epugh opened a new pull request, #4916:
URL: https://github.com/apache/solr/pull/4916
## Summary
Solr's existing v2 security endpoints
(`/api/cluster/security/authentication`, `/api/cluster/security/authorization`)
are command-batch-over-POST — the same `set-user`/`set-permission`/etc.
commands as v1, just reachable at a v2 URL, not genuine resource-oriented REST.
This PR adds a real resource-oriented v2 surface alongside the existing one,
following the same JAX-RS/Jersey pattern already used by
`ClusterPropertyApis`/`AliasPropertyApis`:
- `GET/PUT/DELETE
/api/cluster/security/authentication/{scheme}/users/{username}`
- `GET/PUT/DELETE
/api/cluster/security/authorization/{scheme}/roles/{username}`
- `GET/POST/PUT/DELETE
/api/cluster/security/authorization/permissions/{index}`
The `{scheme}` path segment lets these APIs work correctly under
`MultiAuthPlugin`/`MultiAuthRuleBasedAuthorizationPlugin` (routing to the right
sub-plugin's config), and is simply ignored for a plain
`BasicAuthPlugin`/`RuleBasedAuthorizationPlugin` setup. Permissions have no
such segment — `MultiAuthRuleBasedAuthorizationPlugin.edit()` already treats
every `*-permission` command as shared across all schemes rather than
per-scheme, so no wrapping is needed there.
All mutations still funnel through `SecurityConfHandler`'s existing
`CommandOperation`/`ConfigEditablePlugin` machinery (extracted here into a new
public `editSecurityConfig()` shared with the legacy v1/v2 command endpoints) —
this is additive REST surface, not a rewrite of the security model or
`security.json` semantics.
Also included:
- Wires the Admin UI's Security screen (`security.js`/`services.js`) to the
new endpoints for user/role create/update/delete, following the existing
`AliasesV2`-style generated-client pattern.
- Documents the new endpoints in the ref guide
(`basic-authentication-plugin.adoc`, `rule-based-authorization-plugin.adoc`).
- Fixes a latent doc gap found along the way:
`rule-based-authorization-plugin.adoc` was missing v2 URL examples for the
existing command-batch authorization commands.
## Test plan
- [x] `SecurityV2ApiStandaloneTest` — standalone-mode HTTP tests for all
three resources via the generated SolrJ client (create/list/update/delete,
including 401/404/409 error cases)
- [x] `SecurityV2ApiCloudTest` — SolrCloud-mode coverage; also catches and
regression-tests a `ClassCastException` found via manual testing
(`Utils.getDeepCopy(..., mutable=false)` wraps nested lists in
`Collections.unmodifiableCollection`, not `unmodifiableList`, on the ZK-cached
read path)
- [x] `MultiAuthUsersAndRolesApiCloudTest` — a genuine 2-scheme
`MultiAuthPlugin`/`MultiAuthRuleBasedAuthorizationPlugin` cluster proving
users/roles written to one scheme never leak into another
- [x] Manually verified end-to-end in a browser against a live
Basic-Auth-enabled Solr instance (Admin UI Security screen: add/edit/delete
user, set/clear roles, delete permission)
- [x] Existing security test suites (`SecurityConfHandlerTest`,
`V2SecurityAPIMappingTest`, `BasicAuthStandaloneTest`, `MultiAuthPluginTest`,
`BasicAuthOnSingleNodeTest`) pass unchanged
- [x] `./gradlew spotlessCheck forbiddenApisMain` clean
- [x] Ref guide builds clean (`./gradlew :solr:solr-ref-guide:checkSite`)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
https://claude.ai/code/session_01Kapco1bnqFBMkFHFPF6MFL
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
