Uploaded image for project: 'Solr'
  1. Solr
  2. SOLR-13619

Kerberos: 403 when node doesn't host collection

Attach filesAttach ScreenshotVotersWatch issueWatchersCreate sub-taskLinkCloneUpdate Comment AuthorReplace String in CommentUpdate Comment VisibilityDelete Comments
    XMLWordPrintableJSON

    Details

    • Type: Improvement
    • Status: Closed
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: 8.2
    • Component/s: None
    • Labels:
      None

      Description

      This is a spin off from SOLR-13472, specifically to tackle the Kerberos case. Here's the security.json to reproduce the same problem as of SOLR-13472:

      {
       "authentication": {"class": "org.apache.solr.security.KerberosPlugin"},
       "authorization": {
         "class": "solr.RuleBasedAuthorizationPlugin",
         "permissions": [
           {
             "name": "read",
             "role": "*"
           },
           {
             "name": "update",
             "role": [
               "indexer",
               "admin"
             ]
           },
           {
             "name": "all",
             "role": "admin"
           }
         ],
         "user-role": {
           "HTTP/solr1@EXAMPLE.COM": "admin",
           "HTTP/solr2@EXAMPLE.COM": "admin",
           "client@EXAMPLE.COM": "indexer"
         }
       }
      }
      

      Here, client@EXAMPLE.COM should be able to issue /update and /select requests to both solr1 and solr2, but it throws 403 for the node that doesn't host the collection.

        Attachments

        Issue Links

          Activity

            People

            • Assignee:
              ichattopadhyaya Ishan Chattopadhyaya
              Reporter:
              ichattopadhyaya Ishan Chattopadhyaya

              Dates

              • Created:
                Updated:
                Resolved:

                Time Tracking

                Estimated:
                Original Estimate - Not Specified
                Not Specified
                Remaining:
                Remaining Estimate - 0h
                0h
                Logged:
                Time Spent - 10m
                10m

                  Issue deployment