Secure search of Exchange Server content

If security is enabled for a collection, the Exchange Server crawler can obtain the access control lists (ACLs) for items that it crawls and associate security data with documents in the index. This data enables applications to enforce access controls based on the stored ACLs or security tokens.

You can also configure the crawler to validate user credentials when a user submits a query. In this case, instead of comparing user credentials to indexed security data (pre-filtering), the system compares the credentials to current access control lists that are maintained by the original data source (post-filtering).

The Exchange Server crawler supports BASIC authentication, Digest authentication, and NT LAN Manager (NTLM) authentication through Internet Information Services (IIS) version 6.x and version 7.x.

Supported permissions

To obtain security data for searching user mailboxes, you must deploy a provided web service, ESCommonServices, on the Exchange Server Mailbox server. This service enables Watson Explorer Content Analytics to obtain group lists and permissions necessary for pre-filtering access controls. The supported permission types are:
  • MailboxPermission
  • MailboxFolderPermission
  • Delegation
Users who have permission to access mailboxes and folders that belong to other users (FullAccess authority as a MailboxPermission or ReadItem=FullDetails authority as a MailboxFolderPermission), can search items under those mailboxes and folders. When the permissions are assigned to a security group, users who belong to those groups also can search items under those mailboxes and folders.

Deny ACL

Exchange Server users can set the ACL for each folder as MailboxFolderPermission. When a user assigns MailboxFolderPermission to folders that match either of the following conditions, the user cannot see items under those folders through Outlook:
  • The read access permission for Default and groups that the user belongs to is set to FullDetails.
  • The read access permission of the user is set to None.

However, Watson Explorer Content Analytics cannot deny users who search those items as part of the pre-filtering process. To ensure that users see only the items that they can view through Outlook, configure post-filtering security options when you configure the crawler to ensure that the user's current access controls are validated.

This issue does not affect ACLs where the permission is set to MailboxPermission.

Private items

Exchange Server users can set a private flag for items to prevent other users from seeing the item. When a user has access to another user's mailboxes or folders, through MailboxPermission or Delegation with private access rights, the user can see private items in those mailboxes and folders through Outlook. When a user has MailboxFolderPermission or Delegation with no private access rights, the user cannot see private items under another user's mailboxes and folders.

Watson Explorer Content Analytics can behave the same way as Outlook, and allow users who have access to another user's mailboxes or folders, through MailboxPermission or Delegation with private access rights, to search private items in those mailboxes and folders. However, when Delegation with private access rights is assigned to a group, the users who belong to the group cannot search private items because the crawler cannot obtain the name of a group that has Delegation settings. To obtain the list of users who belong to a group, the crawler must know the group name.

Through Exchange Web Services (EWS) 2010, users who have any permission to search content can see private items. When the Exchange Server crawler uses EWS as a post-filtering process, post-filtering does not work the same way that it does in Outlook. For secure search, you must enable pre-filtering security options when you configure the crawler.

The following table summarizes the differences between Exchange Server permissions to access private items and Watson Explorer Content Analytics secure search.

Table 1. Permissions to access private items
  Exchange Server: Outlook Exchange Server: EWS Secure search: permission assigned to a user Secure search: permission assigned to a group
MailboxPermission Yes Yes Yes Yes
MailboxFolderPermission No Yes No No
Delegation with private access rights Yes Yes Yes No
Delegation without private access rights No Yes No No