Apache ManifoldCF: Search Shared Documents Without Losing Permissions

Apache ManifoldCF collects documents through repository connectors, resolves users' access tokens through authority connectors, and sends content and permission information through output connectors to a search engine such as Solr. Your search application must enforce those permissions on every query. A search box that shows payroll documents to everyone is a breach, even when the original folder remains locked.

This needs an IT provider or a developer who understands your directory and search application. If your shared files fit in one well organized drive, or Microsoft 365 or Google Workspace already finds the right files while respecting access, use that first. Another index adds another copy to protect, update and eventually delete.

ManifoldCF becomes interesting when useful documents span several repositories and staff cannot search them together. It supplies the collection and permission plumbing. It does not supply a finished staff portal or a private chatbot.

We read the official sources on October 30, 2026 and reused the series' October 29 price research. We have not installed this stack for the article. Business sizes, deployment sizes, hours and acceptance targets below are our planning assumptions, not customer results.

What is current, and what needs checking

The download page lists ManifoldCF 2.31, released July 30, 2026. The project home page also records 2.30 on April 11, 2026 and 2.29 on September 12, 2025. Those dates show continuing releases. We would not call it abandoned from its older documentation alone.

There is a documentation gap. The release documentation index still links 2.30, although 2.31 pages exist and retain older instructions. The current README requires Java 25 or newer, and the 2.31 release branch build configuration targets Java 25 with preview features. For a reproducible 2.31 trial, use Java 25 and the matching launcher. Do not follow an old Java 11 recipe or assume every newer Java runtime will accept preview bytecode from an earlier release.

The connector matrix documents these relevant options. Its 2.31 page retains the older tested versions; it is not proof that those servers remain supported by their vendors.

Some matrix entries are visibly old. SharePoint's tested versions end at 2013; Elasticsearch's row lists 1.x versions. That does not establish current Microsoft 365 SharePoint Online or current Elasticsearch compatibility. Ask for a demonstration against your exact service before commissioning an import.

Windows Share/DFS remains documented using the JCIFS family. Check its dependency and registration in your chosen distribution; the release branch's default connector list omits it. The connector instructions explicitly say the generic File System connector has no native document security beyond manually entered job tokens. Mounting an SMB share and using that connector does not preserve its ACLs.

The release notes also mark JDBC's built-in CSV support deprecated since 2.26; use the separate CSV connector. A connector name on a long list is a starting point for verification, not a current support commitment.

Solr has another version boundary. ManifoldCF's download page lists a Solr 9.x security plugin, version 2.2, dated September 7, 2022. It does not list a Solr 10 plugin. Solr 10's Java 21 requirement, covered in our search tools guide, does not establish plugin compatibility. A provider must choose maintained, compatible releases or quote the work to validate another integration. Do not buy a vulnerable old engine merely to match an old tutorial.

How a document keeps its permissions

Imagine an employee who belongs to the maintenance group but not the partners group. The crawler's service account may read both folders so it can index them. That account's broad visibility must never become the employee's search visibility.

The document security analysis describes access tokens attached to indexed documents and a query modification that restricts matching documents. An authority connector supplies tokens associated with the searching user. These are identifiers used for authorization, not passwords or bearer credentials to hand to a browser. Matching denies win, and every applicable document, parent and share level must permit visibility.

The division of work is:

1. A repository connector reads the document and the permissions the source exposes. Its security model determines what can be preserved.
2. ManifoldCF passes content, metadata and applicable allow and deny tokens through the indexing pipeline. The output connector writes them into the search engine.
3. The search application authenticates the person and maps that identity to the authority service's expected user and domain.
4. The search engine applies the security filter before returning results. Titles, snippets, facets, exports and downstream AI context must stay inside that boundary.

The Solr 9.x integration README specifies six token fields: allow_token_document, deny_token_document, allow_token_parent, deny_token_parent, allow_token_share and deny_token_share. Its example makes them multivalued strings and uses the __nosecurity__ marker for the unrestricted case. Copy the documented schema as a reviewed unit. A missing field is not a reason to improvise a permissive default.

