It's only a hole if you fail to include a role for "all" thereby signalling
that anything not otherwise defined requires a role ("admin" in the example
below, taken from the linked security.json in this thread)
{
"name": "all",
"role": "admin"
}
That detail is confusing and error-prone, and I keep hoping I'll find time
to create a clearer alternative to our current rule based authz.
It's important to remember the difference between authentication and
authorization. In any system if you want unauthenticated users to do
anything, you MUST rely solely on authorization to control access. That is
by definition. Authentication is merely the process of identifying the
user, and if you want any unidentified user to pass through that layer they
all have to. Authorization then decides if users that have not been
identified (unauthenticated) are allowed to execute the request..
I have not recently made it happen, but in theory you should be able to
grant access to all roles with '*' but if you are going to do this and you
do need to defend the rest of Solr, it is critical that you read and
understand
https://solr.apache.org/guide/solr/latest/deployment-guide/rule-based-authorization-plugin.html#permission-ordering-and-resolution
(which is no small feat). And it is even more critical that you test your
configuration thoroughly.
If you are unable to protect everything but queries with
blockUnknown:false, a rule for all, and * as the required role for queries
then you may have found a bug.
-Gus
On Fri, Oct 30, 2026 at 1:38 PM Dmitri Maziuk <[email protected]>
wrote:
> On 10/26/26 19:00, Jan Høydahl wrote:
> > Please see the default security.json template that ships with solr and
> that is activated whenever you activate basicAuth from bin/solr auth
> command.
> >
>
> So the problem with both solutions is the terrible horrible "blockUnown
> defaults to false" security hole. Some knee-jerk security professional
> put it into nessus from where it got into tenalbe, that got me a "medium
> vulnerability" security fail, which prompted that question.
>
> Thanks everyone
> Dima
>
>
>
--
http://www.needhamsoftware.com (work)
https://a.co/d/b2sZLD9 (my fantasy fiction book)
