[
https://issues.apache.org/jira/browse/SOLR-18010?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18125495#comment-18125495
]
Eric Pugh commented on SOLR-18010:
----------------------------------
thanks... I wondered if the chagnes I had made to some of the v2 apis caused
this? I thought we had moved from "post an entire security.json back" to
multiple calls with v2 api? I may be confused with soemthing else however....
Found it: [https://github.com/apache/solr/pull/4916]
I think I had some challenges with moving to more REST style there.
Let's get your fix in, and then I'd love you to look at 4916, and see if your
fix is needed in 4916!
> Adding a new role corrupts security.json file
> ---------------------------------------------
>
> Key: SOLR-18010
> URL: https://issues.apache.org/jira/browse/SOLR-18010
> Project: Solr
> Issue Type: Bug
> Components: SolrCLI
> Affects Versions: 9.8
> Environment: Windows
> Solr 9.8.0
> Reporter: Rich M
> Priority: Critical
> Labels: pull-request-available
> Attachments: image-2025-12-02-16-09-45-876.png
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> Do following steps after installing Solr.
> *Step 1:*
> Create a new security.json at \solr-9.8.0\server\solr\ with following
> contents:
> (same as given here -
> https://solr.apache.org/guide/solr/latest/deployment-guide/authentication-and-authorization-plugins.html#configuring-security-json)
> {code:java}
> {
> "authentication":{
> "class":"solr.BasicAuthPlugin",
> "credentials":{"solr":"IV0EHq1OnNrj6gvRCwvFwTrZ1+z1oBbnQdiVC3otuq0=
> Ndd7LKvVBAaZIF0QAVi1ekCfAJXr1GGfLtRUXhgrF8c="}
> },
> "authorization":{
> "class":"solr.RuleBasedAuthorizationPlugin",
> "permissions":[{"name":"security-edit",
> "role":"admin"}],
> "user-role":{"solr":"admin"}
> }}{code}
> Step 2:
> Login with solr user, password - SolrRocks
> Go to 'Security'
> create a new role with a new role
> Error below appears and security.json gets corrupted.
> !image-2025-12-02-16-09-45-876.png|width=550,height=246!
> The json automatically gets updated to:
> {code:java}
> {
> "authentication":{
> "class":"solr.BasicAuthPlugin",
> "credentials":{
> "solr":"IV0EHq1OnNrj6gvRCwvFwTrZ1+z1oBbnQdiVC3otuq0=
> Ndd7LKvVBAaZIF0QAVi1ekCfAJXr1GGfLtRUXhgrF8c=",
> "test1":"VF04APKPG4SRcJ8iuBrC37xMsZO3mYm5b+vsvsqIuwQ=
> g0N/69rk7g/U3L3PZO3zsed5txIfdO0G0/Iyzoru+1I="},
> "":{"v":0}},
> "authorization":{
> "class":"solr.RuleBasedAuthorizationPlugin",
> "permissions":[
> {
> "name":"security-edit",
> "role":"admin",
> "index":1},
> {
> "name":"collection-admin-read",
> "role":["all-read-only"],
> "index":2},
> {
> "name":"config-read",
> "role":["all-read-only"],
> "index":3}],
> "user-role":{
> "solr":"admin",
> "test1":["all-read-only"]},
> "":{"v":0}}}0}}}{code}
> and this is not a valid json anymore.
> As a result, the 'solr' user is not usable anymore.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
