[SOLR-13619] Kerberos: 403 when node doesn't host collection

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 8.2
• Assignee: Ishan Chattopadhyaya
• Reporter: Ishan Chattopadhyaya
• Created: 11/Jul/19 00:37
• Updated: 26/Jul/19 09:01
• Resolved: 15/Jul/19 12:40

Description

This is a spin off from SOLR-13472, specifically to tackle the Kerberos case. Here's the security.json to reproduce the same problem as of SOLR-13472:

{
 "authentication": {"class": "org.apache.solr.security.KerberosPlugin"},
 "authorization": {
   "class": "solr.RuleBasedAuthorizationPlugin",
   "permissions": [
     {
       "name": "read",
       "role": "*"
     },
     {
       "name": "update",
       "role": [
         "indexer",
         "admin"
       ]
     },
     {
       "name": "all",
       "role": "admin"
     }
   ],
   "user-role": {
     "HTTP/[e-mail]": "admin",
     "HTTP/[e-mail]": "admin",
     "[e-mail]": "indexer"
   }
 }
}

Here, [e-mail] should be able to issue /update and /select requests to both solr1 and solr2, but it throws 403 for the node that doesn't host the collection.

Issue Links

• relates to: SOLR-13480 Collection creation failure when using Kerberos authentication combined with rule-base authorization
• links to: GitHub Pull Request #773