[
https://issues.apache.org/jira/browse/SOLR-13097?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18122110#comment-18122110
]
Nick Shanin commented on SOLR-13097:
------------------------------------
🤖 AI text below 🤖 (posted on behalf of Nick Shanin)
I opened a PR for this: https://github.com/apache/solr/pull/5016
HttpSolrCall now puts the serving core's name in the authorization context's
collection list in standalone mode, where the list was previously empty, so
authorization rules scoped through the "collection" field can match a core in
standalone deployments. Cloud behavior is unchanged.
CoreScopedAuthStandaloneTest covers the standalone case.
> RuleBasedAuthorizationPlugin is not fully fonctionnal in Solr standalone mode
> -----------------------------------------------------------------------------
>
> Key: SOLR-13097
> URL: https://issues.apache.org/jira/browse/SOLR-13097
> Project: Solr
> Issue Type: Bug
> Components: Authentication
> Affects Versions: 6.6.5, 7.5
> Environment: Solr standalone
> Reporter: Dominique Béjean
> Priority: Major
> Labels: pull-request-available
> Time Spent: 10m
> Remaining Estimate: 0h
>
> In Solr standalone mode, the collections element of the request context is
> not populated by the core name.
> For instance, the following request:
> {code:java}
> http://user1:xxxxxx@localhost:8983/solr/biblio/select?indent=on&q=*:*&wt=json{code}
> reports this in log:
> {code:java}
> 2018-12-30 12:24:52.102 INFO (qtp1731656333-20) [ x:biblio]
> o.a.s.s.HttpSolrCall USER_REQUIRED auth header Basic Mjox context :
> userPrincipal: [[principal: 2]] type: [READ], collections: [], Path:
> [/select] path : /select params :q=:&indent=on&wt=json{code}
> The consequence is that RuleBasedAuthorizationPlugin is not able to apply
> this kind of permission:
> {code:java}
> {"name":"read-biblio",
> "path":"/select",
> "role":["admin","read","r1"],
> "collection":"biblio",
> "index":2}{code}
> In Solrcloud mode in the init() method of HttpSolrCall.java, the collections
> element is populated with either the collection name matching the core name
> in the request or the collection names provided in the collection parameter.
> {code:java}
> if (cores.isZooKeeperAware()) {
> Â Â // init collectionList (usually one name but not when there are aliases)
> Â Â String def = core != null ? core.getCoreDescriptor().getCollectionName()
> : origCorename;
> Â Â collectionsList =
> resolveCollectionListOrAlias(queryParams.get(COLLECTION_PROP, def)); //
> &collection= takes precedence
> ...
> }{code}
> Â
> I expect init() method could be improved in order to populate collections
> element with the core name for Solr standalone mode.
> Â
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
