Re: https

[Rick Leir]

Hi pub
You need to google CORS cross origin resource sharing. But no need to worry 
about CORS if all of the JavaScript for the Solr site is on the Solr server.

But as others have said, it is best to have some PHP or Python UI in front of 
Solr.
Cheers
Rick

On March 8, 2017 2:11:36 PM EST, pubdiverses  wrote:
>Hello,
>
>I give you some more explanation.
>
>I have a site https://site.com under Apache.
>On the same physical server, i've installed solr.
>
>Inside https://site.com, i've a search form wich call solr with 
>http://xxx.xxx.xxx.xxx/solr.
>
>But the browser says : "mixt content" and blocks the call.
>
>So, i need to have something like https://xxx.xxx.xxx.xxx/solr
>
>Is it possible ?
>
>
>
>Le 07/03/2017 à 22:19, Alexandre Rafalovitch a écrit :
>> The first advise is NOT to expose your Solr directly to the public.
>> Anyone that can hit /search, can also hit /update and wipe out your
>> index.
>>
>> Unless you run a proper proxy that secures URLs and sanitizes the
>> parameters (in GET, in POST, escaped, etc).  And if you are doing
>> that, you can setup the HTTPS in your proxy and have it speak HTTP to
>> Solr on the backend.
>>
>> Otherwise, you need middleware, which runs on a server as well, so
>you
>> are back into configuring _that_ server (not Solr) for HTTPS.
>>
>> Regards,
>> Alex.
>> 
>> http://www.solr-start.com/ - Resources for Solr users, new and
>experienced
>>
>>
>> On 7 March 2017 at 15:45, pubdiverses  wrote:
>>> Hello,
>>>
>>> I would like to acces my solr instance with https://domain.com/solr.
>>>
>>> how to do this ?

-- 
Sent from my Android device with K-9 Mail. Please excuse my brevity.

Re: https

[Shawn Heisey]

On 3/8/2017 12:11 PM, pubdiverses wrote:
> I have a site https://site.com under Apache.
> On the same physical server, i've installed solr.
>
> Inside https://site.com, i've a search form wich call solr with
> http://xxx.xxx.xxx.xxx/solr.
>
> But the browser says : "mixt content" and blocks the call.
>
> So, i need to have something like https://xxx.xxx.xxx.xxx/solr
>
> Is it possible ?

Alexandre and Phil already mentioned this, but it's so critical that I'm
going to repeat it.

This is a VERY BAD idea.

This exposes Solr directly to the Internet, which means that unless you
take *SPECIAL* effort with an intelligent proxy server, which is not at
all trivial to secure properly, then anybody on the Internet can change
your index, delete your index, or send denial of service queries that
make it so your legitimate users cannot utilize your search.

Whether HTTPS is used or not, do not expose Solr directly to the
Internet.  Instead, use server-side web application code to access it
behind the firewall.

Thanks,
Shawn

RE: https

[Phil Scadden]

What we are suggesting is that your browser does NOT access solr directly at 
all. In fact, configure firewall so that SOLR is unreachable outside the 
server. Instead you write a proxy in your site application which calls SOLR 
instead. Ie a server-to-server call instead of browser-to-server. This is a 
much more secure setup and allows you to "vet" query requests, potentially 
distribute to different cores on some application logic etc. Shouldn’t be hard 
to find a skeleton proxy code in whatever your site application is written in.

-Original Message-
From: pubdiverses [mailto:pubdiver...@free.fr]
Sent: Thursday, 9 March 2017 8:12 a.m.
To: solr-user@lucene.apache.org
Subject: Re: https

Hello,

I give you some more explanation.

I have a site https://site.com under Apache.
On the same physical server, i've installed solr.

Inside https://site.com, i've a search form wich call solr with 
http://xxx.xxx.xxx.xxx/solr.

But the browser says : "mixt content" and blocks the call.

So, i need to have something like https://xxx.xxx.xxx.xxx/solr

Is it possible ?



Le 07/03/2017 à 22:19, Alexandre Rafalovitch a écrit :
> The first advise is NOT to expose your Solr directly to the public.
> Anyone that can hit /search, can also hit /update and wipe out your
> index.
>
> Unless you run a proper proxy that secures URLs and sanitizes the
> parameters (in GET, in POST, escaped, etc).  And if you are doing
> that, you can setup the HTTPS in your proxy and have it speak HTTP to
> Solr on the backend.
>
> Otherwise, you need middleware, which runs on a server as well, so you
> are back into configuring _that_ server (not Solr) for HTTPS.
>
> Regards,
> Alex.
> 
> http://www.solr-start.com/ - Resources for Solr users, new and
> experienced
>
>
> On 7 March 2017 at 15:45, pubdiverses <pubdiver...@free.fr> wrote:
>> Hello,
>>
>> I would like to acces my solr instance with https://domain.com/solr.
>>
>> how to do this ?

