Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am crawling a local file share that has read permissions for NT AUTHORITY\NETWORK SERVICE account.

I have enabled anonymous access and now I am able to get to my search box without authentication. But when I actually search for something I get no results back. I am able to get results when using the administrator account.

Changing ACL permissions and reindexing now give my local user access to the search results but my ultimate goal is to have the results viewable by an anonymous user.

admin view

anonymous view

share|improve this question

1 Answer 1

up vote 3 down vote accepted
+25

What you are seeing is actually what I would expect, that is, Search Server challenges the credentials of the user performing the search regarding the ACL of the indexed files and only grant access if the user has proper read permissions regarding the files themselves (i.e. not just the search interface), see e.g. Security considerations for indexing, section About item level security:

When source content is crawled and indexed, authorization information is added to each item’s managed properties (the item’s ACL, or access control list), identifying users and groups that are granted or denied access to the item. Item ACLs help set up item level security by tagging each item with access permissions.

When a user submits a query and the indexes find search results, the query processing service rewrites the user’s query so that the user only sees items that he is authorized to see. This security trimming [...]

Your example seems to imply that the files in question can only be read by NT AUTHORITY\NETWORK SERVICE, hence surfacing those files content via a search index would circumvent the access restrictions consciously applied to them in the first place, and not doing so seems like a sensible default at least (if not the only option in fact).

Consequently you should be able to achieve the desired result by one or (maybe) two means:

  1. Grant anonymous users (or your local test account for an easier/safer start) access to the files themselves via standard Windows ACL management. Please note that you'll likely need to reindex the content to surface the ACL changes in the query result, see quote above.

  2. Eventually Search Server allows to override or ignore the ACL of an indexed fileset explicitly - I'm not aware of this option however (but ain't too familiar with Search Server either).

Good luck!

share|improve this answer
    
I gave my local user read permissions to the share - in both sharing and security. The local user also has full control via site-actions -> site permissions, but searches still come back with no results –  Bernie Sep 27 '10 at 23:08
    
@Bernie - Have you reindexed the content after the permission change? The ACL seems to be indexed as well, see the quote within my updated answer (the referenced documentation applies to FAST Search Server 2010, but the technical foundation should be pretty similar, if not identical - couldn't find an exact match right now). –  Steffen Opel Sep 28 '10 at 1:06
    
reindexing the content after the ACL change now allows my local user access to the search results. thank you! –  Bernie Sep 28 '10 at 17:36
    
@Bernie - thanks for accepting; may I kindly ask you to explicitly reward the bounty as well? While the system handles part of this automatically (if at least 2 upvotes are registered), I'm going to receive half of the bounty amount only like so (see section What if I don't get a good answer? in the FAQ for details) - thanks much! –  Steffen Opel Oct 4 '10 at 7:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.