sarkarsital1959 commented on PR #4916: URL: https://github.com/apache/solr/pull/4916#issuecomment-6598122976
I tried it with JWT and ExternalRole set up next to Basic. Only Basic and RuleBased keep users and roles in security.json. The others get them from the token, so these endpoints don't fit them: - `PUT /authentication/bearer/users/bob` returns 200 but saves nothing. - `PUT /authorization/bearer/roles/bob` returns 200 and saves roles that [ExternalRole refuses to load](https://github.com/apache/solr/blob/90a19f5fb979f0a874ae17c1d11a844bd389fa64/solr/core/src/java/org/apache/solr/security/ExternalRoleRuleBasedAuthorizationPlugin.java#L35). After that, later security changes stop taking effect (a new Basic user gets 401), and a restarted node won't start. v1 `set-user-role` can do the same. I'd return 404 for users and roles when the scheme isn't Basic or RuleBased. Permissions are fine as they are for every plugin type, no nesting needed. A test with a real JWT scheme next to Basic would cover it. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