Notice: This email and any attachments are confidential and may not be used, 
published or redistributed without the prior written consent of the Institute 
of Geological and Nuclear Sciences Limited (GNS Science). If received in error 
please destroy and immediately notify GNS Science. Do not copy or disclose the 
contents.

Re: https

[pubdiverses]

Hello,

I give you some more explanation.

I have a site https://site.com under Apache.
On the same physical server, i've installed solr.

Inside https://site.com, i've a search form wich call solr with 
http://xxx.xxx.xxx.xxx/solr.


But the browser says : "mixt content" and blocks the call.

So, i need to have something like https://xxx.xxx.xxx.xxx/solr

Is it possible ?



Le 07/03/2017 à 22:19, Alexandre Rafalovitch a écrit :

The first advise is NOT to expose your Solr directly to the public.
Anyone that can hit /search, can also hit /update and wipe out your
index.

Unless you run a proper proxy that secures URLs and sanitizes the
parameters (in GET, in POST, escaped, etc).  And if you are doing
that, you can setup the HTTPS in your proxy and have it speak HTTP to
Solr on the backend.

Otherwise, you need middleware, which runs on a server as well, so you
are back into configuring _that_ server (not Solr) for HTTPS.

Regards,
Alex.

http://www.solr-start.com/ - Resources for Solr users, new and experienced


On 7 March 2017 at 15:45, pubdiverses  wrote:

Hello,

I would like to acces my solr instance with https://domain.com/solr.

how to do this ?

RE: https

[Phil Scadden]

>The first advise is NOT to expose your Solr directly to the public.
>Anyone that can hit /search, can also hit /update and wipe out your index.

I would second that too. We have never exposed Solr and I also sanitise queries 
in the proxy.
Notice: This email and any attachments are confidential and may not be used, 
published or redistributed without the prior written consent of the Institute 
of Geological and Nuclear Sciences Limited (GNS Science). If received in error 
please destroy and immediately notify GNS Science. Do not copy or disclose the 
contents.

Re: https

[Shawn Heisey]

On 3/7/2017 1:45 PM, pubdiverses wrote:

I would like to acces my solr instance with https://domain.com/solr.

how to do this ?


The reference guide covers this.

https://cwiki.apache.org/confluence/display/solr/Enabling+SSL

If you want to change the port to 443 so it will work without a port in 
the URL, then you will need to change the port number and run Solr as 
root or an admin user.  In later versions, Solr will refuse to start 
when run as root without a "force" option.  The root/admin requirement 
comes from the operating system -- this is almost always required to 
bind to a port number below 1024.


Thanks,
Shawn

Re: https

[Alexandre Rafalovitch]

The first advise is NOT to expose your Solr directly to the public.
Anyone that can hit /search, can also hit /update and wipe out your
index.

Unless you run a proper proxy that secures URLs and sanitizes the
parameters (in GET, in POST, escaped, etc).  And if you are doing
that, you can setup the HTTPS in your proxy and have it speak HTTP to
Solr on the backend.

Otherwise, you need middleware, which runs on a server as well, so you
are back into configuring _that_ server (not Solr) for HTTPS.

Regards,
   Alex.

http://www.solr-start.com/ - Resources for Solr users, new and experienced


On 7 March 2017 at 15:45, pubdiverses  wrote:
> Hello,
>
> I would like to acces my solr instance with https://domain.com/solr.
>
> how to do this ?

Re: HTTPS for SolrCloud

[Shawn Heisey]

On 9/2/2014 11:44 AM, Christopher Gross wrote:
 OK -- so I think my previous attempts were causing the problem.
 Since this is a dev environment (and is still empty), I just went ahead and
 wiped out the version-2 directories for the zookeeper nodes, reloaded my
 solr collections, then ran that command (zkcli.sh in the solr distro).
 That did work.  What is a reliable way to remove a file from Zookeeper?

The zkcli that comes with zookeeper itself is really good for removing
things.  It's not easy for a beginner to use, though.

There is also at least one GUI option.  The only one that I've used is
zookeeper client plugin for eclipse, because I use eclipse for other
things.  It can be a little hard to figure out, but once you do, it's
very useful for looking at and modifying zookeeper:

http://www.massedynamic.org/mediawiki/index.php?title=Eclipse_Plug-in_for_ZooKeeper

Thanks,
Shawn

Re: HTTPS for SolrCloud

[Christopher Gross]

Shawn,
How do I remove a collection from the SolrCloud?  I tried making
testcollection and it failed, but now it is listed on the Graph part of
the Cloud page for my Solr instances.  I tried using the delete on zkCli
but it still remains on that page.  The only reliable thing that I've found
is to wipe out the version-2 for all the zookeepers, restart them, then
reload my configs back in.

Thanks!

-- Chris


On Thu, Sep 4, 2014 at 4:12 AM, Shawn Heisey s...@elyograg.org wrote:

 On 9/2/2014 11:44 AM, Christopher Gross wrote:
  OK -- so I think my previous attempts were causing the problem.
  Since this is a dev environment (and is still empty), I just went ahead
 and
  wiped out the version-2 directories for the zookeeper nodes, reloaded
 my
  solr collections, then ran that command (zkcli.sh in the solr distro).
  That did work.  What is a reliable way to remove a file from Zookeeper?

