[SOLR-9399] Delete requests do not send credentials & fails for Basic Authentication

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 6.0, 6.0.1
• Fix Version/s: 7.4, 8.0
• Component/s: SolrJ
• Labels: security
• Assignee: Erick Erickson
• Reporter: Susheel Kumar
• Created: 09/Aug/16 15:58
• Updated: 26/Nov/19 20:42
• Resolved: 02/Apr/18 16:31

Description

The getRoutes(..) func of UpdateRequest do not pass credentials to LBHttpSolrClient when deleteById is set while for updates it passes the credentials. See below code snippet

if (deleteById != null) {

Iterator<Map.Entry<String,Map<String,Object>>> entries = deleteById.entrySet()
.iterator();
while (entries.hasNext()) {

Map.Entry<String,Map<String,Object>> entry = entries.next();

String deleteId = entry.getKey();
Map<String,Object> map = entry.getValue();
Long version = null;
if (map != null)

{ version = (Long) map.get(VER); }

Slice slice = router.getTargetSlice(deleteId, null, null, null, col);
if (slice == null)

{ return null; }
List<String> urls = urlMap.get(slice.getName());
if (urls == null) { return null; }

String leaderUrl = urls.get(0);
LBHttpSolrClient.Req request = routes.get(leaderUrl);
if (request != null)

{ UpdateRequest urequest = (UpdateRequest) request.getRequest(); urequest.deleteById(deleteId, version); }

else

{ UpdateRequest urequest = new UpdateRequest(); urequest.setParams(params); urequest.deleteById(deleteId, version); urequest.setCommitWithin(getCommitWithin()); request = new LBHttpSolrClient.Req(urequest, urls); routes.put(leaderUrl, request); }

}
}

Issue Links

• is duplicated by: SOLR-10530 Basic Authentication Plugin blockUnknown HTTP ERROR 401 require authentication
• is duplicated by: SOLR-11885 Solrj client deleteByIds handle route request miss wrap basic auth credentials
• is duplicated by: SOLR-12049 Solrj doesn't pass basic auth for delete requests
• is duplicated by: SOLR-12503 SolrJ deleteById doesn't work when authentication is active.
• is related to: SOLR-12161 CloudSolrClient with basic auth enabled will update even if no credentials supplied
• links to: GitHub Pull Request #69
• links to: GitHub Pull Request #69
• links to: GitHub Pull Request #161