You are viewing a plain text version of this content. The canonical link for it is here.
Posted to solr-user@lucene.apache.org by "Vanalli, Ali A - DOT" <Al...@dot.wi.gov> on 2020/08/28 19:26:56 UTC
BasicAuth help
Hello,
Solr is running on windows machine and wondering if it possible to setup BasicAuth with the LDAP?
Also, tried the example of Basic-Authentication that is published here<https://lucene.apache.org/solr/guide/8_6/rule-based-authorization-plugin.html#rule-based-authorization-plugin> but this did not work too.
Thanks...Ali
Re: BasicAuth help
Posted by Dwane Hall <dw...@hotmail.com>.
Just adding some assistance to the Solr-LDAP integration options. A colleague of mine wrote a plugin that adopts a similar approach to the one Jan suggested of "plugging-in" an LDAP provider.
He provides the following notes on its design and use
1. It authenticates with LDAP on every request which can be expensive. In the same repo he's written an optimisation for a gremlin-ldap-plugin that can probably be ported here (Once LDAP successfully authenticates, caches credentials locally by BCrypt hashing it and using the cached hash to validate subsequent requests until cache timeout which is when it goes back to LDAP again. So, any password changes in LDAP are reflected correctly. This caching can be turned on and off with a param based on how expensive the LDAP auth is).
2. He had to copy large swaths of code from org.apache.solr.security.RuleBasedAuthorizationPlugin into the ldap authorisation plugin because the Solr class is not extensible. A refactor the class to make the extension easier would prevent this.
3. Finally, the inter-node authentication. Need to look into it to see if there is a mechanism to extend the inter-node auth to include roles in the payload so that LDAP role look up isn’t happening on every node that request ends up hitting.
But if someone really wants LDAP integration they can use it as is. It's a good starting point anyway. (https://github.com/vjgorla/solr-ldap-plugin)
Thanks,
Dwane
________________________________
From: Jan Høydahl <ja...@cominvent.com>
Sent: Monday, 7 September 2020 5:21 PM
To: solr-user@lucene.apache.org <so...@lucene.apache.org>
Subject: Re: BasicAuth help
That github patch is interesting.
My initial proposal for how to plug LDAP into Solr was to make the AuthenticationProvider pluggable in BasicAuthPlugin, so you could plug in an LDAPAuthProvider. See https://issues.apache.org/jira/browse/SOLR-8951 <https://issues.apache.org/jira/browse/SOLR-8951>. No need to replace the whole BasicAuth class I think. Anyone who wants to give it a shot, borrowing some code from the ldap_solr repo, feel free :)
Jan
> 4. sep. 2020 kl. 09:43 skrev Aroop Ganguly <ar...@icloud.com.INVALID>:
>
> Try looking at a simple ldap authentication suggested here: https://github.com/itzmestar/ldap_solr <https://github.com/itzmestar/ldap_solr>
> You can combine this for authentication and couple it with rule based authorization.
>
>
>
>> On Aug 28, 2020, at 12:26 PM, Vanalli, Ali A - DOT <Ali.Vanalli@dot.wi.gov <ma...@dot.wi.gov>> wrote:
>>
>> Hello,
>>
>> Solr is running on windows machine and wondering if it possible to setup BasicAuth with the LDAP?
>>
>> Also, tried the example of Basic-Authentication that is published here<https://lucene.apache.org/solr/guide/8_6/rule-based-authorization-plugin.html#rule-based-authorization-plugin <https://lucene.apache.org/solr/guide/8_6/rule-based-authorization-plugin.html#rule-based-authorization-plugin>> but this did not work too.
>>
>> Thanks...Ali
>>
>>
>
Re: BasicAuth help
Posted by Jan Høydahl <ja...@cominvent.com>.
That github patch is interesting.
My initial proposal for how to plug LDAP into Solr was to make the AuthenticationProvider pluggable in BasicAuthPlugin, so you could plug in an LDAPAuthProvider. See https://issues.apache.org/jira/browse/SOLR-8951 <https://issues.apache.org/jira/browse/SOLR-8951>. No need to replace the whole BasicAuth class I think. Anyone who wants to give it a shot, borrowing some code from the ldap_solr repo, feel free :)
Jan
> 4. sep. 2020 kl. 09:43 skrev Aroop Ganguly <ar...@icloud.com.INVALID>:
>
> Try looking at a simple ldap authentication suggested here: https://github.com/itzmestar/ldap_solr <https://github.com/itzmestar/ldap_solr>
> You can combine this for authentication and couple it with rule based authorization.
