[SOLR-14430] Authorization plugins should check roles from request - ASF JIRA

Attach files

Attach Screenshot

Add vote

Voters

Watch issue

Watchers

Create sub-task

Link

Clone

Update Comment Author

Replace String in Comment

Update Comment Visibility

Delete Comments

XML

Word

Printable

JSON

Details

Type: Improvement
Status: Open
Priority: Major
Resolution: Unresolved
Affects Version/s: None
Fix Version/s: None
Component/s: security
Labels:
None

Description

The AuthorizationContext exposes getUserPrincipal to the plugin, but it does not allow the plugin to interrogate the request for isUserInRole. If we trust the request enough to get a principal from it, then we should trust it enough to ask about roles, as those could have been defined and verified by an authentication plugin.

This model would be an alternative to the current model where RuleBasedAuthorizationPlugin maintains its own user->role mapping.