[SOLR-12161] CloudSolrClient with basic auth enabled will update even if no credentials supplied

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 7.3
• Component/s: Authentication
• Assignee: Noble Paul
• Reporter: Erick Erickson
• Created: 29/Mar/18 05:03
• Updated: 08/Jun/19 15:15

Description

This is an offshoot of SOLR-9399. When I was writing a test, if I create a cluster with basic authentication set up, I can still add documents to a collection even without credentials being set in the request.

However, simple queries, commits etc. all fail without credentials set in the request.

I'll attach a test class that illustrates the problem.

If I use a new HttpSolrClient instead of a CloudSolrClient, then the update request fails as expected.

Noble Paul do you have any insight here? Possibly something with splitting up the update request to go to each individual shard?

Issue Links

• duplicates: SOLR-9804 Rule-Based Authorization Plugin does not secure access for update operations
• relates to: SOLR-9399 Delete requests do not send credentials & fails for Basic Authentication