The documented query parser is org.apache.solr.mcf.ManifoldCFQParserPlugin, registered as manifoldCFSecurity. Its AuthorityServiceBaseURL points to the private authority service. The example request handler appends this filter:

fq={!manifoldCFSecurity}

The application supplies AuthenticatedUserName and, where needed, AuthenticatedUserDomain. Those values must come from the authenticated session. A user must not be able to submit the partner's name as a query parameter. The README also describes a search component route; choose and test one complete supported integration rather than mixing pieces.

Appending the filter inside the protected handler matters. Asking browser JavaScript to add it leaves a route for a caller to omit it. Block direct access to Solr and alternative handlers that bypass authorization. Lock down administrative, export and diagnostic routes too. A staff login at the web entrance is not a document permission filter.

Authority responses contain TOKEN: lines and status information. The integration documentation says the token lines drive document security; do not assume a status message alone enforces a denial. Test an unknown user and an unavailable directory. Our acceptance rule is that uncertainty must not produce unrestricted results.

Group changes and file permission changes also travel differently. A removed group membership may be reflected after authority caching expires. A changed document ACL may require a recrawl. Define the maximum acceptable delay, measure both paths, and provide an emergency way to stop search while a revocation catches up.

The security analysis acknowledges a subtler limitation: shared index statistics can affect scoring and potentially reveal information indirectly. A filtered index is not an absolute isolation guarantee. If even the existence of another client's records must remain secret, ask whether separate indexes and application boundaries are required.

Start with a disposable collection

Use synthetic documents before connecting a real client share. Our suggested acceptance collection contains an ordinary procedure, a restricted partner memo and a file with an explicit denial. Give each a distinctive test phrase. Have an authorized reviewer and an ordinary employee account ready; the crawler account is a separate identity.

Run the single process example

Download the 2.31 binary distribution and verify its signature and checksum using the official download instructions. Install Java 25 and set JAVA_HOME to that installation. The current README and deployment guide describe an example directory and a single process containing the web application, agents and embedded HSQLDB.

From the unpacked distribution, use the supplied launcher:

java -version
cd example
./start.sh

Windows uses start.bat. The current README's direct launch alternative is java --enable-preview -jar start.jar. Check the scripts shipped in your chosen archive rather than copying an older command without its preview flag. Open the crawler UI through a private connection on port 8345, at /mcf-crawler-ui. Keep it off the public internet and replace demonstration credentials before allowing anyone else in.

The current README lists the official Docker image apache/manifoldcf:2.31. That is an installation option, not a complete production Compose stack with identity, durable data and backups solved. Confirm the image's runtime, volumes and network bindings before starting it; a container's published port can expose an otherwise private application.

This example proves that the application starts and a connector can run. It does not prove permission enforcement or production capacity. We found no universal production RAM minimum in these instructions. Large files, extraction, crawl state and the index all compete for resources.

Give the ongoing service a database and an owner

For a modest deployment, the deployment guide describes database backed operation, web applications and an agents process. Use a maintained PostgreSQL deployment for crawler state, with the configured database name, credentials and connection settings in protected configuration. Follow the release's initialization and connector registration steps before starting agents. Have the database administrator review the guide's older tuning advice instead of applying it unchanged to modern PostgreSQL.

The web UI manages connections and jobs. The agents process performs collection work. The authority service answers permission lookups. Write down which process supplies each role, how it starts after reboot, and who notices when it stops. Running the UI alone is not evidence that scheduled collection is working.

Our cost example allocates separate hosts to the crawler services, PostgreSQL and Solr. It is an isolation and budgeting choice, not an Apache minimum or a high availability design. A competent provider may consolidate a small pilot after measuring it. One database and one Solr host still mean downtime when either fails.

