adityamparikh opened a new pull request, #284:
URL: https://github.com/apache/solr-mcp/pull/284
Closes #66.
## What
Replaces coarse-grained `@PreAuthorize("isAuthenticated()")` method security
on HTTP MCP endpoints with three granular, non-hierarchical scopes:
`solr:read`, `solr:write`, and `solr:admin`.
### Scope Mapping
| Scope | Authority Checked | Covered Endpoints |
|---|---|---|
| `solr:read` | `SCOPE_solr:read` | Read tools (`search`,
`list-collections`, `get-collection-stats`, `check-health`, `get-schema`,
`list-aliases`), resources (`solr://collections`,
`solr://{collection}/schema`), prompts (`search-collection`,
`explore-collections`, `setup-collection`, `index-data`, `view-schema`,
`design-schema`), and completions. |
| `solr:write` | `SCOPE_solr:write` | Document indexing tools
(`index-json-documents`, `index-csv-documents`, `index-xml-documents`,
`index-markdown-documents`). |
| `solr:admin` | `SCOPE_solr:admin` | Administrative and schema modification
tools (`create-collection`, `create-alias`, `delete-alias`, `add-fields`,
`add-field-types`). |
### Key Details
- **Non-Hierarchical Scopes:** `solr:admin` does not imply `solr:write` or
`solr:read`. Scopes are granted explicitly at the Identity Provider (IdP) level
to maintain least privilege.
- **Declarative Authority Mapping:** Uses Spring Security's standard
`SCOPE_` prefix conventions with compile-time constants in `McpAuthorities`.
Works out of the box with standard JWT `scope`/`scp` claims, and supports
Keycloak realm roles (`authorities-claim-expressions=[realm_access][roles]`)
and Auth0 RBAC (`authorities-claim-name=permissions`) using Spring Boot 4
declarative properties without custom converter code.
- **Backward Compatibility Bridge:** Existing secured deployments can
preserve pre-upgrade behavior during IdP migration via a single property:
```properties
spring.security.oauth2.resourceserver.jwt.authorities-claim-expressions[0]={'solr:read','solr:write','solr:admin'}
```
- **Transport Isolation:** STDIO transport and unsecured HTTP
(`http.security.enabled=false`) remain untouched and operate with zero
authentication overhead.
## Tests
- `McpToolRegistrationTest`: Added `everyMcpEndpointRequiresItsScope`
reflection test ensuring all 28 public MCP entry points across all services
declare `@PreAuthorize` with their exact expected `McpAuthorities` scope
constant.
- `MethodSecurityEnforcementTest`: Verified positive access, denial
(`AccessDeniedException`), unauthenticated rejection, and non-hierarchical
isolation across all three scopes.
- `JwtAuthoritiesMappingTest`: Fast `@SpringBootTest` verifying declarative
claim extraction for Keycloak realm roles, Auth0 permissions, and the migration
bridge.
- Full build and test suite (`./gradlew build`, Spotless, and Rat license
checks) pass.
## Docs
- Updated `docs/security/http.md`, `docs/security/keycloak.md`,
`docs/security/auth0.md`, `docs/site/content/pages/mcp/security.md`, and
`README.md` with least-privilege setup, scope documentation, and migration
guides.
- Updated `keycloak/solr-mcp-realm.json` with pre-configured default client
scopes.
- Updated `THREAT_MODEL.md` and `CHANGELOG.md`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
