Uploaded image for project: 'Solr'
  1. Solr
  2. SOLR-13619

Kerberos: 403 when node doesn't host collection

    XMLWordPrintableJSON

    Details

    • Type: Improvement
    • Status: Closed
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: 8.2
    • Component/s: None
    • Labels:
      None

      Description

      This is a spin off from SOLR-13472, specifically to tackle the Kerberos case. Here's the security.json to reproduce the same problem as of SOLR-13472:

      {
       "authentication": {"class": "org.apache.solr.security.KerberosPlugin"},
       "authorization": {
         "class": "solr.RuleBasedAuthorizationPlugin",
         "permissions": [
           {
             "name": "read",
             "role": "*"
           },
           {
             "name": "update",
             "role": [
               "indexer",
               "admin"
             ]
           },
           {
             "name": "all",
             "role": "admin"
           }
         ],
         "user-role": {
           "HTTP/solr1@EXAMPLE.COM": "admin",
           "HTTP/solr2@EXAMPLE.COM": "admin",
           "client@EXAMPLE.COM": "indexer"
         }
       }
      }
      

      Here, client@EXAMPLE.COM should be able to issue /update and /select requests to both solr1 and solr2, but it throws 403 for the node that doesn't host the collection.

        Attachments

        1. SOLR-13619.patch
          13 kB
          Ishan Chattopadhyaya

          Issue Links

            Activity

              People

              • Assignee:
                ichattopadhyaya Ishan Chattopadhyaya
                Reporter:
                ichattopadhyaya Ishan Chattopadhyaya
              • Votes:
                0 Vote for this issue
                Watchers:
                4 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved:

                  Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0h
                  0h
                  Logged:
                  Time Spent - 10m
                  10m