janhoy commented on a change in pull request #635: SOLR-13371 improve security chapters in refguide URL: https://github.com/apache/lucene-solr/pull/635#discussion_r272178305
########## File path: solr/solr-ref-guide/src/authentication-and-authorization-plugins.adoc ########## @@ -81,7 +84,7 @@ This example also defines `security.json` on the command line, but you can also [WARNING] ==== -Depending on the authentication and authorization plugin that you use, you may have user information stored in `security.json`. If so, we highly recommend that you implement access control in your ZooKeeper nodes. Information about how to enable this is available in the section <<zookeeper-access-control.adoc#zookeeper-access-control,ZooKeeper Access Control>>. +Whenever you use any security plugins and store `security.json` in ZooKeeper, we highly recommend that you implement access control in your ZooKeeper nodes. Information about how to enable this is available in the section <<zookeeper-access-control.adoc#zookeeper-access-control,ZooKeeper Access Control>>. Review comment: I felt that it is important to secure ZK even if you don't have sensitive data in security.json. For the simple reason that if Zk is wide open then *anyone* could disable or change auth* ---------------------------------------------------------------- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: [email protected] With regards, Apache Git Services --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
