Document-level security is not working as expected

[oliver-chao]

I attempted to implement document-level security in the chatbot by creating a group_ids field in my Azure AI Search index and adding it to the environment variables in App Service. However, I'm still receiving results that should be restricted based on my login group information. I’ve verified in the logs that the group data is correctly obtained and passed to the search filter, yet it still isn’t functioning as expected. Has anyone else encountered this issue, or is there a step I might have missed?

[oliver-chao]

I didn\t see filter in the request body. The filter is dumped into model's paramters. Shouldn't we set filter: Optional[str] = Field(default=None, exclude=False) instead of (exclude = True) ?

[borgerta]

@oliver-chao I was running into the same issue. I was able to fix the issue by modifying the filter definition as you suggested:

filter: Optional[str] = None

Documents now appear to be appropriately restricted.

[2gad]

Hi @oliver-chao , @borgerta - wondering if you could help?

Once I get the group_ids in the model_args I am not getting back the expected result but instead the following error:

There was an error generating a response. Chat history can't be saved at this time. Error code: 400 - {'error': {'requestid': '****************************', 'code': 400, 'message': 'An error occurred when calling Azure Cognitive Search: Azure Search Error: 400, message='Server responded with status 400. Error message: {"error":{"code":"","message":"Invalid expression: Could not find a property named \'True\' on type \'search.document\'.\\r\\nParameter name: $filter"}}', url='[https://xxxxxx.search.windows.net/indexes/index/docs/search?api-version=2024-03-01-preview](https://xxxxxx.search.windows.net/indexes/index/docs/search?api-version=2024-03-01-preview%5C)'\nPotential issue with Azure search filter. Please ensure all field names in the filter are correct and syntax is correct for filter.'}}

Here is how my index is defined:

{
"name": "index",
"fields": [
.. OTHER FIELDS ..
{
"name": "group_ids",
"type": "Collection(Edm.String)",
"key": false,
"retrievable": true,
"stored": true,
"searchable": false,
"filterable": true,
"sortable": false,
"facetable": false,
"synonymMaps": []
}
.. Rest of definition ..
}

Any ideas on what I could be doing wrong?