Open topic with navigation

Configure IDOL > Security > Document Security > OmniGroupServer

# OmniGroupServer

OmniGroupServer extracts user and group information from repositories, such as Microsoft Active Directory and IBM Notes. OmniGroupServer stores the information so that it can be used by IDOL to provide document security.

When a user submits a query to IDOL server, IDOL must determine whether the user is permitted to view the documents that are returned as results. To do this, IDOL compares the user's information to each document's Access Control List (ACL).

Note: The permissions applied to a file or record specify the users and groups who are permitted, and are not permitted, to view it. The permissions are stored in the file's ACL. When you set up mapped document security and connectors extract files from a repository, the connector writes the ACL into an encrypted document field.

IDOL must also consider the groups that the user belongs to. For example, a user might not have explicit permission to view a document, but they could be a member of a group that has permission. This means that IDOL requires the user and group information from the repository.

IDOL cannot retrieve security information from a repository at query time, because this would result in an unacceptable delay for the user who submitted the query. Instead, you can use OmniGroupServer to extract and cache the security information. OmniGroupServer regularly extracts security information, based on a schedule that you configure, so that it remains synchronized with the repository.

## Retrieve Security Information

To extract security information from a repository you configure tasks in the OmniGroupServer configuration file. Each task extracts information from one type of repository. You can schedule tasks to run at specific intervals.

Note: OmniGroupServer can make many requests to a repository. To maximize performance, HPE recommends scheduling tasks when the repository has spare capacity to process the queries, for example during the night.

For most repositories, OmniGroupServer can extract incremental changes. The first time the task runs, OmniGroupServer extracts all of the security information from the repository. The next time the task runs, OmniGroupServer only needs to extract the updated information.

Due to API limitations imposed by repositories, OmniGroupServer cannot extract security information from all types of repository. In some cases (for example Microsoft SharePoint), you must use a connector to extract security information. To extract security information using a connector, run the connector's `SynchronizeGroups` action.

You can run the `SynchronizeGroups` action automatically by using one of the following methods:

- Configure a Connector Task in OmniGroupServer. Create and schedule a task in OmniGroupServer, and set the parameter `GroupServerJobType=Connector`. When `GroupServerJobType=Connector`, OmniGroupServer automatically sends the `SynchronizeGroups` action to the specified connector. The connector extracts security information from the repository, using the settings in its configuration file, and returns the information to the OmniGroupServer that sent the action. HPE recommends using this method for retrieving security information using a connector, because it does not require any additional settings to be specified in the connector's configuration file.

- Configure the connector to run the SynchronizeGroups action. You can configure a connector to run the `SynchronizeGroups` action based on a schedule that you configure. The connector runs the action and returns the information to the OmniGroupServer that has been specified in the `[GroupServer]` section of its configuration file. When you use this method, you must configure the new task and specify the details of the OmniGroupServer in the connector's configuration file.

## Process Security Information

OmniGroupServer can perform operations on the security information it extracts. For example, certain repositories use NT security but do not include the domain name in ACLs. In this case you could configure OmniGroupServer to remove the domain name from the NT groups that are extracted, so that they match the ACL.

## Combine Security Information

Some repositories, such as Microsoft SharePoint, use a combination of security types. To set up security for documents that are extracted from SharePoint, you must configure a task in OmniGroupServer to combine NT security information with that from the SharePoint server. For more information about how to do this, refer to the SharePoint connector documentation.

Related Topics

- Configure Security Across Components

© 2016 Hewlett Packard Enterprise Development LP | Send documentation feedback to HPE Close We welcome your comments! To open the configured email client on this computer, open an email window. Otherwise, copy the information below to a web mail client, and send this email to AutonomyTPFeedback@hpe.com. Product: Topic Title: Help Topic: Feedback:

_HP_HTML5_bannerTitle.htm