UserAdd &Username=CONNECTOR%5CDYNAMICSCRMUSER &Password=password &SecurityDynamicsUsername=CONNECTOR%5CDYNAMICSCRMUSER
Obtain a SecurityInfo
string for a user, by sending the UserRead
action to the IDOL Community component. The SecurityInfo
string contains security information for a user, for example a list of group memberships.
http://community:9030/a=UserRead&SecurityInfo=true &Username=CONNECTOR%5CDYNAMICSCRMUSER
Run the Query
action to obtain documents from the IDOL Content component. Your request must include the SecurityInfo
string that you obtained in the previous step.
http://content:9100/a=query&text=* &maxresults=100 &PrintFields=WEBSITEURL,Name &securityinfo=securityinfo
where securityinfo
is the SecurityInfo
string that you obtained from the IDOL Community component.
The SecurityInfo string can contain a significant amount of information, especially when a user is a member of a large number of groups. If you try to send this request from a web browser the request might be truncated. You must also URL-encode the SecurityInfo string. For this reason you might find it easier to send this request as an HTTP POST request using a tool such as cURL.
Using cURL the same request looks like this:
curl --data "text=*&maxresults=100&PrintFields=WEBSITEURL,Name"
--data-urlencode "securityinfo=securityinfo"
http://content:9100/a=query
The IDOL Content component returns documents that the user is permitted to view:
<action>QUERY</action> <response>SUCCESS</response> <responsedata> <autn:numhits>15</autn:numhits> <autn:hit> <autn:reference>http://10.11.12.13/DynamicsCRM/api/...</autn:reference> <autn:id>9</autn:id> <autn:section>0</autn:section> <autn:weight>85.35</autn:weight> <autn:database>Dynamics</autn:database> <autn:content> <DOCUMENT> <NAME>A. Datum Corporation (sample)</NAME> <WEBSITEURL>http://www.adatum.com/</WEBSITEURL> </DOCUMENT> </autn:content> </autn:hit> ... </responsedata>
|