Put the UI behind a private network or an administrator only Cloudflare Access policy. Our private server guide covers the entrance, recovery route and direct access checks. Keep the crawler UI separate from the employee search portal. Cloudflare's login does not translate users into Active Directory tokens for you.

Build one job and prove the denial

Following the end user guide, create an output connection to the test Solr collection. Create an authority group, assign the authority connection to it, and select that same group on the repository connection for the approved test share. The group namespaces its tokens; changing it later requires reindexing. Select the connector that actually preserves that source's permissions. Give its service account read only rights to the approved scope and no right to modify source documents.

Create a job with a narrow starting location, explicit file rules and the reviewed output pipeline. Run it manually first. Inspect the job history and indexed token fields privately. Confirm that documents excluded by a rule were excluded deliberately, rather than quietly failing extraction.

Now use the actual search application as the ordinary employee. Search the restricted phrase, title and known document identifier. There should be no result, snippet, facet disclosure or downloadable copy. Repeat as the authorized reviewer and confirm the expected result. A blank page caused by a broken index does not pass the negative test.

Remove a group membership, change a file's permissions, delete a file and make the authority service unavailable in the test environment. Record when each change takes effect. Try a forged user parameter and a direct engine request. These tests belong in acceptance before real payroll, client or personnel data enters the index.

Only then add a schedule. Choose a crawl window, connector request limits and a recrawl interval that the source system can tolerate. Monitor failures, last successful collection, queue growth and time since a source change. A successful nightly job can still leave a lunchtime permission revocation exposed too long for your policy.

What this could do in a normal workday

These illustrations use our common $554 to $1,240 monthly operating envelope, plus $1,634 to $4,085 setup and separately quoted integration. That is the three host example below, not a price scaled automatically by headcount. A smaller organization should compare the cost with fixing its existing drive first.

A twelve person law office: staff need the latest filing template and matter correspondence without seeing another client's restricted folder. IT would connect one matter share and map client teams to authority tokens. Each morning staff search their permitted matters rather than asking who saved the file. Check attorney client confidentiality and the firm's ethical duties before copying privileged material into an index or sending it to an AI service.

A nine person accounting firm: junior staff cannot find the approved tax checklist, while partner compensation belongs in a separate folder. The first job would index procedures and synthetic restricted files, then approved client material only after review. Staff see the checklist without a partner memo in its suggestions. Check applicability of the GLBA Safeguards Rule before indexing customer financial information.

An eighteen person property management office: leasing and maintenance teams need different records. A provider would connect approved maintenance libraries while keeping screening and legal records outside the pilot. Dispatchers find the latest appliance instructions during a call. The budget buys shared search infrastructure; cleaning tenant identifiers and permissions is additional work.

A forty person manufacturer: engineers need released drawings while pricing and unfinished designs remain restricted. IT would index an approved drawing library and its permission fields. A technician searches by part identifier and sees the released revision. Confirm extraction actually reads the drawing's usable text; a successful crawl does not establish that scanned annotations or proprietary CAD content became searchable.

A fifteen person medical practice: start with equipment manuals and office procedures that contain no patient information. Staff find a maintenance instruction without searching personal folders. Keep patient records out unless a full HIPAA handling, access, contracting and recovery plan exists. Local hosting alone does not provide that plan, and this budget excludes its assessment.

A school district with sixty staff: connect a staff procedures share while keeping student records outside the initial scope. Teachers find approved forms; restricted personnel material remains hidden. Check FERPA before including education records, and test substitutes, departing employees and staff who work across schools.

A county department with thirty employees: approved policy and purchasing documents could be searched alongside restricted HR and legal libraries through separately tested rules. Staff find the current procedure without receiving another department's personnel file. Check state records retention and public records request rules; a search index is not the official retention system. If law enforcement information is involved, check CJIS requirements before connecting it. No jurisdiction or office is represented by this illustration.

