Remote HTTP Security Source

This section explains how remote HTTP security works, as well as how to configure both the security on the source and on Exalead CloudView.

Exalead CloudView provides a remote security API based on a simple HTTP GET or POST / XML protocol. Remote security providers can therefore supply a way for Exalead CloudView to authenticate a user and to retrieve its security tokens. These security tokens are then used by Exalead CloudView to secure document access: the user can only see the documents that match user security tokens of this given user.

This page discusses:

See Also
Local UNIX Security Source
Local Windows Security Source
LDAP Security Source
Federate Several Security Sources

Mandatory Services

  • Authenticate (GET or POST): authenticates a user

    Must be available on <URL>/authenticate and on <URL>/.

  • Reset (GET): restores the security source to its initial state

    Must be available on <URL>/reset.

Authentication Request

Exalead CloudView Search triggers a remote security query to the remote security connector using a simple HTTP GET or POST. Authentication parameters, login and password, pass through the url. If there is no need for authentication, the url parameter checkPassword with the value false can be passed and the password parameter is optional.

Authentication Response

Whether the remote security source succeeded to authenticate the user, it sends back a 200 OK and embeds in the http body the authentication result (XML representation) with it is state.

If the authentication succeeded, it contains the list of security tokens of the user; otherwise it contains the cause of failure.

Required Response Format

The AuthenticationResult must be in XML, with the following attributes:

  • xmlns (required): internally used by Exalead CloudView. The value is always exa:com.exalead.security.sources.common.

  • success (required): it defines if the authentication succeeded. Possible values: true or false.

  • userId (required): the login used to authenticate the user.

  • userDisplayName: The real name of the authenticated user. Used only when authentication is successful.

  • cause: the reason of failure. Used only when authentication fails.

Here is an example of the result format in XML. 

<AuthenticationResult xmlns="exa:com.exalead.security.sources.common"
 userDisplayName="Anonymous user" userId="guest" success="true">
  <SecurityToken xmlns="exa:com.exalead.security.sources.common"
 token="remote:first_token" />
  <SecurityToken xmlns="exa:com.exalead.security.sources.common"
 token="remote:second_token" />
</AuthenticationResult>

Security Tokens

If authentication is successful, the node also contains a list of security tokens.

A SecurityToken has one attribute.

  • token: the value of the security token, which must be the same value than the one used during indexing.

Configuring a Remote HTTP Security Source

In the Administration Console, go to Search > Security Sources and click Add security source.

  • For Type, select Remote Http.

  • The isAlive path parameter defines the path to a service that must reply with an http code below 400. When using multiple hosts, it helps Exalead CloudView to detect available hosts. Leave this field empty to disable this option.

  • The service path parameter defines the path to access the security service.

  • The maxRetries parameter defines the number of trials before giving up on a host connection.

To provide high availability, you can declare multiple hosts with the following parameters:

  • The Host parameter defines the host name of the remote security provider.

  • The Port parameter defines the port of the remote security provider.

  • The Priority parameter is only used if you specify multiple hosts. Connections are made first on a host with higher priority. In case of equality, it is randomly selected.