I have an ElasticSearch search engine and an internal web application. Prior to applying the security model, search results were very fast. The security model restricts some users from accessing certain pages. We have 7 "types" of pages.
Our process is currently this:
- Search engine queries all records
- For each type of result, I get all recordIds of that type from the database that the user is allowed to access. This ensures I only call the database a max of 7 times (once per type)
- I do an intersect between the records the user can access and the records search is returning
The above approach isn't fast enough. I have an autosuggest search and each query takes up to 2 seconds now.
What is a typical way to make a search engine return results that adhere to security? Another developer has recommended I store the security permissions directly in ElasticSearch itself(essentially mirroring what our sql server has).
Edit: Each record has a page. We can assume 200-500 users and 25000+ records.