[SOLR-9693] BasicAuthPlugin API should not allow setting blockUnknown=true if no users configured

• Type: Improvement
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Component/s: security
• Labels: authentication
• Assignee: Unassigned
• Reporter: Jan Høydahl
• Created: 26/Oct/16 07:44
• Updated: 08/Jun/19 15:30

Description

If you use the API to configure BasicAuth, the order in which you specify your config matters. Currently it is possible to set the blockUnknown property without any users being configured, rendering Solr useless. The same would be the case if the last user is removed when blockUnknown is still set.

Perhaps fail with code 409 Conflict or something?

More tricky is the case where BasicAuth is configured with no users, and someone adds an Authorization config requiring a certain user to do anything at all - it would also lock down Solr but since the plugins don't know about each other it is hard to control.