The work that needs IT judgment

Active Directory integration requires agreement on user identifiers, domains, nested groups and denial rules. LDAP is a protocol and directory interface, not a promise that every application's permission model maps cleanly. Test the actual authority and repository pair. Cross domain users and disabled accounts need explicit cases.

SharePoint needs particular care because the published connector compatibility table is old. Match the server edition, authentication and permission behavior; do not assume a connector tested against an older on premises server can use today's cloud authentication. The provider's proposal should name the supported version and show the deny test.

Keep service credentials in protected configuration, rotate them deliberately and record the blast radius of each account. Read only access limits source damage but still permits data copying. Restrict outbound destinations so an indexing process cannot send documents to an unapproved output.

Change control includes the schema and search application, not just the crawler. A developer adding autocomplete, an export handler or AI answers can accidentally create a second route around the filter. Reuse the denial tests after every such change. Tika extracts document text and OpenNLP can add language analysis; neither decides who may receive the result. Our Tika guide and OpenNLP section cover their separate roles.

Three years of costs, including somebody's time

Prices are US dollars before tax. Our series cost method uses $68.09 per hour, from a $47.66 BLS administrator wage divided by a 0.700 compensation wage share. This estimates employee compensation. An outside IT provider bills more; obtain a quote.

Assume twenty search users at both ends of the comparison. Our three host deployment uses three DigitalOcean Basic Regular 8 GiB servers, each with four shared vCPUs and 160 GiB disk, at $48 monthly each. Hosting is $144 monthly. These are pilot sizes, not workload guarantees; index growth or extraction load may require larger machines.

Our retained backup assumptions are 200 GB low and 1,000 GB high across the whole stack. At Backblaze B2's $6.95 per decimal TB monthly, with the first 10 GB free, storage costs $1.3205 or $6.8805 monthly. We assume transfer and requests remain within included allowances. Back up source repositories under their existing plan as well.

Use the shared IT allowance: 24 to 60 setup hours and 6 to 16 administration hours monthly. It covers a bounded supported deployment, updates and recovery checks. Custom connectors, the staff interface, migration, training, compliance reviews and incidents need separate quotes. Existing identity and repository licenses remain on both sides. Setup-period hosting is excluded; add it if you rent machines before the operating period.

Onyx Business publishes $20 per user per month with annual billing. Twenty users cost $400 monthly equivalent, $4,800 annually and $14,400 over 36 months at an unchanged price. It is managed workplace search and AI assistance, not hosted ManifoldCF. Its connector documentation includes permission syncing for Business and requires certificate authentication for SharePoint permission syncing. Confirm your source, plan and identity requirements; OIDC/SAML SSO appears under Enterprise's quoted pricing.

For managed onboarding and routine checks, our additional assumption is 2 to 4 setup hours and 0.5 to 1.5 hours monthly at the same labor rate. This is a planning allowance, not Onyx's service quote. Vendor hosting removes server maintenance, but somebody must still review connectors, access and bills.

Formula: setup hours × $68.09 + 36 × (hosting and backups or subscription + monthly hours × $68.09). Low self hosting is 24 × $68.09 + 36 × ($144 + $1.3205 + 6 × $68.09). Low managed is 2 × $68.09 + 36 × ($400 + 0.5 × $68.09). Calculate before rounding.

Managed wins this modeled operating bill if the Business plan passes your connector and identity tests. A Windows share integration or enterprise authentication requirement could change that conclusion because we have not verified an equivalent priced plan for it. Onyx's SharePoint Online instructions require a broader grant to read permission assignments, list content exclusions and describe scheduled permission updates. Review that grant separately from a read only content account. Its marketing and detailed documentation differ on plan entitlement, so confirm the contract. Neither total includes custom implementation.

Also compare doing nothing new. The supplied browser research verified Microsoft 365 Business Basic at $7 per user monthly, paid yearly, and Google Workspace Business Starter at $7 per user monthly with a one year commitment. Twenty seats are $140 monthly equivalent or $5,040 over 36 months. These are whole suite prices, not additional search fees. If you already pay for the suite and its search meets the need, the incremental search license cost can be zero. File cleanup and permission reviews still take time.

