[SOLR-16527] RuleBasedAuthorizationPluginBase NPE

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 9.1
• Fix Version/s: 9.1, main (10.0)
• Component/s: Authorization
• Assignee: Kevin Risden
• Reporter: Alex Deparvu
• Created: 07/Nov/22 19:04
• Updated: 25/Jan/23 16:15
• Resolved: 08/Nov/22 01:19

Description

I set up a SolrCloud with 2 nodes and enabled basic auth following the Solr guide (https://solr.apache.org/guide/solr/latest/deployment-guide/basic-authentication-plugin.html#enable-basic-authentication).

ERROR (qtp1527086220-49) [] o.a.s.h.RequestHandlerBase java.lang.NullPointerException => java.lang.NullPointerException
at org.apache.solr.security.RuleBasedAuthorizationPluginBase.getPermissionNamesForRoles(RuleBasedAuthorizationPluginBase.java:123)
java.lang.NullPointerException: null
at org.apache.solr.security.RuleBasedAuthorizationPluginBase.getPermissionNamesForRoles(RuleBasedAuthorizationPluginBase.java:123) ~[?:?]
at org.apache.solr.handler.admin.SystemInfoHandler.getSecurityInfo(SystemInfoHandler.java:342) ~[?:?]
at org.apache.solr.handler.admin.SystemInfoHandler.handleRequestBody(SystemInfoHandler.java:153) ~[?:?]

Logs seen on the Solr node originating the request:

2022-11-04 09:26:46.251 INFO  (qtp1658512704-126) [] o.a.s.s.HttpSolrCall [admin] webapp=null path=/admin/info/system params={wt=javabin&version=2&_=1667579206203} status=0 QTime=1
2022-11-04 09:26:46.259 WARN  (qtp1658512704-81) [] o.a.s.h.a.AdminHandlersProxy Exception when fetching result from node localhost:6564_solr => java.util.concurrent.ExecutionException: org.apache.solr.client.solrj.impl.BaseHttpSolrClient$RemoteSolrException: Error from server at http://localhost:6564/solr: java.lang.NullPointerException
at org.apache.solr.security.RuleBasedAuthorizationPluginBase.getPermissionNamesForRoles(RuleBasedAuthorizationPluginBase.java:126)
java.util.concurrent.ExecutionException: org.apache.solr.client.solrj.impl.BaseHttpSolrClient$RemoteSolrException: Error from server at http://localhost:6564/solr: java.lang.NullPointerException

 

I believe the reason is the 'roles' set is null on inter-node requests so this method will throw a NPE https://github.com/apache/solr/blob/26195c82493422cb9d6d4bdf9d4452046e7b3f67/solr/core/src/java/org/apache/solr/security/RuleBasedAuthorizationPluginBase.java#L122

 

It looks like this was introduced with following commit for SOLR-15776 https://github.com/apache/solr/commit/a1406847ba256965e636e05b11e53c0ac696e2a9#diff-83579b1681fbe3ea47f7340796963b034594921405afb41c62d9415f52f5adcfR356

Issue Links

• is broken by: SOLR-15776 Make Admin UI play well with Authorization
• links to: GitHub Pull Request #1164