epugh commented on code in PR #5306:
URL: https://github.com/apache/solr/pull/5306#discussion_r4539375784
##########
solr/core/src/java/org/apache/solr/cli/RunExampleTool.java:
##########
@@ -597,20 +628,501 @@ void initDirs(
String solrHomeProp = EnvUtils.getProperty("solr.home");
if (solrHomeProp != null && !solrHomeProp.isEmpty()) {
solrHomeDir = Path.of(solrHomeProp);
- } else if ("cloud".equals(exampleType)) {
- solrHomeDir = exampleDir.resolve("cloud");
+ } else if ("cloud".equals(exampleType) || "secure".equals(exampleType)) {
+ solrHomeDir = exampleDir.resolve(exampleType);
if (!Files.isDirectory(solrHomeDir))
Files.createDirectory(solrHomeDir);
} else {
solrHomeDir = serverDir.resolve("solr");
}
}
+ if ("secure".equals(exampleType)) Files.createDirectories(solrHomeDir);
if (!Files.isDirectory(solrHomeDir))
throw new IllegalArgumentException(
"Value of --solr-home option is invalid! "
+ solrHomeDir.toAbsolutePath()
+ " is not a directory!");
}
+ /** Runs the equivalent steps of the Ref Guide security tutorial */
+ void runSecureExample(CloudExampleParams params, boolean userManaged) throws
Exception {
+ StartSolrParams start = params.start();
+ if (userManaged || params.zkHost() != null) {
+ throw new IllegalArgumentException(
+ "The secure example requires its own embedded ZooKeeper in SolrCloud
mode.");
+ }
+ if (start.host() != null
+ || start.jvmOpts() != null
+ || !start.extraArgs().isEmpty()
+ || params.scriptInputs() != null
+ || System.getenv("SOLR_DATA_HOME") != null) {
+ throw new IllegalArgumentException(
+ "Unsupported secure example option. Use --solr-home, -p,
--no-prompt, -m, or --force.");
+ }
+ int port = params.basePort();
+ Path home = solrHomeDir.toAbsolutePath().normalize();
+ echo(
+ "Commands below use paths relative to "
+ + serverDir.getParent().toAbsolutePath().normalize());
+ Path tls = home.resolve("tls");
+ Path include = tls.resolve("solr.in.sh");
+ String zkHost = "localhost:" + (port + 1000);
+ Map<String, String> environment = new
HashMap<>(EnvironmentUtils.getProcEnvironment());
+ environment.put("SOLR_INCLUDE", include.toString());
+ environment.put("SOLR_ULIMIT_CHECKS", "false");
+ environment.put("SOLR_PID_DIR", home.toString());
+ environment.put("SOLR_HOME", tls.toString());
+ environment.remove("SOLR_ZK_CREDS_AND_ACLS");
+ environment.remove("ZK_HOST");
+ echo("This example uses 'SolrRocks' for its keystore and demonstration
accounts.");
+ echo("ZooKeeper is protected by digest ACLs; its transport remains
plaintext on loopback.");
+ if (!params.noPrompt()) {
+ prompt(
+ new Scanner(userInput, StandardCharsets.UTF_8),
+ "Press Enter to delete and recreate "
+ + secureExampleDisplayArgument(home.toString())
+ + ", or Ctrl-C to cancel: ",
+ "");
+ }
+ resetSecureExampleHome(home, environment);
+ Files.setPosixFilePermissions(home,
PosixFilePermissions.fromString("rwx------"));
+ Files.createDirectories(tls);
+ Files.setPosixFilePermissions(tls,
PosixFilePermissions.fromString("rwx------"));
+ for (String node : List.of("node1", "node2")) {
+ Path nodeHome =
Files.createDirectories(home.resolve(node).resolve("solr"));
+ for (String file : List.of("solr.xml", "zoo.cfg")) {
+ Files.copy(serverDir.resolve("solr").resolve(file),
nodeHome.resolve(file));
+ }
+ }
+ writeSecureExampleFile(
+ include,
+ String.format(
+ Locale.ROOT,
+ """
+ SOLR_ULIMIT_CHECKS=false
+ SOLR_HOST_BIND=127.0.0.1
+ SOLR_HOST_ADVERTISE=127.0.0.1
+ SOLR_PID_DIR=%s
+ SOLR_OPTS=%s
+ """,
+ secureExampleShellQuote(home.toString()),
+ secureExampleShellQuote("-Dsolr.security.allow.paths=" + home)));
+ boolean ready = false;
+ try {
+ echo("\n");
+ echo("1. Start both nodes and configure the shared SolrCloud URL scheme
to https.");
Review Comment:
I want to do the tutorial once in my life.., but I want to test and play
and demo a secure Solr every day. Also I hope the tutorial helps us
undrrrstsmd how clunky security is right now
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
