Granular user-document level permissions

Elastic Stack Elasticsearch
1

Hi,

In our search index we want to specify access at very granular level. For eg. Say we have doc1, doc2, doc3 in index and user1 has access to doc1 and doc2, similarly user2 to doc2 and doc3, user3 to doc3 and doc1.

There is no field or pattern that we can use to generalize the query in DLS. The mapping between user and documents are decided at individual user and document level.

The number of users are above 10k and documents in millions. That makes it impractical to store userIds with each document.

Any suggestion to how to implement this?

Thanks

2

One way might be to use a parent-child relationship where the document is the parent and the users allowed to access this document each has a child document. There are drawbacks with parent-child in terms of query performance, query complexity and resource usage, but this might be a case where it is appropriate.

3

Thanks @Christian_Dahlqvist . Performance is a concern for us. Instead of joins, if we implement terms lookup/level query to lookup another index (which will have the mapping between users - documents) do you think that will have an impact on the performance?

4

Do you mean running 2 queries - one to get IDs of allowed documents by user and then a query with a potentially huge terms clause limiting access to documents?

5

Not at application code level. That will probably have an impact because of the huge list going over the network. I was referring to using the below feature in ES - [terms lookup] (Terms query | Elasticsearch Guide [8.4] | Elastic). I haven't tried this yet, not sure if it will help in this scenario.

6

I have not used that feature, so do not know how performance compares to parent-child. I suspect it comes down to how many documents each user can be associated with (limit seems to be 65536), which you have not provided informtion around.

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.