[SOLR-17247] 'WWW-Authenticate' headers missing in MultiAuthPlugin

• Type: Bug
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Fix Version/s: 9.7
• Component/s: Authentication
• Assignee: Eric Pugh
• Reporter: Lamine
• Created: 22/Apr/24 15:55
• Updated: 03/Jun/24 04:14
• Resolved: 29/May/24 13:30

Description

MultiAuthPlugin does not return WWW-Authenticate' headers

When returning a 401 response a Web application needs to indicate to the client what authentication challenges it supports, otherwise an exception like "HTTP protocol violation: Authentication challenge without WWW-Authenticate header“ is raised.

Solr’s MultiAuthPlugin does not supports this.  Solr should return the list of supported schemes (challenges).

 

According to HTTP RFC 7235:

The 401 (Unauthorized) status code indicates that the request has not
been applied because it lacks valid authentication credentials for
the target resource. The server generating a 401 response MUST send
a WWW-Authenticate header field (Section 4.1) containing at least one
challenge applicable to the target resource.

Issue Links

• links to: GitHub Pull Request #2416