[SOLR-14216] Exclude HealthCheck from authentication - ASF JIRA

Attach files

Attach Screenshot

Add vote

Voters

Watch issue

Watchers

Create sub-task

Link

Clone

Update Comment Author

Replace String in Comment

Update Comment Visibility

Delete Comments

XML

Word

Printable

JSON

Details

Type: Improvement
Status: Open
Priority: Major
Resolution: Unresolved
Affects Version/s: None
Fix Version/s: None
Component/s: Authentication
Labels:
None

Description

The HealthCheckHandler on /api/node/health and /solr/admin/info/health should by default not be subject to authentication, but be open for all. This allows for load balancers and various monitoring to probe Solr's health without having to support the auth scheme in place. I can't see any reason we need auth on the health endpoint.

It is possible to achieve the same by setting blockUnknown=false and configuring three RBAC permissions: One for v1 endpoint, one for v2 endpoint and one "all" catch all at the end of the chain. But this is cumbersome so better have this ootb.

An alternative solution is to create a separate HttpServer for health check, listening on a different port, just like embedded ZK and JMX.