QuestionWhat approaches are there to not display a search result that a user is not supposed to see?ExampleSuppose we have the following situation.High-level viewIn an enterprise, there are different repositories like websites, databases, filesystem folder etc. And there is a search engine that crawls all those repositories and creates an index. The user can then use the search engine UI to perform searches.Let's say the search engine was Apache Lucene and the encompassing indexing and retrieval system Apache Solr.User permissions are managed via Microsoft Active Directory.The content in the different repositories are managed with all kinds of applications like MS Word, custom-made applications, database management tools etc.Search-index and user permissionsThe index contains the documents A1, A2, B1 and B2.User A has only permission to see documents of type A*.Performing a searchNow, user A performs a search for A* AND B*.Displaying the resultsA system administrator with permission to see everything should see all four documents in the search results: A1, A2, B1 and B2.User A however, who only has permissions to see documents of type A*, should/will only see two documents in the search results: A1 and A2. So user A shouldn't even know that documents B1 and B2 exist.Elaboration on the questionWhat ways are there to implement that requirement that users only see documents they are allowed to see?I suppose it would be a bad idea to add the information to the index whether a user may see a document. I think that because of this use case: suppose all of a sudden user A may only see document A1 and not A2 anymore; those permissions are now set for example on the filesystem. Now it takes a while until the permissions in the index are updated and during that time user A would still be able to see document A2 in the search results even if he can't click on the result and access it anymore.Also, the above approach probably would break down when there are hundreds of millions of documents and thousands of employees.Where and how would the security aspect be implemented in a content indexing and retrieval system in the above scenario?
What approaches are there to not display a search result that a user has no permission to see?
search;information retrieval