 The zkcli that comes with zookeeper itself is really good for removing
 things.  It's not easy for a beginner to use, though.

 There is also at least one GUI option.  The only one that I've used is
 zookeeper client plugin for eclipse, because I use eclipse for other
 things.  It can be a little hard to figure out, but once you do, it's
 very useful for looking at and modifying zookeeper:


 http://www.massedynamic.org/mediawiki/index.php?title=Eclipse_Plug-in_for_ZooKeeper

 Thanks,
 Shawn

Re: HTTPS for SolrCloud

[Anshum Gupta]

Chris,

Did you try the Collections API to do whatever you're trying to do? 1.
Create collection and 2. Delete collection.
https://cwiki.apache.org/confluence/display/solr/Collections+API#CollectionsAPI-api6

The collection APIs cleanup things if stuff goes wrong. As I don't know,
I'm not sure about it but did you already try it and things didn't
work/clean up for you? If that's the case, was there an error that you
noticed?



On Thu, Sep 4, 2014 at 4:45 AM, Christopher Gross cogr...@gmail.com wrote:

 Shawn,
 How do I remove a collection from the SolrCloud?  I tried making
 testcollection and it failed, but now it is listed on the Graph part of
 the Cloud page for my Solr instances.  I tried using the delete on zkCli
 but it still remains on that page.  The only reliable thing that I've found
 is to wipe out the version-2 for all the zookeepers, restart them, then
 reload my configs back in.

 Thanks!

 -- Chris


 On Thu, Sep 4, 2014 at 4:12 AM, Shawn Heisey s...@elyograg.org wrote:

  On 9/2/2014 11:44 AM, Christopher Gross wrote:
   OK -- so I think my previous attempts were causing the problem.
   Since this is a dev environment (and is still empty), I just went ahead
  and
   wiped out the version-2 directories for the zookeeper nodes, reloaded
  my
   solr collections, then ran that command (zkcli.sh in the solr distro).
   That did work.  What is a reliable way to remove a file from Zookeeper?
 
  The zkcli that comes with zookeeper itself is really good for removing
  things.  It's not easy for a beginner to use, though.
 
  There is also at least one GUI option.  The only one that I've used is
  zookeeper client plugin for eclipse, because I use eclipse for other
  things.  It can be a little hard to figure out, but once you do, it's
  very useful for looking at and modifying zookeeper:
 
 
 
 http://www.massedynamic.org/mediawiki/index.php?title=Eclipse_Plug-in_for_ZooKeeper
 
  Thanks,
  Shawn
 
 




-- 

Anshum Gupta
http://www.anshumgupta.net

Re: HTTPS for SolrCloud

[Christopher Gross]

The DELETE from the collections API does get rid of it.  Guess I glossed
over on that when I was looking over that section.

Still -- if the CREATE fails, I don't think it should create anything that
you'd need to go back and DELETE.

Thanks Anshum.

-- Chris


On Thu, Sep 4, 2014 at 3:02 PM, Anshum Gupta ans...@anshumgupta.net wrote:

 Chris,

 Did you try the Collections API to do whatever you're trying to do? 1.
 Create collection and 2. Delete collection.

 https://cwiki.apache.org/confluence/display/solr/Collections+API#CollectionsAPI-api6

 The collection APIs cleanup things if stuff goes wrong. As I don't know,
 I'm not sure about it but did you already try it and things didn't
 work/clean up for you? If that's the case, was there an error that you
 noticed?



 On Thu, Sep 4, 2014 at 4:45 AM, Christopher Gross cogr...@gmail.com
 wrote:

  Shawn,
  How do I remove a collection from the SolrCloud?  I tried making
  testcollection and it failed, but now it is listed on the Graph part of
  the Cloud page for my Solr instances.  I tried using the delete on
 zkCli
  but it still remains on that page.  The only reliable thing that I've
 found
  is to wipe out the version-2 for all the zookeepers, restart them, then
  reload my configs back in.
 
  Thanks!
 
  -- Chris
 
 
  On Thu, Sep 4, 2014 at 4:12 AM, Shawn Heisey s...@elyograg.org wrote:
 
   On 9/2/2014 11:44 AM, Christopher Gross wrote:
OK -- so I think my previous attempts were causing the problem.
Since this is a dev environment (and is still empty), I just went
 ahead
   and
wiped out the version-2 directories for the zookeeper nodes,
 reloaded
   my
solr collections, then ran that command (zkcli.sh in the solr
 distro).
That did work.  What is a reliable way to remove a file from
 Zookeeper?
  
   The zkcli that comes with zookeeper itself is really good for removing
   things.  It's not easy for a beginner to use, though.
  
