[SOLR-11623] Every request handler in Solr should implement PermissionNameProvider interface

• Type: Improvement
• Status: Closed
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: 7.1
• Fix Version/s: 9.0
• Assignee: Jan Høydahl
• Reporter: Hrishikesh Gadre
• Created: 08/Nov/17 17:57
• Updated: 12/May/22 00:26
• Resolved: 14/Jan/22 15:48

Description

Solr authorization framework expects request handler to implement PermissionNameProvider interface so that the type of the permission for the request can be extracted. Currently not all request handlers implement PermissionNameProvider, requiring authorization plugin implementation to check this case explicitly and return OK. During code review of SENTRY-1475, this issue was discussed. Since PermissionNameProvider.Name enum provides "ALL" permission type, it should be possible to have every request handler to implement PermissionNameProvider interface and provide "ALL" permission type if no authorization checks are necessary.

The secondary benefit of this work would be that we can review all the request handlers and ensure that we aren't missing authorization support for any request handlers which provide sensitive information.

Issue Links

• duplicates: SOLR-10100 Hiding credentials from security.json when retrieving through /admin/zookeeper
• is related to: SOLR-7890 By default require admin rights to access /security.json in ZK
• is required by: SOLR-15776 Make Admin UI play well with Authorization
• links to: GitHub Pull Request #372
• links to: GitHub Pull Request #427