[SOLR-14711] Incorrect insecure settings check in CoreContainer

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Duplicate
• Assignee: Unassigned
• Reporter: Mark Todd
• Created: 06/Aug/20 07:21
• Updated: 19/Aug/20 21:26
• Resolved: 13/Aug/20 20:46

Description

I've configured SolrCloud (8.5) with both SSL and Authentication which is working correctly. However, I get the following warning in the logs
 
"Solr authentication is enabled, but SSL is off. Consider enabling SSL to protect user credentials and data with encryption"
 
Looking at the source code for SolrCloud there appears to be a bug
if (authenticationPlugin !=null && StringUtils.isNotEmpty(System.getProperty("solr.jetty.https.port")))

{ log.warn("Solr authentication is enabled, but SSL is off.  Consider enabling SSL to protect user credentials and data with encryption."); }

 
Rather than checking for an empty system property (which would indicate SLL is off) its checking for a populated one which is what you get when SSL is on.

This is a major issue because administrators are very concerned that Solr has been deployed in an insecure fashion.

Issue Links

• duplicates: SOLR-14748 Correct SSL/Auth startup warning