FSA Fix b/16198970: Config option to skip reading share ACL

The adaptor attempts to preserve access control integrity when sending
Access Control Lists (ACLs) to the GSA. In general, only users that have access
to a file share have access to the files maintained on that share, so the
adaptor includes the share's ACL in those sent to the GSA.  However, in some
configurations, the adaptor may not have sufficient permissions to read the
share ACL. In those instances, the broken share ACL will prevent all files
maintained on that file share from appearing in search results. The GSA's
Index Diagnostics for those will also indicate a broken inheritance chain.

If the share ACL cannot be read by the adaptor, the administrator may
skip the attempt to read the share ACL by setting the
'filesystemadaptor.skipShareAccessControl' configuration option to 'true'.
This feeds a highly permissive share ACL to the GSA, rather than the actual
share ACL, leaving only the file system ACLs to control access.

WARNING: Bypassing the file share access control may be inconsistent with
enterprise security policies. This may allow users that do not have access
to the file share to see documents hosted by that file share in search results.

[pjo, 2014-08-05 23:40:48]

Great.  LGTM.  Thank you

[Brett, 2014-08-05 23:53:08]

https://codereview.appspot.com/123780043/diff/1/src/com/google/enterprise/ada...
File src/com/google/enterprise/adaptor/fs/FsAdaptor.java (right):

https://codereview.appspot.com/123780043/diff/1/src/com/google/enterprise/ada...
src/com/google/enterprise/adaptor/fs/FsAdaptor.java:383: // Ignore the Share
ACL, but create an benign placeholder.
"an" -> "a"

[JohnL, 2014-08-11 18:51:56]

Minor comment. Are you waiting on a review from Miguel?

John L

https://codereview.appspot.com/123780043/diff/1/src/com/google/enterprise/ada...
File src/com/google/enterprise/adaptor/fs/FsAdaptor.java (right):

https://codereview.appspot.com/123780043/diff/1/src/com/google/enterprise/ada...
src/com/google/enterprise/adaptor/fs/FsAdaptor.java:386: dfsShareAcl = null;
The other two paths set the dfsShareAcl first; I think that consistency is nice.

[Brett, 2014-08-12 01:15:17]

> Are you waiting on a review from Miguel?

I was actually waiting for feedback from you, John, since you had significant
input into the design.

https://codereview.appspot.com/123780043/diff/1/src/com/google/enterprise/ada...
File src/com/google/enterprise/adaptor/fs/FsAdaptor.java (right):

https://codereview.appspot.com/123780043/diff/1/src/com/google/enterprise/ada...
src/com/google/enterprise/adaptor/fs/FsAdaptor.java:383: // Ignore the Share
ACL, but create an benign placeholder.
On 2014/08/05 23:53:07, Brett wrote:
> "an" -> "a"

Done.

https://codereview.appspot.com/123780043/diff/1/src/com/google/enterprise/ada...
src/com/google/enterprise/adaptor/fs/FsAdaptor.java:386: dfsShareAcl = null;
On 2014/08/11 18:51:56, John L wrote:
> The other two paths set the dfsShareAcl first; I think that consistency is
nice.

Done.

[Brett, 2014-08-12 01:17:50]

John's Feedback, minor edits before pushing.

[Brett, 2014-08-12 01:20:21]

Committed 11 August 2014 to Filesystem Adaptor:

To https://code.google.com/p/plexi.fs/
   062155f..9aa177d  master -> master