No results returned

[Douglas Green]

Recently I changed from using the onboard file crawler using NTLM with perimeter security setup, to using the offboard connector for File System to gather the documents and the ACL's. I am using LDAP via the secure port 636 and I have it setup under the Universal Auth\LDAP to authenticate and gather groups. 

I removed the onboard crawl patterns and crawler access and I added the http://server:8080/getDocumentContent? under the follow urls.

I can see under feeds the documents and ACLS being successfully indexed.

Under Index Diagnostics I can see for http://server:8080 the documents and the meta data plus ACL info.

When I search, perimeter security prompts me to authenticate. I do successfully, according to the secmgr log and the Windows Event Log on the Domain Controller.

When I type a name I know was successfully indexed according to the Index Diagnostics I get no results for anything at all.

I looked at the serving logs attached here:

Time Component Logs

2/19/15 17:13:47.635

Appliance Frontend

Query received: test

2/19/15 17:13:47.688

Appliance Frontend

Full query URI: /search?q=test&site=default_collection&btnG=Google+Search&access=a&client=default_frontend&gsaRequestId=DO_NOT_LOG_REQUEST_ID&proxystylesheet=default_frontend&output=xml_no_dtd&sort=date%3AD%3AL%3Ad1&wc=200&wc_mc=1&oe=UTF-8&ie=UTF-8&ud=1&exclude_apps=1

2/19/15 17:13:47.709

Authentication

The user's current session is still valid; skipping authentication and reusing credentials from session: a217f53cfa6e6f3330f3175763825c17

2/19/15 17:13:47.741

Appliance Frontend

Sending request to backend.

2/19/15 17:13:48.025

Appliance Backend

Number of documents filtered by indexserver using ACLs for this query: 0

2/19/15 17:13:48.025

Appliance Backend

Number of documents scored for this query: 1929

2/19/15 17:13:51.576

Appliance Backend

Requestor IP: 10.120.21.101 Proxy Path: 10.120.21.101

2/19/15 17:13:51.601

Appliance Backend

Number of results returned by backend: 1000

2/19/15 17:13:51.601

Appliance Backend

Number of results returned to frontend after filtering: 0

2/19/15 17:13:51.601

Appliance Backend

Total time spent in backend: 3824 ms.

2/19/15 17:13:51.603

Appliance Frontend

Received response from backend.

2/19/15 17:13:51.859

Appliance Frontend

Sending response to user.

I have a robots file to filter out unwanted file types but what could be filtering our my results?? The documents are found just not returned after a front end filter. I blew away the front end and started with a default front end and no luck just the same results. I deleted my collections and I am using the default collection which is "/" which I guess is all documents. Do I need a collection set to use the path of the connector?

thanks for any light that can be shed on this,

Doug

[Dave Watts]

> Recently I changed from using the onboard file crawler using NTLM with
> perimeter security setup, to using the offboard connector for File System to
> gather the documents and the ACL's. I am using LDAP via the secure port 636
> and I have it setup under the Universal Auth\LDAP to authenticate and gather
> groups.
>
> I removed the onboard crawl patterns and crawler access and I added the
> http://server:8080/getDocumentContent? under the follow urls.
>
> I can see under feeds the documents and ACLS being successfully indexed.
>
> Under Index Diagnostics I can see for http://server:8080 the documents and
> the meta data plus ACL info.
>
> When I search, perimeter security prompts me to authenticate. I do
> successfully, according to the secmgr log and the Windows Event Log on the
> Domain Controller.
>
> When I type a name I know was successfully indexed according to the Index
> Diagnostics I get no results for anything at all.
>

> ...

>
> I have a robots file to filter out unwanted file types but what could be
> filtering our my results?? The documents are found just not returned after a
> front end filter. I blew away the front end and started with a default front
> end and no luck just the same results. I deleted my collections and I am
> using the default collection which is "/" which I guess is all documents. Do
> I need a collection set to use the path of the connector?

You're showing a serving log for a request after the initial
authentication process. You should go back to the first successful
authentication and see whether groups were retrieved for that user,
and whether those groups match what you have in the ACLs.

Dave Watts, CTO, Fig Leaf Software
1-202-527-9569
http://www.figleaf.com/
http://training.figleaf.com/

Fig Leaf Software is a Service-Disabled Veteran-Owned Small Business
(SDVOSB) on GSA Schedule, and provides the highest caliber vendor-
authorized instruction at our training centers, online, or onsite.

[Douglas Green]

Thanks Dave,

So I looked at the serving logs with debug checked. I looked at the initial search after the login. The Debug info states that the GSA would use the existing login information as the session was still active and returned no ACL info.

I thought this to be odd as it has been over 18 hours since I did a search. I have a test user account I never use and I have not used with GSA before. I looked at the serving logs after I logged in with the test account. I received the  same message that the GSA would use the existing login information as the session was still active. 

I have a second GSA on another domain that works fine. The serving logs for that one show when debug is checked the ACL info once a user authenticates.

Any thoughts?

[Dave Watts]

> So I looked at the serving logs with debug checked. I looked at the initial
> search after the login. The Debug info states that the GSA would use the
> existing login information as the session was still active and returned no
> ACL info.
>
> I thought this to be odd as it has been over 18 hours since I did a search.
> I have a test user account I never use and I have not used with GSA before.
> I looked at the serving logs after I logged in with the test account. I
> received the same message that the GSA would use the existing login
> information as the session was still active.
>
> I have a second GSA on another domain that works fine. The serving logs for
> that one show when debug is checked the ACL info once a user authenticates.

Delete your browser's cookie from the GSA, and try again.