   There is also at least one GUI option.  The only one that I've used is
   zookeeper client plugin for eclipse, because I use eclipse for other
   things.  It can be a little hard to figure out, but once you do, it's
   very useful for looking at and modifying zookeeper:
  
  
  
 
 http://www.massedynamic.org/mediawiki/index.php?title=Eclipse_Plug-in_for_ZooKeeper
  
   Thanks,
   Shawn
  
  
 



 --

 Anshum Gupta
 http://www.anshumgupta.net

Re: HTTPS for SolrCloud

[Anshum Gupta]

I'm just curious, do you know why the CREATE failed for you?


On Thu, Sep 4, 2014 at 12:21 PM, Christopher Gross cogr...@gmail.com
wrote:

 The DELETE from the collections API does get rid of it.  Guess I glossed
 over on that when I was looking over that section.

 Still -- if the CREATE fails, I don't think it should create anything that
 you'd need to go back and DELETE.

 Thanks Anshum.

 -- Chris


 On Thu, Sep 4, 2014 at 3:02 PM, Anshum Gupta ans...@anshumgupta.net
 wrote:

  Chris,
 
  Did you try the Collections API to do whatever you're trying to do? 1.
  Create collection and 2. Delete collection.
 
 
 https://cwiki.apache.org/confluence/display/solr/Collections+API#CollectionsAPI-api6
 
  The collection APIs cleanup things if stuff goes wrong. As I don't know,
  I'm not sure about it but did you already try it and things didn't
  work/clean up for you? If that's the case, was there an error that you
  noticed?
 
 
 
  On Thu, Sep 4, 2014 at 4:45 AM, Christopher Gross cogr...@gmail.com
  wrote:
 
   Shawn,
   How do I remove a collection from the SolrCloud?  I tried making
   testcollection and it failed, but now it is listed on the Graph part
 of
   the Cloud page for my Solr instances.  I tried using the delete on
  zkCli
   but it still remains on that page.  The only reliable thing that I've
  found
   is to wipe out the version-2 for all the zookeepers, restart them, then
   reload my configs back in.
  
   Thanks!
  
   -- Chris
  
  
   On Thu, Sep 4, 2014 at 4:12 AM, Shawn Heisey s...@elyograg.org
 wrote:
  
On 9/2/2014 11:44 AM, Christopher Gross wrote:
 OK -- so I think my previous attempts were causing the problem.
 Since this is a dev environment (and is still empty), I just went
  ahead
and
 wiped out the version-2 directories for the zookeeper nodes,
  reloaded
my
 solr collections, then ran that command (zkcli.sh in the solr
  distro).
 That did work.  What is a reliable way to remove a file from
  Zookeeper?
   
The zkcli that comes with zookeeper itself is really good for
 removing
things.  It's not easy for a beginner to use, though.
   
There is also at least one GUI option.  The only one that I've used
 is
zookeeper client plugin for eclipse, because I use eclipse for other
things.  It can be a little hard to figure out, but once you do, it's
very useful for looking at and modifying zookeeper:
   
   
   
  
 
 http://www.massedynamic.org/mediawiki/index.php?title=Eclipse_Plug-in_for_ZooKeeper
   
Thanks,
Shawn
   
   
  
 
 
 
  --
 
  Anshum Gupta
  http://www.anshumgupta.net
 




-- 

Anshum Gupta
http://www.anshumgupta.net

Re: HTTPS for SolrCloud

[Christopher Gross]

I was running 4.8.1, and the solr.ssl.checkPeerName flag didn't work, so it
was unable to talk to the other nodes to create the collection.  I've since
upgraded to 4.9.0 and was able to create it, but I had to increment the
name.  I've had other failures in the past as well, like typos
(mulitValued instead of multiValued), which left me in a similar state.

-- Chris


On Thu, Sep 4, 2014 at 3:28 PM, Anshum Gupta ans...@anshumgupta.net wrote:

 I'm just curious, do you know why the CREATE failed for you?


 On Thu, Sep 4, 2014 at 12:21 PM, Christopher Gross cogr...@gmail.com
 wrote:

  The DELETE from the collections API does get rid of it.  Guess I glossed
  over on that when I was looking over that section.
 
  Still -- if the CREATE fails, I don't think it should create anything
 that
  you'd need to go back and DELETE.
 
  Thanks Anshum.
 
  -- Chris
 
 
  On Thu, Sep 4, 2014 at 3:02 PM, Anshum Gupta ans...@anshumgupta.net
  wrote:
 
   Chris,
  
   Did you try the Collections API to do whatever you're trying to do? 1.
   Create collection and 2. Delete collection.
  
  
 
 https://cwiki.apache.org/confluence/display/solr/Collections+API#CollectionsAPI-api6
  
   The collection APIs cleanup things if stuff goes wrong. As I don't
 know,
   I'm not sure about it but did you already try it and things didn't
   work/clean up for you? If that's the case, was there an error that you
   noticed?
  