Setup time when Claude or ChatGPT does the typing

Keep the same infrastructure, backups and twenty user comparison. Our IT planning assumptions reduce setup to 65% to 90% of manual hours and administration to 80% to 100%. These are scenarios, not measured ManifoldCF installations. Review occupies 6 to 18 setup hours and 3 to 8 monthly hours within the AI totals; do not add it again. Prompting, testing and correction count as human work. Unattended agent time does not automatically count as labor.

The October 29 research prices Claude Max 5x and ChatGPT Pro 100 at $100 monthly each. Charge one separate setup month, then allocate $50 monthly for 36 operating months only if other work uses the remaining half. Exclusive use adds $1,800. Equal prices do not establish equal allowances or results. Confirm usage limits before starting.

AI total = setup hours × AI setup share × $68.09 + setup tool fee + 36 × (unchanged infrastructure + monthly hours × AI administration share × $68.09 + monthly tool fee).

Our cumulative API budgets are 1 to 5 million setup input tokens and 100,000 to 500,000 output; monthly budgets are 500,000 to 2 million input and 50,000 to 200,000 output. Low input is 30% ordinary, 10% short cache writes and 60% cache reads. High input is uncached. Include retries and billed reasoning, keep each request in the applicable context price band, and deduct no subscription credits.

The Claude rates are $4 ordinary input, $20 output, $5 short cache write and $0.20 cache read per million tokens. The OpenAI rates are $10, $50, $12.50 and $1 respectively. Those produce setup/monthly token charges of $3.82/$1.91 low and $30/$12 high for Claude, or $9.85/$4.925 and $75/$30 for OpenAI. The kit shows the worksheet.

Claude Code or Codex CLI can draft configuration, inspect logs and prepare restoration commands on an authorized server. Desktop Commander can provide terminal and file access; its free local service is our budgeted route. Its command restrictions are not a sandbox. Optional Remote Pro at $20 monthly adds $20 setup and $10 monthly with the same shared allocation, or $380 over this period.

Claude in Chrome can help inspect provider and Cloudflare settings while you watch. ChatGPT's cloud browser uses a separate browser where available. Neither browser supplies the crawler server or decides which employee should see a document.

Use staging, approve commands or restrict a sandbox, keep secrets and private documents out of chat, and watch dashboard actions. Use subscriptions for supervised supported tools and API credentials for custom pipelines. Review changes and test restoration. Our AI access and recovery guide explains the boundary.

AI assistance does not reverse this cost comparison. In the high case, monthly labor stays unchanged, so recurring tool fees consume the setup saving. Subscription assistance becomes more expensive than manual work in month 7; the Claude and OpenAI API cases cross in months 32 and 12. No cited study establishes these assumed savings for Apache administration.

Recovery, updates and the next decision

Back up the crawler database, protected configuration and connector definitions, plus the Solr schema, security plugin configuration and recoverable index state. An exported job list is useful but does not replace the crawl database. Encrypt independent copies and keep recovery credentials available outside the failed server.

Restore into an isolated environment with agents stopped. Verify the database and connections, prevent test jobs from writing to production, and reconcile restored crawl state with the restored index. Then rerun the positive and negative permission tests before serving results. An old backup can restore obsolete permissions as well as old documents.

Before updates, read release notes and security advisories, record the installed Java, crawler, connector, parser and engine versions, and test the proposed combination. Preserve a consistent recovery point. Rollback must account for database and schema changes; replacing a binary alone may not undo an upgrade.

Read the ManifoldCF advisories as well as its security analysis. CVE-2022-45910 affects versions through 2.23: insufficiently validated user and domain arguments can cause LDAP injection in the Active Directory and SharePoint Active Directory authority connectors. The advisory describes extra queries, filter manipulation and denial of service. Upgrade affected installations and validate trusted identity inputs. An advisory list is not proof that every bundled dependency is current.

