Hello there,
we have issues setting up Solr authentication/authorization using
/var/solr/data/security.json. We are using version 8.11.1 in standalone mode.
Here is our redacted security.json:
{
"authentication":{
"class":"solr.BasicAuthPlugin",
"blockUnknown": true,
"credentials":{
"readuser":"...",
"writeuser": "..."
}
},
"authorization":{
"class":"solr.RuleBasedAuthorizationPlugin",
"user-role":{
"readuser": "read",
"writeuser": "write"
},
"permissions":[
{ "name": "read", "role": "read" },
{ "name": "all", "role": "write"}
]
}
}
We want that readuser should be able to read, and writeuser to do anything...
BUT, In reality, readuser can read, but we get "403 Unauthorized request" if
writeuser tries to read. If we put "{ "name": "all", "role": "write"}" in the
first position of the array, then writeuser can do everything, and readuser get
"403 Unauthorized request".
Any idea of what is happening here?
Thanks
Grazie,
Matteo
Fondazione The Microsoft Research - University of Trento Centre for
Computational and Systems Biology (COSBI)
Piazza Manifattura 1, 38068 Rovereto (TN), Italy
tomas...@cosbi.eu<https://webmail.cosbi.eu/owa/redir.aspx?C=VNXi3_8-qSZTBi-FPvMwmwSB3IhCOjY8nuCBIfcNIs_5SgD-zNPWCA..&URL=mailto%3acalabro%40cosbi.eu>
http://www.cosbi.eu<https://webmail.cosbi.eu/owa/redir.aspx?C=CkilyF54_imtLHzZqF1gCGvmYXjsnf4bzGynd8OXm__5SgD-zNPWCA..&URL=http%3a%2f%2fwww.cosbi.eu%2f>
As for the European General Data Protection Regulation 2016/679 on the
protection of natural persons with regard to the processing of personal data,
we inform you that all the data we possess are object of treatment in the
respect of the normative provided for by the cited GDPR.
It is your right to be informed on which of your data are used and how; you may
ask for their correction, cancellation or you may oppose to their use by
written request sent by recorded delivery to The Microsoft Research –
University of Trento Centre for Computational and Systems Biology Scarl, Piazza
Manifattura 1, 38068 Rovereto (TN), Italy.
P Please don't print this e-mail unless you really need to
