This is an automated email from the ASF dual-hosted git repository.
epugh pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/solr.git
The following commit(s) were added to refs/heads/main by this push:
new 1fc38d1e40c SOLR-18610: S3 backup repository: grant the permissions
the AWS SDK's web identity provider needs under the Security Manager (#5264)
1fc38d1e40c is described below
commit 1fc38d1e40cb12512aba2b1990b22b04111dad2d
Author: Samuel Verstraete <[email protected]>
AuthorDate: Thu Nov 5 16:16:19 2026 +0100
SOLR-18610: S3 backup repository: grant the permissions the AWS SDK's web
identity provider needs under the Security Manager (#5264)
Co-authored-by: Samuel Verstraete <[email protected]>
Co-authored-by: Claude Opus 5.5 <[email protected]>
---
.../unreleased/SOLR-18610-s3-web-identity-security-manager.yml | 9 +++++++++
solr/server/etc/security.policy | 4 ++++
2 files changed, 13 insertions(+)
diff --git
a/changelog/unreleased/SOLR-18610-s3-web-identity-security-manager.yml
b/changelog/unreleased/SOLR-18610-s3-web-identity-security-manager.yml
new file mode 100644
index 00000000000..fb6019072cb
--- /dev/null
+++ b/changelog/unreleased/SOLR-18610-s3-web-identity-security-manager.yml
@@ -0,0 +1,9 @@
+# See https://github.com/apache/solr/blob/main/dev-docs/changelog.adoc
+title: The S3 backup repository uses web identity credentials (such as EKS IAM
Roles for Service Accounts) again when the Security Manager is enabled, instead
of falling back to the next credentials provider, such as the EC2 instance
profile.
+type: fixed
+authors:
+ - name: Samuel Verstraete
+ nick: elangelo
+links:
+ - name: SOLR-18610
+ url: https://issues.apache.org/jira/browse/SOLR-18610
diff --git a/solr/server/etc/security.policy b/solr/server/etc/security.policy
index 2dd03af0be2..0c61da2300b 100644
--- a/solr/server/etc/security.policy
+++ b/solr/server/etc/security.policy
@@ -106,6 +106,10 @@ grant {
// needed by aws s3 sdk (Apache HTTP Client)
permission java.lang.RuntimePermission
"accessClassInPackage.jdk.internal.reflect";
permission java.lang.RuntimePermission "accessSystemModules";
+ // needed by the aws sdk default http client (Apache HttpClient 5), used for
STS by the web identity credentials provider
+ permission jdk.net.NetworkPermission "setOption.TCP_KEEPIDLE";
+ permission jdk.net.NetworkPermission "setOption.TCP_KEEPINTERVAL";
+ permission jdk.net.NetworkPermission "setOption.TCP_KEEPCOUNT";
// These two *have* to be spelled out a separate
permission java.lang.management.ManagementPermission "control";
