[SOLR-4470] Support for basic http auth in internal solr requests

• Type: New Feature
• Status: Closed
• Priority: Major
• Resolution: Duplicate
• Affects Version/s: 4.0
• Fix Version/s: 6.0
• Component/s: clients - java, multicore, replication (java), SolrCloud
• Labels: authentication https solrclient solrcloud ssl
• Assignee: Jan Høydahl
• Reporter: Per Steffensen
• Created: 18/Feb/13 09:08
• Updated: 09/May/16 18:45
• Resolved: 07/Aug/15 08:16

Description

We want to protect any HTTP-resource (url). We want to require credentials no matter what kind of HTTP-request you make to a Solr-node.

It can faily easy be acheived as described on http://wiki.apache.org/solr/SolrSecurity. This problem is that Solr-nodes also make "internal" request to other Solr-nodes, and for it to work credentials need to be provided here also.

Ideally we would like to "forward" credentials from a particular request to all the "internal" sub-requests it triggers. E.g. for search and update request.

But there are also "internal" requests

• that only indirectly/asynchronously triggered from "outside" requests (e.g. shard creation/deletion/etc based on calls to the "Collection API")
• that do not in any way have relation to an "outside" "super"-request (e.g. replica synching stuff)

We would like to aim at a solution where "original" credentials are "forwarded" when a request directly/synchronously trigger a subrequest, and fallback to a configured "internal credentials" for the asynchronous/non-rooted requests.

In our solution we would aim at only supporting basic http auth, but we would like to make a "framework" around it, so that not to much refactoring is needed if you later want to make support for other kinds of auth (e.g. digest)

We will work at a solution but create this JIRA issue early in order to get input/comments from the community as early as possible.

Issue Links

• Is contained by: SOLR-7236 Securing Solr (umbrella issue)
• is duplicated by: SOLR-7692 Implement BasicAuth based impl for the new Authentication/Authorization APIs
• relates to: SOLR-4407 SSL Certificate based authentication for SolrCloud
• relates to: SOLR-7230 An API to plugin security into Solr
• relates to: SOLR-608 scripts using curl should support authentication params
• relates to: SOLR-6625 Add interceptor API for outgoing calls through HttpSolrClient
• requires: SOLR-5220 Marking server as zombie due to 4xx response is odd
• requires: SOLR-5853 Return status for AbstractFullDistribZkTestBase#createCollection() and friends