Hi,
I reply to myself.
I had to go in debug mode in order to see that Set<String> userRoles =
getUserRoles(principal); was returning null due to the fact the username
attribute in the principal was the keycloak user uuid (the default sub
attribute value) and not the preferred_username.
I fixed this in security.json, by adding "principalClaim":
"preferred_username" in the authentication settings.
{
"authentication":{
"blockUnknown": true,
"class":"solr.JWTAuthPlugin",
"principalClaim": "preferred_username
...
Dominique
Le sam. 2 avr. 2022 à 15:15, Dominique Bejean <dominique.bej...@eolya.fr> a
écrit :
> Hi,
>
> I am testing JWT Authentication Plugin with a keycloak IPD.
>
>
> Rule-Based Authorization Plugins deny access to some Solr end points.
> According to logs, I don't understand why.
>
> For example, in this log line we see that
> requested role are either "solr", "solr:admin", "consoleread"
> user roles are [profile, solr, admin, email]
>
> The determineIfPermissionPermitsPrincipal method in
> RuleBasedAuthorizationPluginBase.java should allow access.
>
> Set<String> userRoles = getUserRoles(principal);
> for (String role : governingPermission.role) {
> if (userRoles != null && userRoles.contains(role)) {
> log.debug("Governing permission [{}] allows access to role [{}];
> permitting access", governingPermission, role);
> return MatchStatus.PERMITTED;
> }
> }
> log.info("This resource is configured to have a permission {}, The
> principal {} does not have the right role ", governingPermission,
> principal);
> return MatchStatus.FORBIDDEN;
>
> governingPermission.role = "solr", "solr:admin", "consoleread"
> userRoles = profile, solr, admin, email
>
> "solr" role should match !?
>
>
> 2022-04-02 12:33:12.693 INFO (qtp1406253491-27) [ ]
> o.a.s.s.RuleBasedAuthorizationPluginBase This resource is configured to
> have a permission {
> "collection":null,
> "path":[
> "/admin/info",
> "/admin/info/threads",
> "/admin/info/system",
> "/admin/info/properties"],
> "role":[
> "solr",
> "solr:admin",
> "consoleread"],
> "index":7}, The principal
> JWTPrincipalWithUserRoles{username='89c48f69-eead-44ee-bf37-741e2d661b77',
> token='*****', claims={exp=1648903285, iat=1648902385,
> auth_time=1648902256, jti=1838b4df-801a-410e-903a-f4b9ced085fc, iss=
> https://localhost:8443/auth/realms/solr,
> sub=89c48f69-eead-44ee-bf37-741e2d661b77, typ=Bearer, azp=solr-app,
> nonce=25kzdeinhb9dqflogqy4id8a8zmiyvpkg,
> session_state=34ed4051-8cc1-45da-a25e-67054087af34, acr=0,
> realm_access={roles=[solr:admin]},
> resource_access={solr-app={roles=[solr:admin]}}, scope=openid profile solr
> admin email, sid=34ed4051-8cc1-45da-a25e-67054087af34, email_verified=true,
> preferred_username=solradmin, given_name=, family_name=}, roles=[profile,
> solr, admin, email]} does not have the right role
>
> Any suggestions ?
>
> Regards
>
> Dominique
>
>
