This post discusses the possibility of extending the DotNetNuke search provider to support security at the SearchItem level.
Out of the box DotNetNuke provides security at a Tab (page) and Module level. The default Search provider uses this security to filter results to only show items from Modules the current user is allowed to view. Unfortunately this is “all or nothing” for the contents of a module - there is no way for a module to indicate that some of its search results should only be visible to certain users.
There are many examples of where this could be useful. Consider a module that shows different News items depending on the roles of the current user or perhaps a Forum module where some forums are restricted to certain users. If those modules implement the ISearchable interface then all search results will be visible to any user with view access to the module. Even though the module should prevent access to the full detail of the search item, the summary that is shown in the search results list may be confidential in itself. Also it is not really “good form” to show search results that the user can’t access the details for.
OK, so let's extent DotNetNuke's search provider.
How would this affect module developers? It wouldn’t - unless they want to take advantage of the new features. If the module doesn’t need to secure part of its content it just carries on implementing ISearchable as it does now - no change. The module’s GetSearchItems returns a SearchItemInfoCollection filled with SearchItemInfo objects just as it does now. The DotNetNuke search provider continues to check Tab and Module permissions to confirm the user has the right to view the search results.
So what changes? A new class called SearchItemInfoWithPermissions is derived from SearchItemInfo. If the module wants to implement search item-by-item security it’s GetSearchItems fills the SearchItemInfoCollection with objects of this new class instead. The extended search provider will then persist the extra permission information along with the search item and use it when processing results.
On a different but related topic, this security could also be used to control items shown in RSS feeds and would be particularly useful when combined with basic authentication (connected to DotNetNuke’s forms authentication) for the RSS results page so that news readers could get results for secured content. (see the article about MADAM at
http://msdn.microsoft.com/en-us/library/aa479391.aspx for more info about this). Anyway back to searching...
There is an enhancement request on Gemini along these lines. Feel free to vote for it if you think it would be useful J. (http://support.dotnetnuke.com/issue/ViewIssue.aspx?id=2727&PROJID=2)
I’m going to work on fleshing out some code for this and will probably keep having a conversation with myself here in this forum. Please let me know if work has already been done on this topic or if I’ve missed a really obvious issue.