Home

Content Sources

Index

Search
  Search Features
  Secure Search
    Access Control
    Head Requestor Deny Rules
    Policy ACLs
    Universal Login
    Universal Login Auth Mechanisms
      Cookie
      HTTP
      Client Certificate
      Kerberos
      SAML
      Connectors
      LDAP
    Universal Login Form Customization
    Flexible Authorization
    Trusted Applications
  Diagnostics

Reports

GSA Unification

GSAⁿ

Administration

More Information

Search > Secure Search > Access Control

Use the Search > Secure Search > Access Control page to perform the following tasks:

• Enabling the Search Appliance to Record User Identities for Queries
• Enabling Authentication for User Results
• Changing the SAML Issuer Entity ID
• Setting Session Idle Time

Enabling the Search Appliance to Record User Identities for Queries

The search appliance can record the user identity for a secure query when the user is authenticated with a verified identity. Enabling this option will set the search appliance to record the user identity (if available) for each query and display user identities in search logs and in serving logs. After you enable this option, the search appliance begins recording user identities for subsequent queries.

You can define, generate, or view a search log by using the Reports > Search Logs page in the Admin Console. You can view serving logs by using the Reports > Serving Logs page.

To enable recording user identities in search logs and serving logs:

1. Click the check box for Record user identity in Search Logs and Serving Logs.
2. Click Save.

To disable recording user identities in search logs and serving logs:

1. Clear the check box for Record user identity in Search Logs and Serving Logs.
2. Click Save.

Enabling Authentication for User Results

User results give users the capability to add search results for certain keywords in a specific front end. User results cause designated documents always to appear on the results pages for specified keyword searches performed in the front end. To configure user results, use the Search > Search Features > User Results page.

Enabling authentication for user results requires a user to be properly authenticated with a verified identity before adding, editing, or removing user results. If authentication for user results is enabled, and the user is not logged in with a proper verified identity, the user cannot add, edit, or delete user results. If authentication for user results is not enabled, users are not required to be properly authenticated before adding, editing, or removing them.

To enable authentication for user results:

1. Click the check box for Require authentication for User Results.
2. Click Save.

To disable authentication for user results:

1. Clear the check box for Require authentication for User Results.
2. Click Save.

Changing the SAML Issuer Entity ID

By default, the SAML Issuer Entity ID that is used by a search appliance in SAML requests is:

http://google.com/enterprise/gsa/${APPLIANCE_ID}

In a configuration with one search appliance or more than one separate search appliances, each one should have its own SAML Issuer Entity ID to ensure that the issuer is unambiguous.

In a multibox configuration, such as GSAn, GSA Unification, or load balancing, the search appliances should share the SAML Issuer Entity ID of the master node. Enabling a multibox configuration causes the SAML Issuer Entity ID to propogate to the other nodes in the configuration.

You can change the ${APPLIANCE_ID} in the SAML Issuer Entity ID to be anything you want, for example:

http://google.com/enterprise/gsa/corp_gsa_1

To change the SAML issuer entity ID for your search appliance:

1. Enter the new ID in the SAML Issuer Entity ID box.
2. Click Save.

Setting Session Idle Time

Session Idle Time specifies how long a user's search session can be inactive before timing out, in seconds. When the session idle time expires, the search appliance ends the session. To resume searching, the user needs to provide his credentials again in the Universal Login Form. The default value is 1800 seconds (30 minutes).

Take note that a user might also be prompted to provide credentials again if the Trust Duration for the authentication method times out. In fact, the user is prompted to provide credentials when the shortest setting (Session Idle Time or Trust Duration) times out first. For this reason, Google recommends coordinating the two settings.

To set Trust Duration, use the Search > Secure Search > Universal Login Auth Mechanisms page.

To set Session Idle Time:

1. In the Session Idle Time box, enter the number of seconds a search session can be inactive before timing out.
2. Click Save.

For More Information

For more information about access control, see Administration > LDAP Setup and Content Sources > Web Crawl > Secure Crawl > Crawler Access.