Amrit Sarkar created SOLR-18579:
-----------------------------------
Summary: v2 node APIs deny users whose predefined permission
matches when an "all" rule exists
Key: SOLR-18579
URL: https://issues.apache.org/jira/browse/SOLR-18579
Project: Solr
Issue Type: Bug
Components: Authorization, v2 API
Reporter: Amrit Sarkar
With {{RuleBasedAuthorizationPlugin}} and a catch-all {{all}} permission, a
user whose only grant is a predefined permission such as {{metrics-read}} gets
a 403 from container-level JAX-RS v2 APIs that require exactly that permission.
The v1 equivalent works.
||Request||Permissions||User role||Result||
|{{GET /solr/admin/metrics}}|{{metrics-read}}: metrics, {{all}}:
admin|metrics|allowed|
|{{GET /api/metrics}}|{{metrics-read}}: metrics, {{all}}: admin|metrics|403|
|{{GET /api/metrics}}|{{metrics-read}}: metrics|metrics|allowed|
This follows from SOLR-17708. The first check, in {{HttpSolrCall.call()}},
builds its context from {{V2HttpCall._getHandler()}}, which returns {{api}}.
For a JAX-RS container API {{api}} is null, so
{{RuleBasedAuthorizationPluginBase.predefinedPermissionAppliesToRequest}} skips
every predefined permission except {{all}}. The {{all}} rule then governs and
denies the request before {{SolrRequestAuthorizer}} checks the method's
{{@PermissionName}}.
{noformat}
Request handler [null] is not a PermissionNameProvider, perm doesnt apply
'ALL' perm applies to all requests; perm applies.
Found perm [{"name":"all","role":"admin"}] to govern resource [/____v2/metrics]
... BasicAuthPlugin [username=mu,pwd=*****] does not have the right role
{noformat}
It fails closed, so it isn't a security hole, but it makes predefined
permissions unusable on these APIs in a common setup. Other container APIs with
a non-{{all}} {{@PermissionName}}, such as {{/api/node/threads}}, are likely
affected the same way. No existing test covers a non-{{all}} predefined
permission against a container-level JAX-RS API.
Skipping the {{HttpSolrCall}} check for JAX-RS requests, as suggested on
SOLR-17708, should fix it. A test with a {{metrics-read}}-only user plus an
{{all}} rule would pin it.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