  
  
   On Thu, Sep 4, 2014 at 4:45 AM, Christopher Gross cogr...@gmail.com
   wrote:
  
Shawn,
How do I remove a collection from the SolrCloud?  I tried making
testcollection and it failed, but now it is listed on the Graph
 part
  of
the Cloud page for my Solr instances.  I tried using the delete on
   zkCli
but it still remains on that page.  The only reliable thing that I've
   found
is to wipe out the version-2 for all the zookeepers, restart them,
 then
reload my configs back in.
   
Thanks!
   
-- Chris
   
   
On Thu, Sep 4, 2014 at 4:12 AM, Shawn Heisey s...@elyograg.org
  wrote:
   
 On 9/2/2014 11:44 AM, Christopher Gross wrote:
  OK -- so I think my previous attempts were causing the problem.
  Since this is a dev environment (and is still empty), I just went
   ahead
 and
  wiped out the version-2 directories for the zookeeper nodes,
   reloaded
 my
  solr collections, then ran that command (zkcli.sh in the solr
   distro).
  That did work.  What is a reliable way to remove a file from
   Zookeeper?

 The zkcli that comes with zookeeper itself is really good for
  removing
 things.  It's not easy for a beginner to use, though.

 There is also at least one GUI option.  The only one that I've used
  is
 zookeeper client plugin for eclipse, because I use eclipse for
 other
 things.  It can be a little hard to figure out, but once you do,
 it's
 very useful for looking at and modifying zookeeper:



   
  
 
 http://www.massedynamic.org/mediawiki/index.php?title=Eclipse_Plug-in_for_ZooKeeper

 Thanks,
 Shawn


   
  
  
  
   --
  
   Anshum Gupta
   http://www.anshumgupta.net
  
 



 --

 Anshum Gupta
 http://www.anshumgupta.net

Re: HTTPS for SolrCloud

[Christopher Gross]

Once I upgraded to 4.9.0, the solr.ssl.checkPeerName option was used, and I
was able to create a collection.

I'm still wondering if there is a good way to remove references to any
collections that didn't complete, but block a collection from being made
with the same name?

Thanks!

-- Chris


On Tue, Sep 2, 2014 at 2:30 PM, Christopher Gross cogr...@gmail.com wrote:

 Is the solr.ssl.checkPeerName option available in 4.8.1?  I have my
 Tomcat starting up with that as a -D option, but I'm getting an exception
 on validating the hostname w/ the cert...

 -- Chris


 On Tue, Sep 2, 2014 at 1:44 PM, Christopher Gross cogr...@gmail.com
 wrote:

 OK -- so I think my previous attempts were causing the problem.
 Since this is a dev environment (and is still empty), I just went ahead
 and wiped out the version-2 directories for the zookeeper nodes, reloaded
 my solr collections, then ran that command (zkcli.sh in the solr distro).
 That did work.  What is a reliable way to remove a file from Zookeeper?

 Now I just get this error when trying to create a collection:
 org.apache.solr.client.solrj.SolrServerException:IOException occured when
 talking to server at: https://server:8444

 This brings up another problem that I have -- if there's an error
 creating a collection, if I fix the issue and try to re-create the
 collection, I get something like this:

 str name=Operation createcollection caused
 exception:org.apache.solr.common.SolrException:org.apache.solr.common.SolrException:
 collection already exists: testcollection/str

 How do I go about cleaning those up?  The only reliable thing that I've
 found is to wipe out the zookeepers and start over.

 Thanks Hoss!




 -- Chris


 On Tue, Sep 2, 2014 at 1:08 PM, Chris Hostetter hossman_luc...@fucit.org
  wrote:


 : ./zkcli.sh -zkhost localhost:2181 -cmd put /clusterprops.json
 : '{urlScheme:https}'
 ...
 : Next I start Tomcat, I get this:
 : 482  [localhost-startStop-1] ERROR org.apache.solr.core.SolrCore  â
 : null:org.noggit.JSONParser$ParseException: JSON Parse Error:
 : char=',position=0 BEFORE=''' AFTER='{urlScheme:https}''

 I can't reproduce the erorr you are describing when i follow all the
 steps on the SSL doc page (using bash, and the outer single quotes, just
 like you)...


 https://cwiki.apache.org/confluence/display/solr/Enabling+SSL#EnablingSSL-SolrCloud


 Are you certain that you  your solr nodes are talking to the same
 zookeeper instance?

 (Because according to that error, there is a stray sigle-quote at the
 begining of the clusterprops.json file in the ZK server solr is
 talking to, and as you already confirmed there's no single quotes in the
 string you read back from the zk server you are talking to ... perhaps
 there are 2 zk instances setup somewhere and the one solr is using still
 has crufty data from before you got the quoting issue straightened out?)


 do you see log messages early on in Solr's startup from ZkContainer that
 say...

 1359 [main] INFO  org.apache.solr.core.ZkContainer  – Zookeeper
 client=localhost:2181

 ?
 -Hoss
 http://www.lucidworks.com/

Re: HTTPS for SolrCloud

[Christopher Gross]

Getting closer.

