There are basically two approaches you could choose to implement this:

1. You apply security after the search, i.e. filter the search results. Instead of returning your search results directly, you process the documents found through your 'normal' security layer and filter out those that are inaccessible.


2. You specify security information as part of the query. If you have a 'role-based' security model, add a field to all indexed documents for each role that is allowed to access it and define a wildcard for 'open/unsecured' documents. When searching, dynamically expand all security roles for a particular user, add the wildcard role and perform your search, including the security query.

If you have a predefined set of security roles, go for the second implementation. First of all this performs amazingly well in Lucene and does not require any additional filtering on your part. Secondly, you get only the results you expected to find; this enabled result-paging and other features that do not combine well with filtering.

One drawback is that you will have to re-index all documents in case your security role structure changes!