Security Issues with the HEAD approach to authorizing SharePoint content

January 10th, 2010

Recently, while working on a Google Search Appliance implementation involving a custom SAML interface users were being returned documents in some cases which they did not have access to. In reviewing the logs, we found that SharePoint was responding with an HTTP status of 200.

The GSA resolves late binding by performing a head request. Our case involved a user being granted access to a document by the GSA that they shouldn’t have. For reasons unknown, when one user accessed a page, they got a 401 (unauthorized) and when another use accessed the page, they got an error. Both users were not able to access the document.

The head request was something similar to:
head request

This appears to be a standard 200 response, but it contains something interesting. There is an additional header called SharePointError. In digging around MSDN, I found this article . The SAML bridge had to be modified to check for this head in addition to the response. The existence of this header does not indicate a failure, only that it needs to be future examined to see if the user has access.

Add a facet search menu to your Google Search Appliance!

January 7th, 2010

gsa-faceted-search helps you build a faceted search experience.  The filters are static but provide a very rich ability to filter without a hole lot of XSLT modifications.  There is a simple 3 step process documented here on adding it to your search interface.

Happy Holidays from MC+A

December 21st, 2009

From all of us at MC+A.  Have a happy and safe holiday season.  Best wishes for the new year.

- The MC+A Team

Have a Safe Holiday Season

Google Search Appliance Connectors 2.4 released

December 18th, 2009

Earlier this week, Google release version 2.4.  This is the first public accessible version of the connectors.  Connections as part of this release are:

  • SharePoint
  • Documentum
  • LiveLink
  • FileNet
  • File Systems – new (aka beta)
  • Databases – new (aka beta)

Upon first view of them, it looks like they incorporate many of the suggestions we have posted on this blog over the past few months.  (i.e. use javascript to produce the results [Thanks Jon Doctor!]).  We’ll be posting a how to get the best search out of SharePoint with a Google Search Appliance shortly.

Customers interested in assistance with deployment of the connectors please contact us.

Parsing a URL Encoded String for the parameter (match between two words)

December 17th, 2009

I spent the last hour trying to find a regular expression to parse a url that was url-encoded or to match between two words.  Java was having a difficult time retrieving the url since it was parameter=something& but rather proxystylesheet%3Ddefault_frontend%26.  The expression is:

(?<=proxystylesheet%3D).*?(?=%26)

Where proxystylesheet is the parameter you are looking for.  This won’t find the value if it is at the end of the line but in my case, that is unnecessary.

Google Analytics new Features = Awesome

December 10th, 2009

When Google originally announced the features for the most recent refresh of Google Analytics we were excited. But not that they have finished rolling most of them out, to everyone’s analytics accounts, it is pretty awesome. For a free product Google Analytics now is pretty feature rich.

Of all the new Google Analytics features we feel the there are 3 the really stand out.

1. Custom Variables
Finally! Custom variables in Google Analytics will now allow you to set up to five variables per page. This is a vast improvement over the old _setVar. You can set three types: visitor, session or page. The flexibility this will allow is amazing. This feature is even more compelling when you consider that you can now also use custom variables in advanced segments.

2. Annotations
This is very helpful. Add notes to data that will allow you to keep better track of external marketing’s effect on traffic.

3. Expanded Goals Functionality
Let’s me honest, four goals was never enough. Not a problem anymore! You now have 20 goal that are segmented into Goal groups for 5 each. This is great for grouping conversion actions. In addition to an expanded number of goals you can also track site engagement through goals.

Head over to Google Code to get all the documentation on these new features.

Asynchronous Tracking Code for Google Analytics

December 2nd, 2009

Yesterday, Google announced a new Asynchronous Tracking Code for Google Analytics. While initially in Beta, the code will allow for tracking of events before all the scripts on your page load. Should be a great improvement for rich media or large content site tracking.

The new tracking snippet offers the following benefits:

  • Faster tracking code load times for your web pages due to improved browser execution
  • Enhanced data collection and accuracy
  • Elimination of tracking errors from dependencies when the JavaScript hasn’t fully loaded

If you’re ready to dive in head over to the Asynchronous Tracking Code Section on Google Code.

See you at directIT tonight.

December 1st, 2009

MC+A will be sponsoring the directIT Chicago event tonight at the Elysian hotel.  Drop a comment if you are going to be there.

SharePoint 2010 and Office 2010 Betas Released

November 18th, 2009

Today, Microsoft released the new Office 2010 and SharePoint 2010 public beta.  This is is the first public beta of the new technology.

It’s been 3 years since the previous release of the Office.  Much has changed in the economy and the enterprise landscape.  We just download the versions and will begin to test them and report back.

GSA 6.2 features Webinar

November 9th, 2009

The MC+A team will be hosting a webinar to discuss the new features of the recently released Google Search Appliance version 6.2 software. We will be covering the business impact of these features and making recommendations for upgrading your appliance.

More Information

Page 3 of 131234510...Last »