>
>
>
>> On Aug 28, 2020, at 12:26 PM, Vanalli, Ali A - DOT <Ali.Vanalli@dot.wi.gov <ma...@dot.wi.gov>> wrote:
>>
>> Hello,
>>
>> Solr is running on windows machine and wondering if it possible to setup BasicAuth with the LDAP?
>>
>> Also, tried the example of Basic-Authentication that is published here<https://lucene.apache.org/solr/guide/8_6/rule-based-authorization-plugin.html#rule-based-authorization-plugin <https://lucene.apache.org/solr/guide/8_6/rule-based-authorization-plugin.html#rule-based-authorization-plugin>> but this did not work too.
>>
>> Thanks...Ali
>>
>>
>
Re: BasicAuth help
Posted by Joe Doupnik <jr...@netlab1.net>.
There is an effective alternative approach to placing
authentication within Solr. It is to use the web server (say Apache) as
a smart proxy to Solr and in so doing also apply access restrictions of
various kinds. Thus Solr remains intact, no addition needed for
authentication, and authentication can be accomplished with a known
robust tool.
Sketching the Apache part, to clarify matters. This example
requires both an IP range and an LDAP authentication, and it supports
https as well.
<Location /solr>
require ip 11.22.33.44/24 5.6.7.8/28
AuthType Basic
AuthBasicProvider ldap
AuthName "Solr"
AuthLDAPUrl ldap://example.com/o=GCHQ?uid?one?(objectClass=user)
require ldap-user admin james moneypenny
proxypass "http://localhost:8983/solr" keepalive=on
proxypassreverse "http://localhost:8983/solr"
</Location>
Above, localhost can be replaced with the DNS name of another
machine, that where Solr itself resides. The URI name /solr is clearly
something which we can choose to suit ourselves. This example may be
enhanced for local requirements.
The Apache manual has full details, naturally. It is important to
use proven robust tools when we deal with the bad guys.
Thanks,
Joe D.
On 04/09/2020 08:43, Aroop Ganguly wrote:
> Try looking at a simple ldap authentication suggested here: https://github.com/itzmestar/ldap_solr <https://github.com/itzmestar/ldap_solr>
> You can combine this for authentication and couple it with rule based authorization.
>
>
>
>> On Aug 28, 2020, at 12:26 PM, Vanalli, Ali A - DOT <Ali.Vanalli@dot.wi.gov <ma...@dot.wi.gov>> wrote:
>>
>> Hello,
>>
>> Solr is running on windows machine and wondering if it possible to setup BasicAuth with the LDAP?
>>
>> Also, tried the example of Basic-Authentication that is published here<https://lucene.apache.org/solr/guide/8_6/rule-based-authorization-plugin.html#rule-based-authorization-plugin <https://lucene.apache.org/solr/guide/8_6/rule-based-authorization-plugin.html#rule-based-authorization-plugin>> but this did not work too.
>>
>> Thanks...Ali
>>
>>
>
Re: BasicAuth help
Posted by Aroop Ganguly <ar...@icloud.com.INVALID>.
Try looking at a simple ldap authentication suggested here: https://github.com/itzmestar/ldap_solr <https://github.com/itzmestar/ldap_solr>
You can combine this for authentication and couple it with rule based authorization.
> On Aug 28, 2020, at 12:26 PM, Vanalli, Ali A - DOT <Ali.Vanalli@dot.wi.gov <ma...@dot.wi.gov>> wrote:
>
> Hello,
>
> Solr is running on windows machine and wondering if it possible to setup BasicAuth with the LDAP?
>
> Also, tried the example of Basic-Authentication that is published here<https://lucene.apache.org/solr/guide/8_6/rule-based-authorization-plugin.html#rule-based-authorization-plugin <https://lucene.apache.org/solr/guide/8_6/rule-based-authorization-plugin.html#rule-based-authorization-plugin>> but this did not work too.
>
> Thanks...Ali
>
>
Re: BasicAuth help
Posted by Jason Gerlowski <ge...@gmail.com>.
Hi Ali,
1. Solr doesn't have any support for LDAP authentication ootb (at
least, as far as I'm aware). The BasicAuth plugin requires users to
be defined in the JSON configuration.
2. What failed when you ran the documented BasicAuth example? What
error messages did you get etc.? If there's something wrong with that
example, maybe we can fix the docs.
Jason
On Fri, Aug 28, 2020 at 3:28 PM Vanalli, Ali A - DOT
<Al...@dot.wi.gov> wrote:
>
> Hello,
>
> Solr is running on windows machine and wondering if it possible to setup BasicAuth with the LDAP?
>
> Also, tried the example of Basic-Authentication that is published here<https://lucene.apache.org/solr/guide/8_6/rule-based-authorization-plugin.html#rule-based-authorization-plugin> but this did not work too.
>
> Thanks...Ali
>
>