Follow Solr security, Tika security and ASF security guidance too. Isolate document parsing, cap resources and restrict its network access. An untrusted file can attack a parser before any employee searches for it. Keep real confidential documents out of an AI setup conversation.

For operational confidence, ask a prospective provider to identify the exact supported combination, demonstrate a revoked user's exclusion, restore the database and index, and name who covers an absence. Mailing list help is not an on call contract. The Apache License 2.0 allows commercial use and modification subject to its terms, including distribution notices. It supplies no warranty or general trademark permission.

Download the setup kit

Download the ManifoldCF setup kit for the version checklist, first job, denial tests, recovery plan, provider questions and matching cost worksheet. The practical spending rule behind The $97 Launch fits here: fund one useful result you can test before buying a larger system.

Related reading

• Search and knowledge tools for Answer, Solr, Nutch, ManifoldCF and Tika together.
• Tika document text extraction and private document search with AI answers for the neighboring pieces.
• Apache language and AI tools for OpenNLP's role.
• An Apache stack for a growing business for deciding which components earn their upkeep.
• AI subscriptions, APIs and backups and a private server with Cloudflare Access for supervised setup and access boundaries.

Fact-check notes and sources

Dates below identify documentation observations, not installation tests. All times are UTC. Versions and prices may change; no provider promises the same price for three years. The illustrative organizations, hours, token budgets, hardware and acceptance tests are our assumptions.

1. ManifoldCF home, downloads and documentation index, October 30, 2026, 00:27. The home page labels 2.31 “Java 25 Leap.”
2. Current README, release branch build, launcher options and Dockerfile, October 30, 00:28 to 00:32. Branch source corroborates requirements; it is not an immutable release artifact.
3. Version 2.31 deployment, connector matrix, user guide and concepts, October 30, 00:30. The File System section explicitly limits document security.
4. Connector registration list, JCIFS build and release notes, October 30, 00:30 to 00:32. Packaging and deprecated CSV checks.
5. Solr 9.x integration, October 30, 00:29; document security analysis, 00:28; ManifoldCF advisories, 00:30. Solr 10 compatibility was not established.
6. Solr and Tika security pages, reused October 29 series observations, 21:38 and 21:40; ASF security, October 30, 00:28; Apache license, reused October 29, 21:39.
7. Onyx pricing, October 30, 00:28, browser confirmation 00:29; connector administration, 00:29; SharePoint instructions, 00:30. Pricing says “$20” and “Annual Billing.” The marketing connector page, 00:29, retains conflicting Enterprise-only wording for permission sync.
8. BLS wage, compensation share, DigitalOcean and B2, reused October 29 observations at 21:12, 21:17 and 21:10 respectively.
9. Microsoft 365 and Google Workspace, supplied October 29 and 30 browser research. Google observation time was not supplied. Annual billing terms matter; no checkout was performed here.
10. Claude Max, ChatGPT prices, Claude API and OpenAI API, reused October 29 research, 23:31 except ChatGPT approximately 23:27. OpenAI caching, 23:32. Short writes and reads replace ordinary input charges for those tokens.
11. Codex CLI, October 30, 00:28; Desktop Commander, its pricing, Claude in Chrome and ChatGPT cloud browser, reused October 29, 23:31 to 23:32.
12. HHS HIPAA summary, ABA Model Rule 1.6, FTC Safeguards guide, FERPA and FBI CJIS repository, October 30, 00:29. The ABA source is a model rule; local requirements need review. No state retention period is assumed.

This post is informational, not legal, security or IT consulting advice. Requirements depend on the records, jurisdiction and actual deployment.

Apache, the Apache feather logo and the Apache project names are trademarks of The Apache Software Foundation. This site is not affiliated with or endorsed by the ASF. Other product names are used for identification only.