[jira] [Commented] (SOLR-15237) Distributed search with index sharding is not working with basic authentication plugin enabled

["Mark Robert Miller (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/SOLR-15237?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17462535#comment-17462535 ] 

Mark Robert Miller commented on SOLR-15237:
-------------------------------------------

So in this case, things were changed so that the PKIAuthenticationPlugin is required for the basic auth plugin to function. In SolrCloud, it's added automatically. So if you just set up the BasicAuthPlugin, it will not register any intercepts - the basic auth intercepts are now called from the PKIAuthenticationPlugin -- even if it's not used (forwardCredentials=true).

I imagine it's easy for our tests to have missed this because when I made sure a standalone mode basic auth test did something that would fail on this, it passed – because for some reason, 'unknown user' (equivalent to no security headers) was setup to succeed.

Anyway, fix is relatively simple, let the basic auth plugin register its own intercepts in standalone mode as it used to.

 

> Distributed search with index sharding is not working with basic authentication plugin enabled
> ----------------------------------------------------------------------------------------------
>
>                 Key: SOLR-15237
>                 URL: https://issues.apache.org/jira/browse/SOLR-15237
>             Project: Solr
>          Issue Type: Bug
>          Components: Authentication
>    Affects Versions: 7.7.3, 8.7, 8.8.1
>            Reporter: Samir Huremovic
>            Assignee: Mark Robert Miller
>            Priority: Critical
>              Labels: Authentication
>
> Issue confirmed for 7.7.3, 8.7 and 8.8.1.
> Steps to reproduce are:
> 1. Following the docs for setting up distributed search (https://solr.apache.org/guide/8_8/distributed-search-with-index-sharding.html).
> 1.1 Stop both nodes after confirming that distributed search works without basic auth (last step).
> 2. Enable basic authentication plugin for both nodes, example for node1 {{example/nodes/node1/security.json}}:
> {noformat}
> "authentication":{ 
>    "blockUnknown": true, 
>    "class":"solr.BasicAuthPlugin",
>    "credentials":{"solr":"IV0EHq1OnNrj6gvRCwvFwTrZ1+z1oBbnQdiVC3otuq0= Ndd7LKvVBAaZIF0QAVi1ekCfAJXr1GGfLtRUXhgrF8c="}, 
>    "realm":"My Solr users", 
>    "forwardCredentials": false 
> }}
> {noformat}
> 3. Configure {{shardsWhitelist}} in {{solr.xml}} for both nodes, example for node1 {{example/nodes/node1/solr.xml}}
> {noformat}
> <shardHandlerFactory name="shardHandlerFactory"
>     class="HttpShardHandlerFactory">
>     <int name="socketTimeout">${socketTimeout:600000}</int>
>     <int name="connTimeout">${connTimeout:60000}</int>
>     <str name="shardsWhitelist">localhost:8984,localhost:8985</str>
>   </shardHandlerFactory>
> {noformat}
> 4. Start both nodes.
> 5. Confirm that searching on one node with basic auth works with {{curl --user solr:SolrRocks "http://localhost:8984/solr/core1/select?q=*:*&wt=xml&indent=true"}}
> 6. Confirm that searching on both nodes does not work with {{curl --user solr:SolrRocks "http://localhost:8984/solr/core1/select?q=*:*&indent=true&shards=localhost:8985/solr/core1,localhost:8984/solr/core1&fl=id,name&wt=xml"}}
> Error:
> {noformat}
> ❯ curl --user solr:SolrRocks "http://localhost:8984/solr/core1/select?q=*:*&indent=true&shards=localhost:8985/solr/core1,localhost:8984/solr/core1&fl=id,name&wt=xml"
> <?xml version="1.0" encoding="UTF-8"?>
> <response>
> <lst name="responseHeader">
>   <int name="status">401</int>
>   <int name="QTime">173</int>
>   <lst name="params">
>     <str name="q">*:*</str>
>     <str name="shards">localhost:8985/solr/core1,localhost:8984/solr/core1</str>
>     <str name="indent">true</str>
>     <str name="fl">id,name</str>
>     <str name="wt">xml</str>
>   </lst>
> </lst>
> <lst name="error">
>   <lst name="metadata">
>     <str name="error-class">org.apache.solr.client.solrj.impl.BaseHttpSolrClient$RemoteSolrException</str>
>     <str name="root-error-class">org.apache.solr.client.solrj.impl.BaseHttpSolrClient$RemoteSolrException</str>
>   </lst>
>   <str name="msg">Error from server at null: Expected mime type application/octet-stream but got text/html. &lt;html&gt;
> &lt;head&gt;
> &lt;meta http-equiv="Content-Type" content="text/html;charset=utf-8"/&gt;
> &lt;title&gt;Error 401 require authentication&lt;/title&gt;
> &lt;/head&gt;
> &lt;body&gt;&lt;h2&gt;HTTP ERROR 401 require authentication&lt;/h2&gt;
> &lt;table&gt;
> &lt;tr&gt;&lt;th&gt;URI:&lt;/th&gt;&lt;td&gt;/solr/core1/select&lt;/td&gt;&lt;/tr&gt;
> &lt;tr&gt;&lt;th&gt;STATUS:&lt;/th&gt;&lt;td&gt;401&lt;/td&gt;&lt;/tr&gt;
> &lt;tr&gt;&lt;th&gt;MESSAGE:&lt;/th&gt;&lt;td&gt;require authentication&lt;/td&gt;&lt;/tr&gt;
> &lt;tr&gt;&lt;th&gt;SERVLET:&lt;/th&gt;&lt;td&gt;default&lt;/td&gt;&lt;/tr&gt;
> &lt;/table&gt;
> &lt;/body&gt;
> &lt;/html&gt;
> </str>
>   <int name="code">401</int>
> </lst>
> </response>
> {noformat}
> See also SOLR-14569 that seems similar, but the patch provided does not help after I applied it to 8.8.1, therefore I think this is not the same issue.
> Adjust priority as necessary. For cases where basic auth is required this means we cannot use Solr as of now.



--
This message was sent by Atlassian Jira
(v8.20.1#820001)

---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org