Documentum Connector for a Search Framework

Dear EMC community,

I am currently working on my bachelor thesis and facing the following problem:

My task is to develop a connector for a Search Framework which is used in my company.

The connector is supposed to tie a DMS based on Documentum as a data source to the Search Framework - which has its own search engine, own index, etc.

There is an interface on Seach-Framework-side which awaits parsed content that is to be indexed by the SF.

Using the search function (via the SF-frontend) users should be able to find content which they are authorized for in Documentum (it should be noted that users have the same user id in both systems).

In the search form, they should be able to see a short excerpt of the found document(s) as well as a link to the document(s) in Documentum so that if they were to click the link, the document opens in Documentum.

Unfortunately not only I have very little knowledge of technical details of Documentum but also most of my colleagues.

As far as I have found out, user/group permissions are stored individually for each document in ACLs (or in most cases the document inherits the ACL of the parent folder).

Apart from an initial indexing process I need to make sure that every creation, deletion or change in general of documents, metadata and user permissions is registered and communicated to the SF-interface so that the SF-index can be refreshed and is consistent to the Documentum index.

It is essential that users may not find content which they are not authorized for in Documentum.

What do you think is the best way to approach this?

After some research I thought of something like registering a system user for all document- and permission-change-events that can be handled by the connector. The real struggle is the permission-thing though because I have absolutely no idea on how to check if the searching user - even if I put a reference to the according ACL into the SF-index - is permitted to access the document (and even allowed to see that the document exists).

I already thought of copying the Documentum index or just forwarding the search request to the Documentum system, but the explicit demand of my superiors is to build an own index within the SF.

Has anybody already attempted something similar?

I really have no clue on how to approach this and would be glad for any help I can get!

Thanks in advance and best regards,

Maik

Find more posts tagged with

Note:

If there are Accepted Answers, those will be shown by default. You can switch to 'All Replies' by selecting the tab below.

Accepted answers

bacham2

What you describe is pretty much what EMC implemented for Documentum's own full-text engine called xPlore. It duplicates the ACL and group information in in its own database and uses it to filter results. Like you wrote, it gets notified of each change in ACLs and group so that it gets a chance to update its database.

You can try to implement the same behavior on your side. However, you will need to know how to evaluate Documentum permissions. Assuming you are not using any of the advanced Trusted COntent Services features such as mandatory access control and so forth, a user needs at least READ permission to view the document content. If a user is mentioned several times in an ACL (e.g. explicitely or as part of several groups), the more permissive is granted.

Alternatively, you could run your query in your system and then send a DQL query to Documentum with the hits stored in Documentum to filter the documents with the right permissions. However, this solution is likely to not perform very well.

All comments

bacham2

boon046

There are already numerous connectors for indexing Documentum data (including support for security trimming) to inject into external search engines, eg BA Insight, Search Technologies, Docway, possibly some opensource connectors used by Lucene.

Ro4cHii

I think the fact that it would most likely not perform very well is the main reason why I am supposed to let the SF do the indexing and not forward the query to Documentum. I already thought of this as well, but a search via SF takes <1sec while the average search in Documentum takes between 10-20 seconds because its index is really messed up due to historical reasons. So I guess this approach would slow down the entire SF-searching process.

Do you know if there are any documents that provide useful information about how to evaluate Documentum permissions?

Furthermore, I would have to store the permissions in the SF-index to guarantee proper security measures. What would be the best approach to do this, since dm_document-objects only contains a reference to the acl_name and acl_domain but not the actual ACL-content (and I have no clue how to access this content nor how to reference it out of the SF). Any idea?

Since we are using a heavily modified/extended version of Documentum I don't think one of the existing connectors (especially the not-open-source-ones) would be applicable, because it would take a lot of adjustments - but nevertheless, thanks a lot & I will take a look at those you mentioned, .

EDIT: I just asked my superiors if we use the advanced Trusted Content Services... we do. I guess this will make things even more difficult!?