[SOLR-13344] Admin UI inaccessible with RuleBasedAuthorizationPlugin

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 7.7, 8.0
• Fix Version/s: 7.7.2, 8.1
• Component/s: Admin UI, Authentication
• Assignee: Jan Høydahl
• Reporter: Märt
• Created: 24/Mar/19 10:52
• Updated: 08/Jun/19 15:01
• Resolved: 04/Apr/19 14:48

Description

SOLR-7896 made some changes to the admin ui login. After the changes I can no longer log in at all.

I'm running standalone solr 7.7 (same with 8.0) with the following security.json:

{
  "authentication": {
    "class": "solr.BasicAuthPlugin",
    "blockUnknown": true,
    "credentials": {
      "solr": "IV0EHq1OnNrj6gvRCwvFwTrZ1+z1oBbnQdiVC3otuq0= Ndd7LKvVBAaZIF0QAVi1ekCfAJXr1GGfLtRUXhgrF8c="
    },
  },
  "authorization": {
    "class": "solr.RuleBasedAuthorizationPlugin",
    "permissions": [
      {
        "name": "all",
        "role": "admin"
      }
    ],
    "user-role": {
      "solr": "admin"
    }
  }
}

Opening the UI at http://localhost:8080/solr/ shows an error page with 401. The login page is not displayed because of the "all" permission being required. The browser's basic auth popup is not shown because the WWW-Authenticate header is not present. Changing the RuleBasedAuthorizationPlugin required permission from "all" to "security-edit" makes the login page appear.

The bug can be reproduced as follows:

1. unpack solr-8.0.0.zip
2. copy the security.json example from https://lucene.apache.org/solr/guide/7_7/basic-authentication-plugin.html into server/solr/ and replace "name":"security-edit" with "name":"all"
3. start with bin/solr -f -p 8080
4. open http://localhost:8080/

The bug was discussed on solr-user list http://mail-archives.apache.org/mod_mbox/lucene-solr-user/201903.mbox/%3C7629BDDD-3D22-4203-9188-0E0A8DCF2FEE%40cominvent.com%3E

Issue Links

• is related to: SOLR-13364 Make Admin UI aware of logged-in users permissions
• relates to: SOLR-7896 Add a login page for Solr Administrative Interface
• links to: GitHub Pull Request #630