[SOLR-15194] JWTIssuerConfig only allows HTTPS urls, not HTTP, which is overly strict.

• Type: Improvement
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 9.0, 8.8.1
• Fix Version/s: 9.0, 8.9
• Component/s: security
• Assignee: Eric Pugh
• Reporter: Eric Pugh
• Created: 24/Feb/21 18:42
• Updated: 23/Jun/21 13:42
• Resolved: 27/Feb/21 14:26

Description

Setting up JWT should always be done with HTTPS urls, but especially in dev and test, require HTTPS is too much.  

Let Solr relax a bit, and log a warning if the url is HTTP versus HTTPS.

 

Keycloak, out of the box for example doesn't have SSL enabled.

Issue Links

• links to: GitHub Pull Request #2430