I can at least get the file to be there, but I can't figure out what to put
into it.
I make a clusterprops.json file, and its had:
{ urlScheme: https }
{ \urlScheme\: \https\ }
{ \\urlScheme\\: \\https\\ }

Which gets loaded in like this:
./zkCli.sh -zkhost localhost:2181 -cmd put /cluserprops.json `cat
./clusterprops.json`
(and I've also tried just pushing those above values within the zkCli app
to no avail)

I always get a message like this:
Caused by: org.noggit.JSONParser$ParseException: Expected string:
char=\,position=1 BEFORE='{\' AFTER='urlScheme\:\https\}'

I'm not getting a whole lot on searches for clusterprops.json -- any
advice would be appreciated.


-- Chris


On Tue, Sep 2, 2014 at 8:59 AM, Christopher Gross cogr...@gmail.com wrote:

 Solr 4.8.1
 Java 1.7
 Tomcat 7.0.50
 Zookeeper 3.4.6

 Trying to get a SolrCloud running with https only.  I found this:
 https://issues.apache.org/jira/browse/SOLR-3854

 I don't have a clusterprops.json file, and running the zkCli command
 doesn't add one either.
 Command is along the lines of:
 ./zkCli.sh -zkhost host:port -cmd put /clusterprops.json
 '{urlScheme:https}'
 (run from the zookeeper/bin directory).

 I've done some googling, but I can't seem to figure out what I'm doing
 wrong.  I'm not getting an error message when doing the command.

 Any ideas?  Thanks.

 -- Chris

Re: HTTPS for SolrCloud

[Chris Hostetter]

First question: ignoring the oiginal jira (which may be out of date 
due to later improvements) have you seen the instructions? 

https://cwiki.apache.org/confluence/display/solr/Enabling+SSL#EnablingSSL-SolrCloud

: I always get a message like this:
: Caused by: org.noggit.JSONParser$ParseException: Expected string:
: char=\,position=1 BEFORE='{\' AFTER='urlScheme\:\https\}'

looks like you have literally backslash caractes in your JSON (evidently 
from your attempts to ecape the quote characters)

If you're having trouble with putting hte JSON directly in the command 
line (you're examples looked really contrived - which shell are you 
using?) you can always -putfile directly and bypass any concerns about 
the shell...

https://cwiki.apache.org/confluence/display/solr/Command+Line+Utilities



-Hoss
http://www.lucidworks.com/

Re: HTTPS for SolrCloud

[Christopher Gross]

Hi Hoss.

I did finally stumble onto that document (just after I posted my last
message, of course).
Using bash shell.

I've now tried those steps:

Tomcat is stopped.

First I run:
./zkcli.sh -zkhost localhost:2181 -cmd put /clusterprops.json
'{urlScheme:https}'

I confirm via the zookeeper-provided client:
[zk: localhost:2181(CONNECTED) 0] get /clusterprops.json
{urlScheme:https}
cZxid = 0x1053a
ctime = Tue Sep 02 16:11:09 GMT-00:00 2014
mZxid = 0x1053a
mtime = Tue Sep 02 16:11:09 GMT-00:00 2014
pZxid = 0x1053a
cversion = 0
dataVersion = 0
aclVersion = 0
ephemeralOwner = 0x0
dataLength = 21
numChildren = 0
[zk: localhost:2181(CONNECTED) 1]

Next I start Tomcat, I get this:
482  [localhost-startStop-1] ERROR org.apache.solr.core.SolrCore  â
null:org.noggit.JSONParser$ParseException: JSON Parse Error:
char=',position=0 BEFORE=''' AFTER='{urlScheme:https}''

I've done it with  without the quotes, based on commentary here:
http://qnalist.com/questions/4770318/solrcloud-and-https

I get the same error with loading in the props this way:
./zkcli.sh -zkhost localhost:2181 -cmd put /clusterprops.json
{\urlScheme\:\https\}

Error:
533  [localhost-startStop-1] ERROR org.apache.solr.core.SolrCore  â
null:org.noggit.JSONParser$ParseException: JSON Parse Error:
char=',position=0 BEFORE=''' AFTER='{urlScheme:https}''

putfile also nets the same error.

I'm not sure where I'm supposed to go from here.

Thanks!

-- Chris


On Tue, Sep 2, 2014 at 12:06 PM, Chris Hostetter hossman_luc...@fucit.org
wrote:


 First question: ignoring the oiginal jira (which may be out of date
 due to later improvements) have you seen the instructions?


 https://cwiki.apache.org/confluence/display/solr/Enabling+SSL#EnablingSSL-SolrCloud

 : I always get a message like this:
 : Caused by: org.noggit.JSONParser$ParseException: Expected string:
 : char=\,position=1 BEFORE='{\' AFTER='urlScheme\:\https\}'

 looks like you have literally backslash caractes in your JSON (evidently
 from your attempts to ecape the quote characters)

 If you're having trouble with putting hte JSON directly in the command
 line (you're examples looked really contrived - which shell are you
 using?) you can always -putfile directly and bypass any concerns about
 the shell...

 https://cwiki.apache.org/confluence/display/solr/Command+Line+Utilities



 -Hoss
 http://www.lucidworks.com/

Re: HTTPS for SolrCloud

[Christopher Gross]

Side note -- I've also tried adding the clusterprops.json file via
zookeeper's shell client on the command line, and within that client, all
with no luck.

