SharePoint's search engine can remove particular search results from view by using what Microsoft call a "security trimmer".

A custom security trimmer is implemented as a .NET class that implements the ISecurityTrimmer interface, which provides for two methods:

BitArray CheckAccess(IList<string> crawlUrls, IDictionary<string, Object> sessionProperties)
void Initialise(NameValueCollection staticProperties, SearchContext searchContext)

The CheckAccess method typically iterates through each 'documentCrawlUrl', and sets a flag within a bit array that says whether the result should or should not be displayed to the user.

Microsoft's example is adapted below to perform this. In our example, we trim out search results that contain the word "internal" in the Url.

public BitArray CheckAccess(IList crawlURLs, IDictionary sessionProperties)
{
    BitArray retArray = new BitArray(crawlURLs.Count);
 
    // Windows authentication
    string strUser = WindowsIdentity.GetCurrent().Name;
 
    //For Forms authentication, uncomment the next line:
    //string strUser = HttpContext.Current.User.Identity.Name;
 
    for (int x = 0; x < crawlURLs.Count; x++)
    {
        // Determine whether user is allowed to see this Url
        retArray[x] = IsUserAllowed(strUser, crawlUrls[x]);
    }
 
    return retArray;
}
 
private bool IsUserAllowed(string username, string url) 
{
    // perform authorization logic here based on the user's identity 
    // and the resource being requested.
 
    // for this example, we check if the Url contains the word "internal",
    // and if so, block it out
    if ( url.Contains("internal") 
    {
       return false;
    }
 
    return true;
}

Deployment

The class is compiled into a .NET .dll and deployed into the GAC, and then associated to a particular search crawl rule by using the stsadm.exe command line tool.

Authorization Policies

Organisations define security policies.

Some example business rules derived from policy are:

• "Contractors cannot access information marked commercial-in-confidence"
• "Only board members can know the existence of merger-related documentation"
• "Non-US citizens cannot read documents labelled NOFORN"
• "Personnel accessing information classified SECRET must have a SECRET or higher clearance"

These policies are typically defined in an IT-agnostic manner: the challenge for Architects is in architecting a system that provides sufficient compliance with these policies.

SharePoint in particular is a challenge, as it lacks any real Policy-based Authorization policy enforcement.

Models

SharePoint is often described as providing Role-based Access Controls. However, this is only partly true, as SharePoint lacks granular DENY rules. So in practice, more advanced RBAC-based policy modelling is simply not possible with SharePoint without substantial bespoke development or third party tools.

Role-based access controls - See NIST's RBAC community
Mandatory access controls -
Discretionary access controls -

Standards

XACML

The Extensible Access Control Markup Language (XACML) is intended to be a core XML schema for representing authorization and entitlement policies. It allows for an organisation to define its policies in a declarative manner.

XACML not supported by SharePoint.