Details
-
Improvement
-
Status: Closed
-
Major
-
Resolution: Fixed
-
None
-
None
-
None
Description
This is a spin off from SOLR-13472, specifically to tackle the Kerberos case. Here's the security.json to reproduce the same problem as of SOLR-13472:
{
"authentication": {"class": "org.apache.solr.security.KerberosPlugin"},
"authorization": {
"class": "solr.RuleBasedAuthorizationPlugin",
"permissions": [
{
"name": "read",
"role": "*"
},
{
"name": "update",
"role": [
"indexer",
"admin"
]
},
{
"name": "all",
"role": "admin"
}
],
"user-role": {
"HTTP/solr1@EXAMPLE.COM": "admin",
"HTTP/solr2@EXAMPLE.COM": "admin",
"client@EXAMPLE.COM": "indexer"
}
}
}
Here, client@EXAMPLE.COM should be able to issue /update and /select requests to both solr1 and solr2, but it throws 403 for the node that doesn't host the collection.
Attachments
Attachments
Issue Links
- relates to
-
SOLR-13480 Collection creation failure when using Kerberos authentication combined with rule-base authorization
-
- Resolved
-
- links to