-- Chris


On Tue, Sep 2, 2014 at 12:19 PM, Christopher Gross cogr...@gmail.com
wrote:

 Hi Hoss.

 I did finally stumble onto that document (just after I posted my last
 message, of course).
 Using bash shell.

 I've now tried those steps:

 Tomcat is stopped.

 First I run:
 ./zkcli.sh -zkhost localhost:2181 -cmd put /clusterprops.json
 '{urlScheme:https}'

 I confirm via the zookeeper-provided client:
 [zk: localhost:2181(CONNECTED) 0] get /clusterprops.json
 {urlScheme:https}
 cZxid = 0x1053a
 ctime = Tue Sep 02 16:11:09 GMT-00:00 2014
 mZxid = 0x1053a
 mtime = Tue Sep 02 16:11:09 GMT-00:00 2014
 pZxid = 0x1053a
 cversion = 0
 dataVersion = 0
 aclVersion = 0
 ephemeralOwner = 0x0
 dataLength = 21
 numChildren = 0
 [zk: localhost:2181(CONNECTED) 1]

 Next I start Tomcat, I get this:
 482  [localhost-startStop-1] ERROR org.apache.solr.core.SolrCore  â
 null:org.noggit.JSONParser$ParseException: JSON Parse Error:
 char=',position=0 BEFORE=''' AFTER='{urlScheme:https}''

 I've done it with  without the quotes, based on commentary here:
 http://qnalist.com/questions/4770318/solrcloud-and-https

 I get the same error with loading in the props this way:
 ./zkcli.sh -zkhost localhost:2181 -cmd put /clusterprops.json
 {\urlScheme\:\https\}

 Error:
 533  [localhost-startStop-1] ERROR org.apache.solr.core.SolrCore  â
 null:org.noggit.JSONParser$ParseException: JSON Parse Error:
 char=',position=0 BEFORE=''' AFTER='{urlScheme:https}''

 putfile also nets the same error.

 I'm not sure where I'm supposed to go from here.

 Thanks!

 -- Chris


 On Tue, Sep 2, 2014 at 12:06 PM, Chris Hostetter hossman_luc...@fucit.org
  wrote:


 First question: ignoring the oiginal jira (which may be out of date
 due to later improvements) have you seen the instructions?


 https://cwiki.apache.org/confluence/display/solr/Enabling+SSL#EnablingSSL-SolrCloud

 : I always get a message like this:
 : Caused by: org.noggit.JSONParser$ParseException: Expected string:
 : char=\,position=1 BEFORE='{\' AFTER='urlScheme\:\https\}'

 looks like you have literally backslash caractes in your JSON (evidently
 from your attempts to ecape the quote characters)

 If you're having trouble with putting hte JSON directly in the command
 line (you're examples looked really contrived - which shell are you
 using?) you can always -putfile directly and bypass any concerns about
 the shell...

 https://cwiki.apache.org/confluence/display/solr/Command+Line+Utilities



 -Hoss
 http://www.lucidworks.com/

Re: HTTPS for SolrCloud

[Chris Hostetter]

: ./zkcli.sh -zkhost localhost:2181 -cmd put /clusterprops.json
: '{urlScheme:https}'
...
: Next I start Tomcat, I get this:
: 482  [localhost-startStop-1] ERROR org.apache.solr.core.SolrCore  â
: null:org.noggit.JSONParser$ParseException: JSON Parse Error:
: char=',position=0 BEFORE=''' AFTER='{urlScheme:https}''

I can't reproduce the erorr you are describing when i follow all the 
steps on the SSL doc page (using bash, and the outer single quotes, just 
like you)...

https://cwiki.apache.org/confluence/display/solr/Enabling+SSL#EnablingSSL-SolrCloud


Are you certain that you  your solr nodes are talking to the same 
zookeeper instance?

(Because according to that error, there is a stray sigle-quote at the 
begining of the clusterprops.json file in the ZK server solr is 
talking to, and as you already confirmed there's no single quotes in the 
string you read back from the zk server you are talking to ... perhaps 
there are 2 zk instances setup somewhere and the one solr is using still 
has crufty data from before you got the quoting issue straightened out?)


do you see log messages early on in Solr's startup from ZkContainer that 
say...

1359 [main] INFO  org.apache.solr.core.ZkContainer  – Zookeeper 
client=localhost:2181

?
-Hoss
http://www.lucidworks.com/

Re: HTTPS for SolrCloud

[Christopher Gross]

OK -- so I think my previous attempts were causing the problem.
Since this is a dev environment (and is still empty), I just went ahead and
wiped out the version-2 directories for the zookeeper nodes, reloaded my
solr collections, then ran that command (zkcli.sh in the solr distro).
That did work.  What is a reliable way to remove a file from Zookeeper?

