MC+A

New Version of Google Search Appliance software 6.4

Google released a patch for appliance software release 6.4.  Release notes can be found here (goes to Google support page).

MC+A support will be contacting MC+A support customers about scheduling a time for the update.

The Problem

Header requests is the default method for how the Google Search Appliance (GSA) performs authorization on a document level (also known as late binding) for web based content (See The Header Requester).  There are numerous advantages and disadvantages.  One of the minuses, is that it relies on the content source to adhere to HTTP protocols.

We’ve experienced numerous content systems that don’t fully support the correct HTTP response for this to work.  In many cases of Lotus Domino or Microsoft SharePoint, a friendly message is return or their is an embedded header.  This causes the to misinterpret the response from the server and think the user has access to the document.

The common method pre 6.4 was to implement a SAML interface and develop custom code to handle the logic for the variety of content sources.  Google released several Open Source projects to jump start your efforts.  Most notably they are:

• Google Value Security Framework
• Google SAML Bridge for Windows

The Solution: Header Request Deny Rules

Those tended to be difficult for our clients to implement and another piece of infrastructure to deploy and manage.  In version 6.4, Google has added additional rule validation on the appliance.  You now can check the most common sets on the appliance with simple configuration:

Screen shot of the Header Request Deny Rule Form

This virtually eliminates many of the customizations that we’ve made for the wrong response.  How Neat!!!

New Version Released For 6.4

Google released a patch for the latest search appliance release.

Release notes can be found here.

MC+A support customers will be contacted to schedule the update.

Google has just released 6.4 on the enterprise support site and has updated code.google.com’s documentation.  We have yet to install and verify.  But some of the big changes so far:

JavaScript Crawling

The search appliance now can detect links and content generated dynamically.  I wonder if this will help the forms authentication wizard?

Serve Time Authentication

You will no longer need to enable or disable security manager and legacy auth as in 6.2. The default behavior of the appliance is to now centralize authentication for:

• Cookies
• HTTP Basic and NTLM
• Kerberos
• SAML
• Connectors

Administrative Improvements

There are various administration improvements, most notably:

• LDAP Setup
  New options to use LDAP during serve-time and looking up a user’s group during authentication.
• Timeout for Auth Requests
  New option allows specification wait time for GSA before processing batch authorizations.
• Head Requestor Deny Rules
  Allows you to identify URLs where content servers deny users access with codes other than HTTP code 401. (Non web standard pages)

The full documentation is here.