[SOLR-15233] ConfigurableInternodeAuthHadoopPlugin with authorization is broken

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 8.4.1
• Fix Version/s: 9.0, 8.8.2, 8.9
• Component/s: Authentication, Authorization
• Labels: authentication authorization
• Assignee: Mike Drob
• Reporter: Geza Nagy
• Created: 09/Mar/21 17:20
• Updated: 13/Apr/21 20:10
• Resolved: 05/Apr/21 18:15

Description

Setting up a cluster with multiple solr nodes with Kerberos using it for internode communication as well (attached security.json) and added Ranger as authorization plugin.

When sending requests the authentication happens against the end user but the authorization is for solr service user.

Tested two cases (3 nodes, have a collection with 2 replicas on 2 nodes of it):
1. send a query to a node where the collection has replica. Authorization is wrong every nodes

2. send a query to a node which doesn't contain a replica. The first place authorization is fine but when the query distributed it goes as solr service user issued.