Document Outline

• Managing Search for Controlled-Access Content
  • Contents
  • Overview
    • About this Guide
    • Which Sections of this Guide Should I Read?
  • Crawl, Index, and Serve
    • Authentication, Authorization, and Controlled- Access Content
    • Crawl and Index for Controlled-Access Content
      • How a Search Appliance Indexes Controlled-Access Content
      • Configuring Crawl for Cookie-Based Access
      • Configuring Crawl for HTTP Basic or NTLM HTTP
      • Configuring Crawl for the SAML Authentication and Authorization Service Provider Interface
      • Configuring Crawl and Serve for Kerberos
      • Configuring Crawl and Serve Over HTTPS
    • Secure Content and Public Content
      • How a Search Appliance Labels Controlled-Access Content Sources as Public or Secure
      • How a Search Appliance Determines What to Display in Public Search Results
    • Authentication
      • Universal Login
        • Credential Groups
        • Primary Verified Identity
        • Universal Login Form
        • Credential Group Satisfaction
        • Working with Credential Groups
        • Configuring Credential Groups
      • Cookie-Based Authentication
        • Configuring a Credential Group for Cookie-Based Authentication
        • Multiple Cookie Domains
        • Cookie-Based Authentication Scenarios
      • HTTP-Based Authentication
        • Configuring a Credential Group for HTTP Basic or NTLM
      • Client Certificate-Based Authentication
        • Enabling User Authentication by X.509 Certificate
        • Configuring a Credential Group for Client Certificate-Based Authentication
      • Kerberos-Based Authentication
        • Enrolling the Search Appliance in the KDC Domain and Creating a Keytab File
        • Configuring a Credential Group for Kerberos-Based Authentication
        • Configuring Web Browsers for Kerberos Authentication
        • More Kerberos Information
      • The SAML Authentication Service Provider Interface (SPI)
        • Configuring a Credential Group for SAML Authentication
      • Connectors
        • Configuring a Credential Group for a Connector Manager
      • LDAP
        • Integrating the Search Appliance with an LDAP Server
        • Enabling LDAP Authentication for a Search Appliance
        • Enabling Group Lookup
        • Configuring a Credential Group for LDAP
        • Protecting the User’s Credentials for Serve with HTTP Basic and NTLM HTTP
      • Using Silent Authentication
        • Using Cookie Cracking
      • Using Perimeter Security
    • Authorization
      • Flexible Authorization
      • Legacy Authorization
      • Policy Access Control Lists
        • Per-URL ACLs and Policy ACLs
        • Methods for Adding ACLs to the Index
        • Crawling Per-URL ACLs
        • Policy ACLs
        • Enabling Late Binding for Policy ACLs and Per-URL ACLs
        • Setting ACL Precedence in Legacy Authorization
      • The SAML Authorization Service Provider Interface
        • Enabling the Authorization SPI on the Google Search Appliance
    • How to Exclude Controlled-Access Content Sources from Search
      • Excluding Controlled-Access Content from the Index
      • Removing Controlled-Access Content from Search Results
    • Customizing the Universal Login Form
      • Using the Page Layout Helper
      • Creating a Fully Customized Universal Login Form
  • Use Cases with Public and Secure Serve for Multiple Authentication Mechanisms
    • Use Case 1: HTTP Basic or NTLM HTTP Controlled- Access Content with Public Serve
      • Setting up Crawl and Index
      • Populating the Index for Controlled-Access Content
      • Serving Controlled-Access Content to the User as Public Content
    • Use Case 2: One Set of Credentials for Multiple Authentication Mechanisms
      • Setting Up Crawl and Index
      • Populating the Index with Controlled-Access Content
      • Setting Up Serve
      • Serving Controlled-Access Content to a User with One Set of Credentials
    • Use Case 3: Two Sets of Credentials for Two Connectors
      • Creating a Credential Group
      • Adding Connectors to the Credential Groups
      • Serving Controlled-Access Content to a User with Two Sets of Credentials
    • Use Case 4: Windows Authentication with Kerberos Tickets for Secure Serve
      • Obtaining a keytab File
      • Configuring and Activating Kerberos Support
      • Serving Controlled-Access Content to the User as Secure Content with Kerberos Authentication
        • Search by an Authorized User
        • Search by an Unauthorized User
  • Cookie-Based Authentication Scenarios
    • Overview of Scenarios
    • Cookie-Based Authentication Options
      • Sample URL
      • Sample URL Redirect to Login Form
      • Redirect URL
        • Return URL Parameter
      • Silent Authentication
      • Cookie Cracking
        • Using Quoted-Printable Encoding in Response Headers
    • Scenario 1: Normal Forms Authentication
      • Set Up for Scenario 1
      • Process Overview of Scenario 1
    • Scenario 2: Cannot Use Universal Login Form
      • Set Up for Scenario 2
      • Process Overview of Scenario 2
    • Scenario 3: Cannot Use Universal Login Form and Need Identity Verified Silently
      • Set Up for Scenario 3
      • Process Overview of Scenario 3
    • Scenario 4: Cannot Provide a Sample URL
      • Set Up for Scenario 4
      • Process Overview of Scenario 4
    • Scenario 5: Necessary Cookie is Available for Getting a Verified Identity
      • Set Up for Scenario 5
      • Process Overview of Scenario 5
    • Scenario 6: Use an HTTP Basic Challenge to Get Cookies
      • Set Up for Scenario 6
      • Process Overview of Scenario 6
    • Scenario 7: Use an NTLM HTTP Login Page to Get Cookies
      • Set Up for Scenario 7
      • Process Overview of Scenario 7
  • Index