Uploaded image for project: 'Solr'
  1. Solr
  2. SOLR-15233

ConfigurableInternodeAuthHadoopPlugin with authorization is broken

    XMLWordPrintableJSON

    Details

      Description

      Setting up a cluster with multiple solr nodes with Kerberos using it for internode communication as well (attached security.json) and added Ranger as authorization plugin.

      When sending requests the authentication happens against the end user but the authorization is for solr service user.

      Tested two cases (3 nodes, have a collection with 2 replicas on 2 nodes of it):
      1. send a query to a node where the collection has replica. Authorization is wrong every nodes

      2. send a query to a node which doesn't contain a replica. The first place authorization is fine but when the query distributed it goes as solr service user issued.

        Attachments

        1. SOLR-15233-reproducing-unit-test.patch
          12 kB
          Jason Gerlowski
        2. SOLR-15233.5.patch
          33 kB
          Mike Drob
        3. SOLR-15233.4.patch
          23 kB
          Mike Drob
        4. SOLR-15233.3.patch
          21 kB
          Mike Drob
        5. SOLR-15233.2.patch
          15 kB
          Mike Drob
        6. SOLR-15233_Enable_delegation_tokens.patch
          0.9 kB
          Geza Nagy
        7. solr-15233_Adding_doAs_to_requests_in_CIAHP.patch
          4 kB
          Geza Nagy
        8. security.json
          2 kB
          Geza Nagy
        9. Screenshot 2021-03-09 at 18.15.31.png
          335 kB
          Geza Nagy
        10. admin-ui-doAs.png
          20 kB
          Geza Nagy
        11. 0001-SOLR-15233-Add-negative-test-case-for-KRB-Authz.patch
          6 kB
          Mike Drob

          Activity

            People

            • Assignee:
              mdrob Mike Drob
              Reporter:
              gezan Geza Nagy
            • Votes:
              0 Vote for this issue
              Watchers:
              7 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved: