Hidden Features of 6.4 : Head Requestor Deny Rules
August 5th, 2010
The Problem
Header requests is the default method for how the Google Search Appliance (GSA) performs authorization on a document level (also known as late binding) for web based content (See The Header Requester). There are numerous advantages and disadvantages. One of the minuses, is that it relies on the content source to adhere to HTTP protocols.
We’ve experienced numerous content systems that don’t fully support the correct HTTP response for this to work. In many cases of Lotus Domino or Microsoft SharePoint, a friendly message is return or their is an embedded header. This causes the to misinterpret the response from the server and think the user has access to the document.
The common method pre 6.4 was to implement a SAML interface and develop custom code to handle the logic for the variety of content sources. Google released several Open Source projects to jump start your efforts. Most notably they are:
The Solution: Header Request Deny Rules
Those tended to be difficult for our clients to implement and another piece of infrastructure to deploy and manage. In version 6.4, Google has added additional rule validation on the appliance. You now can check the most common sets on the appliance with simple configuration:
This virtually eliminates many of the customizations that we’ve made for the wrong response. How Neat!!!







