Group and Granted Security Identities

Enterprise user management systems typically encourage including users in groups, especially when dealing with many users. Using groups can make permission attribution faster and more efficient since you can create a group security identity representing all users that have the same title or are members of the same team or department.

A group security identity represents the sum of all its member security identities. When a group is allowed or denied access to an item, all group members have the same permission.

Group security identities can also include other groups, or both groups and users.

Coveo handles granted security identities (formerly known as well-known groups) like groups when analyzing an item permission model. As a result, both of these security identity types can be marked as allowed or denied access to the item in place of a list of individual security identities.

Granted security identities differ from group security identities in that it’s impossible to retrieve a list of their members, because often such a list doesn’t exist. The secured enterprise system automatically knows whether it should grant a certain security identity to a user depending on the users' characteristics, so it doesn’t store an exhaustive list of who is granted which security identity. This list is required because the index needs it to filter search results and it must therefore be obtained otherwise. Since it can retrieve the granted identities of all users using the security identity provider, the Coveo security identity cache can easily determine which users are linked to which granted identity (see Security Identity Relationships and Security Identity Cache and Provider). Coveo therefore handles granted security identities as smoothly as group security identities.

A group or a granted security identity is usually related to at least another security identity (see Security Identity Relationships).