Google Search Appliance Security - Manual (Page 25)

25
Flexible Authorization Rules
In general, for most deployments, we can leave the first 3 entries of Flexible Authorization alone:
PER_URL_ACL, CACHE, and POLICY. This also applies for this particular deployment. PER-URL-ACL
rule will kick in for SharePoint and Salesforce content because ACLs are indexed with documents. We do
have to make some changes to the CONNECTOR rule because the default configuration is only
associated with the “Default” Credential Group.
● CONNECTOR
○ Change the Authentication ID to “Legacy”—it’s equivalent to the selection of Credential
Group here.
○ Fill in the database connector name in Connector Name field.
We also need to define a SAML rule. Although SAML Bridge uses Head Request to authorize custom IIS
web sites, we cannot rely on the “
HEADREQUEST ” rule because that’s for GSA to perform Head
Request.
● SAML
○ It should be right after CONNECTOR rule in the Flexible Authorization order.
○ Authentication ID should be “Default” (maps to Credential Group).
Authorization Service URL should point to Saml Bridge’s Authz.aspx.