Documentation

Security Transformation

Before user-group relationships become indexed, you can alter principals in our principal transformation pipeline. This allows in particular to change user ids to so-called aliases.

Adding an alias to a user is necessary, if the user principal name does not map user ids in the content source.

This means that e-mail addresses are the leading id for the RheinInsights Retrieval Suite but also for some search engines, such as Microsoft Search. On the other hand, many on-premises systems, such as Confluence Data Center, Jira Server or file shares use uids or sAMAccountNames as the leading ids.

Thus these need to be transformed so that the search engine can resolve groups for the user who searches.

The Suite offers the following principal transformation stages:

  1. Regex Security Transformer

  2. Ldap/Active Directory Security Transformer

Please note that the transformation pipeline is only executed once per user principal per security crawl. If you like to reindex user principals after changing the security transformation pipeline, please run a Principal Recrawl, cf. Crawl Modes .

Matcher

You can decide if a security transformation stage should be executed.

The conditions below apply to the user alias or if it is empty on the user id. If no matcher is configured the stage is executed for every indexed security principal.

Configuration Parameters:

  1. Condition Type:

    1. Match regex. Here you can add a regular expression in the next field. If this regular expression matches the user id, then the stage is executed.
      The regular expression must be a valid Java regex format.

    2. Match empty value. This means if the user id is empty.

    3. Match regex does not match. Here you can provide a Java regex and if it does NOT apply to the user alias or user id, if the alias is empty, the transformation above will not be applied. This is useful if you have for instance user ids which are partly mail addresses and partly not:

You can add multiple matchers per stage. This means that all matchers must match the given input principal. Otherwise the stage is not executed for this principal.