[SOLR-15626] config-read permission does not allow access to /solr/admin/configs?action=LIST

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 8.8
• Fix Version/s: 9.0, 8.11
• Component/s: Authorization
• Assignee: Eric Pugh
• Reporter: Jonathan J Senchyna
• Created: 13/Sep/21 15:05
• Updated: 17/Nov/21 14:22
• Resolved: 07/Oct/21 14:38

Description

Overview

The /solr/admin/configs?action=LIST endpoint is not available when the user has the config-read permission.

Steps to Reproduce

1. Create a security.json file that defines:
   1. a user with the config-read permission, but not the all permission.
   2. a separate user with the all permission
2. Using the first user, attempt to hit the /solr/admin/configs?action=LIST endpoint

Expected
The user is able to access the endpoint.
Actual
The request fails with a 403 and the following is logged:

This resource is configured to have a permission {
   "name":"all",
   "role":"admin"}

Workaround

The following can be added to the security.json file to provide the required permission to the desired roles:

{
    "name": "list-configsets",
    "role": ["someRole"],
    "collection": null,
    "path": "/admin/configs",
    "params": {
        "action": ["LIST"]
     }
}

Suggested fix

I believe the issue is that the config-read permission is configured with only the "*" collection, but it should have "*" and null like the config-edit permission to allow it to be applied to routes that are not tied to a collection (e.g. solr/admin/configs?action=LIST).
https://github.com/apache/solr/blob/main/solr/core/src/java/org/apache/solr/security/PermissionNameProvider.java#L44-L45

Issue Links

• links to: GitHub Pull Request #296