[
https://issues.apache.org/jira/browse/SOLR-7275?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14497711#comment-14497711
]
Ishan Chattopadhyaya edited comment on SOLR-7275 at 4/16/15 8:18 AM:
---------------------------------------------------------------------
Quick thought:
{quote}
{noformat}
+ //Initialize the Authorization module
+ if(cores.getZkController().getZkClient().exists(SOLR_SECURITY_CONF_PATH,
true)) {
+ byte[] data = cores.getZkController().getZkClient()
+ .getData(SOLR_SECURITY_CONF_PATH, null, new Stat(), true);
+ Map securityConf = (Map) ZkStateReader.fromJSON(data) ;
+ Map authorizationConf = (Map) securityConf.get("authorization");
+ log.info("Initializing authorization plugin: " +
authorizationConf.get("class"));
+ authorizationPlugin = cores.getResourceLoader().newInstance((String)
authorizationConf.get("class"),
+ SolrAuthorizationPlugin.class);
{noformat}
{quote}
Maybe we should move this to the ZkStateReader, so that we can do something
like this here:
{noformat}
zkcontroller.getSecurityProps().getAuthorizationProps() or
zkcontroller.getSecurityProps().getAuthenticationProps()
{noformat}
was (Author: ichattopadhyaya):
Quick thought:
{quote}
{noformat}
+ //Initialize the Authorization module
+ if(cores.getZkController().getZkClient().exists(SOLR_SECURITY_CONF_PATH,
true)) {
+ byte[] data = cores.getZkController().getZkClient()
+ .getData(SOLR_SECURITY_CONF_PATH, null, new Stat(), true);
+ Map securityConf = (Map) ZkStateReader.fromJSON(data) ;
+ Map authorizationConf = (Map) securityConf.get("authorization");
+ log.info("Initializing authorization plugin: " +
authorizationConf.get("class"));
+ authorizationPlugin = cores.getResourceLoader().newInstance((String)
authorizationConf.get("class"),
+ SolrAuthorizationPlugin.class);
{noformat}
{quote}
Maybe we should move this to the ZkStateReader, so that we can do something
like this here:
{noformat}
zkcontroller.getSecurityProps().getAuthorization() or
zkcontroller.getSecurityProps().getAuthentication()
{noformat}
> Pluggable authorization module in Solr
> --------------------------------------
>
> Key: SOLR-7275
> URL: https://issues.apache.org/jira/browse/SOLR-7275
> Project: Solr
> Issue Type: Sub-task
> Reporter: Anshum Gupta
> Assignee: Anshum Gupta
> Attachments: SOLR-7275.patch, SOLR-7275.patch
>
>
> Solr needs an interface that makes it easy for different authorization
> systems to be plugged into it. Here's what I plan on doing:
> Define an interface {{SolrAuthorizationPlugin}} with one single method
> {{isAuthorized}}. This would take in a {{SolrRequestContext}} object and
> return an {{SolrAuthorizationResponse}} object. The object as of now would
> only contain a single boolean value but in the future could contain more
> information e.g. ACL for document filtering etc.
> The reason why we need a context object is so that the plugin doesn't need to
> understand Solr's capabilities e.g. how to extract the name of the collection
> or other information from the incoming request as there are multiple ways to
> specify the target collection for a request. Similarly request type can be
> specified by {{qt}} or {{/handler_name}}.
> Flow:
> Request -> SolrDispatchFilter -> isAuthorized(context) -> Process/Return.
> {code}
> public interface SolrAuthorizationPlugin {
> public SolrAuthorizationResponse isAuthorized(SolrRequestContext context);
> }
> {code}
> {code}
> public class SolrRequestContext {
> UserInfo; // Will contain user context from the authentication layer.
> HTTPRequest request;
> Enum OperationType; // Correlated with user roles.
> String[] CollectionsAccessed;
> String[] FieldsAccessed;
> String Resource;
> }
> {code}
> {code}
> public class SolrAuthorizationResponse {
> boolean authorized;
> public boolean isAuthorized();
> }
> {code}
> User Roles:
> * Admin
> * Collection Level:
> * Query
> * Update
> * Admin
> Using this framework, an implementation could be written for specific
> security systems e.g. Apache Ranger or Sentry. It would keep all the security
> system specific code out of Solr.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
