How to manage fine grain permissions in Elasticsearch?

Hello,

I need to store in a consistent way the role/groups that can access the
information but I'm not sure what's the best way to do it.

Summary: I have 2 kinds of docs "tweet" and "blog":

  • At tweet level, I store the group name allowed to access the
    information
  • blog is more complex, there are metadata (title, description, nature,
    ...) but some of those informations can be restricted to some groups of
    user (only admin, or logged_in users)

What the best way to map this with Elasticsearch ?

As of today, I end up with documents like:

/tweet/455
{
id: 112,
ugroups: [ "restricted_user", "admin" ],
description: "foo",
},
{
id: 113,
ugroups: [ "anonymous" ]
description: "foo",
}

and

/blog/500
{
id: 5,
fields: [
{
"nature": {
"value": "foo",
"ugroup": [ "admin" ]
}
}
]
}
{
id: 6,
fields: [
{
"comment": {
"value": "foo",
"ugroup": [ "anonymous" ]
}
}
]
}

When user want to search in tweet, that's easy, I build a term query with
words submitted by the user and I append the groups the user belongs to
this query.

But how to make a query that will take this "ugroup" thing at various level
?

Ideally I could issue a query like:

  • search in tweet with tweet.ugroup: "anonymous" and in blog with
    blog.fields.*.ugroup:
    "anonymous"

Is there a way to write such a query ?

Manuel VACELET


@vaceletm

--
You received this message because you are subscribed to the Google Groups "elasticsearch" group.
To unsubscribe from this group and stop receiving emails from it, send an email to elasticsearch+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/elasticsearch/CAP66XbEYW786uoZ2p6So0G2p31NX1owejaq0X1QDuZd8Nq7a1A%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.