Now I just get this error when trying to create a collection:
org.apache.solr.client.solrj.SolrServerException:IOException occured when
talking to server at: https://server:8444

This brings up another problem that I have -- if there's an error creating
a collection, if I fix the issue and try to re-create the collection, I get
something like this:

str name=Operation createcollection caused
exception:org.apache.solr.common.SolrException:org.apache.solr.common.SolrException:
collection already exists: testcollection/str

How do I go about cleaning those up?  The only reliable thing that I've
found is to wipe out the zookeepers and start over.

Thanks Hoss!




-- Chris


On Tue, Sep 2, 2014 at 1:08 PM, Chris Hostetter hossman_luc...@fucit.org
wrote:


 : ./zkcli.sh -zkhost localhost:2181 -cmd put /clusterprops.json
 : '{urlScheme:https}'
 ...
 : Next I start Tomcat, I get this:
 : 482  [localhost-startStop-1] ERROR org.apache.solr.core.SolrCore  â
 : null:org.noggit.JSONParser$ParseException: JSON Parse Error:
 : char=',position=0 BEFORE=''' AFTER='{urlScheme:https}''

 I can't reproduce the erorr you are describing when i follow all the
 steps on the SSL doc page (using bash, and the outer single quotes, just
 like you)...


 https://cwiki.apache.org/confluence/display/solr/Enabling+SSL#EnablingSSL-SolrCloud


 Are you certain that you  your solr nodes are talking to the same
 zookeeper instance?

 (Because according to that error, there is a stray sigle-quote at the
 begining of the clusterprops.json file in the ZK server solr is
 talking to, and as you already confirmed there's no single quotes in the
 string you read back from the zk server you are talking to ... perhaps
 there are 2 zk instances setup somewhere and the one solr is using still
 has crufty data from before you got the quoting issue straightened out?)


 do you see log messages early on in Solr's startup from ZkContainer that
 say...

 1359 [main] INFO  org.apache.solr.core.ZkContainer  – Zookeeper
 client=localhost:2181

 ?
 -Hoss
 http://www.lucidworks.com/

Re: HTTPS for SolrCloud

[Christopher Gross]

Is the solr.ssl.checkPeerName option available in 4.8.1?  I have my Tomcat
starting up with that as a -D option, but I'm getting an exception on
validating the hostname w/ the cert...

-- Chris


On Tue, Sep 2, 2014 at 1:44 PM, Christopher Gross cogr...@gmail.com wrote:

 OK -- so I think my previous attempts were causing the problem.
 Since this is a dev environment (and is still empty), I just went ahead
 and wiped out the version-2 directories for the zookeeper nodes, reloaded
 my solr collections, then ran that command (zkcli.sh in the solr distro).
 That did work.  What is a reliable way to remove a file from Zookeeper?

 Now I just get this error when trying to create a collection:
 org.apache.solr.client.solrj.SolrServerException:IOException occured when
 talking to server at: https://server:8444

 This brings up another problem that I have -- if there's an error creating
 a collection, if I fix the issue and try to re-create the collection, I get
 something like this:

 str name=Operation createcollection caused
 exception:org.apache.solr.common.SolrException:org.apache.solr.common.SolrException:
 collection already exists: testcollection/str

 How do I go about cleaning those up?  The only reliable thing that I've
 found is to wipe out the zookeepers and start over.

 Thanks Hoss!




 -- Chris


 On Tue, Sep 2, 2014 at 1:08 PM, Chris Hostetter hossman_luc...@fucit.org
 wrote:


 : ./zkcli.sh -zkhost localhost:2181 -cmd put /clusterprops.json
 : '{urlScheme:https}'
 ...
 : Next I start Tomcat, I get this:
 : 482  [localhost-startStop-1] ERROR org.apache.solr.core.SolrCore  â
 : null:org.noggit.JSONParser$ParseException: JSON Parse Error:
 : char=',position=0 BEFORE=''' AFTER='{urlScheme:https}''

 I can't reproduce the erorr you are describing when i follow all the
 steps on the SSL doc page (using bash, and the outer single quotes, just
 like you)...


 https://cwiki.apache.org/confluence/display/solr/Enabling+SSL#EnablingSSL-SolrCloud


 Are you certain that you  your solr nodes are talking to the same
 zookeeper instance?

 (Because according to that error, there is a stray sigle-quote at the
 begining of the clusterprops.json file in the ZK server solr is
 talking to, and as you already confirmed there's no single quotes in the
 string you read back from the zk server you are talking to ... perhaps
 there are 2 zk instances setup somewhere and the one solr is using still
 has crufty data from before you got the quoting issue straightened out?)


 do you see log messages early on in Solr's startup from ZkContainer that
 say...

 1359 [main] INFO  org.apache.solr.core.ZkContainer  – Zookeeper
 client=localhost:2181

 ?
 -Hoss
 http://www.lucidworks.com/