|
9 | 9 | "\n", |
10 | 10 | "In Azure AI Search, you can use an indexer to pull content into a search index for indexing. This notebook shows you how index blobs that have access control lists (ACLs) in Azure Storage Data Lake Storage (ADLS) Gen2, and then query the index to return only those results that the user is authorized to view.\n", |
11 | 11 | "\n", |
12 | | - "The security principal behind the query access token determines the \"user\". The ACLs on folders and files determine whether the user has authorization to the content, and that metadata is pulled into the index along with document content. Internally, the search engine filters out any documents that aren't associated with the security principal.\n", |
| 12 | + "The security principal behind the query access token determines the \"user\". The ACLs on folders and files determine whether the user is authorized to view the content, and that metadata is pulled into the index along with other document content. Internally at query time, the search engine filters out any documents that aren't associated with the object ID.\n", |
13 | 13 | "\n", |
14 | 14 | "This feature is currently in preview.\n", |
15 | 15 | "\n", |
|
24 | 24 | "\n", |
25 | 25 | "+ Folders and files, where each file has an [access control list specified](https://learn.microsoft.com/azure/storage/blobs/data-lake-storage-access-control). We recommend group IDs.\n", |
26 | 26 | "\n", |
27 | | - "We recommend creating a virtual environment to run this sample code. In Visual Studio Code, open the control palette (ctrl-shift-p) to create an environment. This notebook was tested on Python 3.10.\n", |
28 | | - "\n", |
29 | 27 | "## Permissions\n", |
30 | 28 | "\n", |
31 | | - "+ On Azure Storage, **Storage Blob Data Reader** permissions are required for both the search service identity and for your user account since you are testing locally. You also need **Storage Blob Data Contributor**. This sample includes code for creating and configuring a container and blobs used in this demonstration.\n", |
| 29 | + "+ On Azure Storage, **Storage Blob Data Reader** permissions are required for both the search service identity and for your user account since you are testing locally. You also need **Storage Blob Data Contributor** because the sample includes code for creating and configuring a container and its contents.\n", |
32 | 30 | "\n", |
33 | 31 | "+ On Azure AI Search, assign yourself **Search Service Contributor**, **Search Index Data Contributor**, and **Search Index Data Reader** permissions to create objects and run queries. For more information, see [Connect to Azure AI Search using roles](https://learn.microsoft.com/azure/search/search-security-rbac) and [Quickstart: Connect without keys for local testing](https://learn.microsoft.com/azure/search/search-get-started-rbac).\n", |
34 | 32 | "\n", |
35 | 33 | "## Limitations\n", |
36 | 34 | "\n", |
37 | | - "+ Parsing indexer options aren't currently supported." |
| 35 | + "+ Parsing indexer options aren't currently supported. There's no support for CSV, JSON, or Markdown parsing." |
38 | 36 | ] |
39 | 37 | }, |
40 | 38 | { |
|
55 | 53 | "\n", |
56 | 54 | "## Load Connections\n", |
57 | 55 | "\n", |
58 | | - "Load the environment variables to set up connections and object names." |
| 56 | + "We recommend creating a virtual environment to run this sample code. In Visual Studio Code, open the control palette (ctrl-shift-p) to create an environment. This notebook was tested on Python 3.10.\n", |
| 57 | + "\n", |
| 58 | + "Once the environment is created, load the environment variables to set up connections and object names." |
59 | 59 | ] |
60 | 60 | }, |
61 | 61 | { |
|
91 | 91 | "source": [ |
92 | 92 | "## Create an index\n", |
93 | 93 | "\n", |
94 | | - "The search index must includes fields for your content and for permission metadata. Assign the new permission filter option to a string filter and make sure the field is filterable. \n", |
| 94 | + "The search index must include fields for your content and for permission metadata. Assign the new permission filter option to a string field and make sure the field is filterable. The search engine builds the filter internally at query time.\n", |
95 | 95 | "\n", |
96 | | - "For local testing, `retrievable` can be **true**, but be sure to change it back to **false** if you make the solution available to others." |
| 96 | + "For local testing, `retrievable` should be **true** so that you can view the permission metadata, but be sure to change it back to **false** if you make the solution available to others." |
97 | 97 | ] |
98 | 98 | }, |
99 | 99 | { |
|
188 | 188 | "source": [ |
189 | 189 | "## Upload sample directory and file\n", |
190 | 190 | "\n", |
191 | | - "This step creates the container, folders, and uploads the files into Azure Storage. It assigns your group IDs to to the access control list for each folder." |
| 191 | + "This step creates the container, folders, and uploads the files into Azure Storage. It assigns your group IDs to to the access control list for each file." |
192 | 192 | ] |
193 | 193 | }, |
194 | 194 | { |
|
266 | 266 | "source": [ |
267 | 267 | "## Search sample data using x-ms-query-source-authorization\n", |
268 | 268 | "\n", |
269 | | - "This query uses an empty search string (`*`) to provide an unqualified search. It returns the file name and permission metadata associated with each file. Notice that each file is associated with a different group ID." |
| 269 | + "Wait for the indexer to finish processing before running queries. This query uses an empty search string (`*`) for an unqualified search. It returns the file name and permission metadata associated with each file. Notice that each file is associated with a different group ID." |
270 | 270 | ] |
271 | 271 | }, |
272 | 272 | { |
|
0 commit comments