SOLR Permissions / Filtering Results depending on Access Rights

Question

For example I have Documents A, B, C. User 1 must only be able to see Documents A, B. User 2 must only be able to see Document C. Is it possible to do it in SOLR without filtering by metadata? If I use metadata filter, everytime there are access right changes, I have to reindex.

[update 2/14/2012] Unfortunately, in the client's case, change is frequent. Data is confidential and usually only managed by the owners which are internal users. Then the specific case is they need to be able to share those documents to certain external users and specify access levels for those users. And most of the time this is an adhoc task, and not identified ahead of time

Answer 1

I would suggest storing the access roles (yes, its plural) as document metadata. Here the required field access_roles is a facet-able multi-valued string field.

Doc1: access_roles:[user_jane, manager_vienna] // Jane and the Vienna branch manager may see it
Doc2: access_roles:[user_john, manager_vienna, special_team] // Jane, the Vienna branch manager and a member of special team may see it

The user owning the document is a default access role for that document.

To change the access roles of a document, you edit access_roles.

---

When Jane searches, the access roles she belongs to will be part of the query. Solr will retrieve only the documents that match the user's access role.

When Jane (user_jane), manager at vienna office (manager_vienna) searches, her searches go like:

q=mainquery
&fq=access_roles:user_jane
&fq=access_roles:manager_vienna
&facet=on
&facet.field=access_roles

which fetches all documents which contains user_jane OR manager_vienna in access_roles; Doc1 and Doc2.

When Bob, (user_bob), member of a special team (specia_team) searches,

q=mainquery
&fq=access_roles:user_bob
&fq=access_roles:special_team
&facet=on
&facet.field=access_roles

which fetches Doc2 for him.

Queries adapted from http://wiki.apache.org/solr/SimpleFacetParameters#Multi-Select_Faceting_and_LocalParams