[SOLR-12121] JWT Authentication plugin

• Type: New Feature
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 8.1
• Component/s: Authentication
• Assignee: Jan Høydahl
• Reporter: Jan Høydahl
• Created: 19/Mar/18 09:43
• Updated: 08/Jun/19 15:14
• Resolved: 12/Apr/19 08:14

Description

A new Authentication plugin that will accept a Json Web Token (JWT) in the Authorization header and validate it by checking the cryptographic signature. The plugin will not perform the authentication itself but assert that the user was authenticated by the service that issued the JWT token.

JWT defined a number of standard claims, and user principal can be fetched from the sub (subject) claim and passed on to Solr. The plugin will always check the exp (expiry) claim and optionally enforce checks on the iss (issuer) and aud (audience) claims.

The first version of the plugin will only support RSA signing keys and will support fetching the public key of the issuer through a Json Web Key (JWK) file, either from a https URL or from local file.

Issue Links

• contains: SOLR-12131 Authorization plugin support for getting user's roles from the outside
• is depended upon by: SOLR-13070 Add JWT Auth support in SolrJ
• is depended upon by: SOLR-13071 Add JWT Auth support in bin/solr
• is related to: SOLR-12131 Authorization plugin support for getting user's roles from the outside
• relates to: SOLR-12791 Add Metrics reporting for AuthenticationPlugin
• requires: SOLR-12799 Allow Authentication Plugins to easily intercept internode requests
• links to: GitHub Pull Request #343
• links to: GitHub Pull Request #343
• links to: GitHub Pull Request #645