Re: Issue Using Solr 5.3 Authentication and Authorization Plugins

Kevin & Noble, I've manually verified the fix for SOLR-8000, but not yet for SOLR-8004. I reproduced the initial problem with reloading security.json after restarting both Solr and ZooKeeper. I verified using zkcli.sh that ZooKeeper does retain the changes to the file after using

Re: Issue Using Solr 5.3 Authentication and Authorization Plugins

SOLR-8004 also appears to work to me. I manually edited security.json and did putfile. I didn't bother with browse permission, because it was Kevin's workaround.solr-5.3.1-SNAPSHOT did challenge me for credentials when going to curl

Re: Issue Using Solr 5.3 Authentication and Authorization Plugins

Thanks Dan! Please let us know what you find. I’m interested to know if this is an issue with anyone else’s setup or if I have an issue in my local configuration that is still preventing it to work on start/restart. - Kevin > On Sep 5, 2015, at 8:45 AM, Dan Davis wrote:

Re: Issue Using Solr 5.3 Authentication and Authorization Plugins

Kevin & Noble, I'll take it on to test this. I've built from source before, and I've wanted this authorization capability for awhile. On Fri, Sep 4, 2015 at 9:59 AM, Kevin Lee wrote: > Noble, > > Does SOLR-8000 need to be re-opened? Has anyone else been able to

Re: Issue Using Solr 5.3 Authentication and Authorization Plugins

Hi Kevin/Noble, What is the download link to take the latest? What are the steps to compile it, test and use? We also have a use case to have this feature in solr too. Therefore, wanted to test and above info would help a lot to get started. Thanks. On Fri, Sep 4, 2015 at 1:45 PM, Kevin Lee

Re: Issue Using Solr 5.3 Authentication and Authorization Plugins

There are no download links for 5.3.x branch till we do a bug fix release If you wish to download the trunk nightly (which is not same as 5.3.0) check here https://builds.apache.org/job/Solr-Artifacts-trunk/lastSuccessfulBuild/artifact/solr/package/ If you wish to get the binaries for 5.3

Re: Issue Using Solr 5.3 Authentication and Authorization Plugins

Noble, Does SOLR-8000 need to be re-opened? Has anyone else been able to test the restart fix? At startup, these are the log messages that say there is no security configuration and the plugins aren’t being used even though security.json is in Zookeeper: 2015-09-04 08:06:21.205 INFO

Re: Issue Using Solr 5.3 Authentication and Authorization Plugins

Thanks, I downloaded the source and compiled it and replaced the jar file in the dist and solr-webapp’s WEB-INF/lib directory. It does seem to be protecting the Collections API reload command now as long as I upload the security.json after startup of the Solr instances. If I shutdown and

Re: Issue Using Solr 5.3 Authentication and Authorization Plugins

Both these are committed. If you could test with the latest 5.3 branch it would be helpful On Wed, Sep 2, 2015 at 5:11 PM, Noble Paul wrote: > I opened a ticket for the same > https://issues.apache.org/jira/browse/SOLR-8004 > > On Wed, Sep 2, 2015 at 1:36 PM, Kevin Lee

Re: Issue Using Solr 5.3 Authentication and Authorization Plugins

I’ve found that completely exiting Chrome or Firefox and opening it back up re-prompts for credentials when they are required. It was re-prompting with the /browse path where authentication was working each time I completely exited and started the browser again, however it won’t re-prompt

Re: Issue Using Solr 5.3 Authentication and Authorization Plugins

" However, after uploading the new security.json and restarting the web browser," The browser remembers your login , So it is unlikely to prompt for the credentials again. Why don't you try the RELOAD operation using command line (curl) ? On Tue, Sep 1, 2015 at 10:31 PM, Kevin Lee

Re: Issue Using Solr 5.3 Authentication and Authorization Plugins

I opened a ticket for the same https://issues.apache.org/jira/browse/SOLR-8004 On Wed, Sep 2, 2015 at 1:36 PM, Kevin Lee wrote: > I’ve found that completely exiting Chrome or Firefox and opening it back up > re-prompts for credentials when they are required. It was

Re: Issue Using Solr 5.3 Authentication and Authorization Plugins

The restart issues aside, I’m trying to lockdown usage of the Collections API, but that also does not seem to be working either. Here is my security.json. I’m using the “collection-admin-edit” permission and assigning it to the “adminRole”. However, after uploading the new security.json and

Re: Issue Using Solr 5.3 Authentication and Authorization Plugins

Thanks for the clarification! So is the wiki page incorrect at https://cwiki.apache.org/confluence/display/solr/Basic+Authentication+Plugin which says that the admin ui will require authentication once the authorization plugin is activated? "An authorization plugin is also available to

Re: Issue Using Solr 5.3 Authentication and Authorization Plugins

Admin UI is not protected by any of these permissions. Only if you try to perform a protected operation , it asks for a password. I'll investigate the restart problem and report my findings On Tue, Sep 1, 2015 at 3:10 AM, Kevin Lee wrote: > Anyone else running into

Re: Issue Using Solr 5.3 Authentication and Authorization Plugins

I removed that statement "If activating the authorization plugin doesn't protect the admin ui, how does one protect access to it?" One does not need to protect the admin UI. You only need to protect the relevant API calls . I mean it's OK to not protect the CSS and HTML stuff. But if you

Re: Issue Using Solr 5.3 Authentication and Authorization Plugins

I'm investigating why restarts or first time start does not read the security.json On Tue, Sep 1, 2015 at 1:00 PM, Noble Paul wrote: > I removed that statement > > "If activating the authorization plugin doesn't protect the admin ui, > how does one protect access to it?" >

Re: Issue Using Solr 5.3 Authentication and Authorization Plugins

Hi Kevin, Were you able to get a workaround / fix for your problem ? I'm also looking to secure Collection and Update APIs by upgrading to 5.3. Just wondering if it's worth the upgrade or should I wait for the next version, which will probably address this. Regards, Shamik -- View this

Re: Issue Using Solr 5.3 Authentication and Authorization Plugins

Looks like there is a bug in that . On start/restart the security.json is not loaded I shall open a ticket https://issues.apache.org/jira/browse/SOLR-8000 On Tue, Sep 1, 2015 at 1:01 PM, Noble Paul wrote: > I'm investigating why restarts or first time start does not read

Re: Issue Using Solr 5.3 Authentication and Authorization Plugins

Anyone else running into any issues trying to get the authentication and authorization plugins in 5.3 working? > On Aug 29, 2015, at 2:30 AM, Kevin Lee wrote: > > Hi, > > I’m trying to use the new basic auth plugin for Solr 5.3 and it doesn’t seem > to be working