[SOLR-12161] CloudSolrClient with basic auth enabled will update even if no credentials supplied

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 7.3
• Component/s: Authentication
• Assignee: Noble Paul
• Reporter: Erick Erickson
• Created: 29/Mar/18 05:03
• Updated: 08/Jun/19 15:15

Description

This is an offshoot of SOLR-9399. When I was writing a test, if I create a cluster with basic authentication set up, I can still add documents to a collection even without credentials being set in the request.

However, simple queries, commits etc. all fail without credentials set in the request.

I'll attach a test class that illustrates the problem.

If I use a new HttpSolrClient instead of a CloudSolrClient, then the update request fails as expected.

noblepaul do you have any insight here? Possibly something with splitting up the update request to go to each individual shard?

Issue Links

• duplicates: SOLR-9804 Rule-Based Authorization Plugin does not secure access for update operations
• relates to: SOLR-9399 Delete requests do not send credentials & fails for Basic Authentication