Uploaded image for project: 'Solr'
  1. Solr
  2. SOLR-12131

Authorization plugin support for getting user's roles from the outside

    XMLWordPrintableJSON

    Details

    • Type: New Feature
    • Status: Reopened
    • Priority: Major
    • Resolution: Later
    • Affects Version/s: None
    • Fix Version/s: None
    • Component/s: security
    • Labels:
      None

      Description

      Currently the RuleBasedAuthorizationPlugin relies on explicitly mapping users to roles. However, when users are authenticated by an external Identity service (e.g. JWT as implemented in SOLR-12121), that external service keeps track of the user's roles, and will pass that as a "claim" in the token (JWT).

      In order for Solr to be able to Authorise requests based on those roles, the Authorization plugin should be able to accept (verified) roles from the request instead of explicit mapping.

      Suggested approach is to create a new interface VerifiedUserRoles and a PrincipalWithUserRoles which implements the interface. The Authorization plugin can then pull the roles from request. By piggy-backing on the Principal, we have a seamless way to transfer extra external information, and there is also a natural relationship:

      User Authentication -> Role validation -> Creating a Principal

      I plan to add the interface, the custom Principal class and restructure RuleBasedAuthorizationPlugin in an abstract base class and two implementations: RuleBasedAuthorizationPlugin (as today) and a new ExternalRoleRuleBasedAuthorizationPlugin.

        Attachments

          Issue Links

            Activity

              People

              • Assignee:
                janhoy Jan Høydahl
                Reporter:
                janhoy Jan Høydahl
              • Votes:
                0 Vote for this issue
                Watchers:
                2 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved:

                  Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0h
                  0h
                  Logged:
                  Time Spent - 50m
                  50m