You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@lucene.apache.org by no...@apache.org on 2015/12/18 09:40:38 UTC
svn commit: r1720729 - in /lucene/dev/trunk/solr: CHANGES.txt
core/src/java/org/apache/solr/security/BasicAuthPlugin.java
core/src/test/org/apache/solr/security/TestSha256AuthenticationProvider.java
Author: noble
Date: Fri Dec 18 08:40:38 2015
New Revision: 1720729
URL: http://svn.apache.org/viewvc?rev=1720729&view=rev
Log:
SOLR-8434: Add a flag 'blockUnknown' to BasicAuthPlugin to block unauthenticated requests
Modified:
lucene/dev/trunk/solr/CHANGES.txt
lucene/dev/trunk/solr/core/src/java/org/apache/solr/security/BasicAuthPlugin.java
lucene/dev/trunk/solr/core/src/test/org/apache/solr/security/TestSha256AuthenticationProvider.java
Modified: lucene/dev/trunk/solr/CHANGES.txt
URL: http://svn.apache.org/viewvc/lucene/dev/trunk/solr/CHANGES.txt?rev=1720729&r1=1720728&r2=1720729&view=diff
==============================================================================
--- lucene/dev/trunk/solr/CHANGES.txt (original)
+++ lucene/dev/trunk/solr/CHANGES.txt Fri Dec 18 08:40:38 2015
@@ -231,6 +231,8 @@ New Features
* SOLR-4280: Allow specifying "spellcheck.maxResultsForSuggest" as a percentage of filter
query results (Markus Jelsma via James Dyer)
+* SOLR-8434: Add a flag 'blockUnknown' to BasicAuthPlugin to block unauthenticated requests (noble)
+
Bug Fixes
----------------------
Modified: lucene/dev/trunk/solr/core/src/java/org/apache/solr/security/BasicAuthPlugin.java
URL: http://svn.apache.org/viewvc/lucene/dev/trunk/solr/core/src/java/org/apache/solr/security/BasicAuthPlugin.java?rev=1720729&r1=1720728&r2=1720729&view=diff
==============================================================================
--- lucene/dev/trunk/solr/core/src/java/org/apache/solr/security/BasicAuthPlugin.java (original)
+++ lucene/dev/trunk/solr/core/src/java/org/apache/solr/security/BasicAuthPlugin.java Fri Dec 18 08:40:38 2015
@@ -29,25 +29,24 @@ import java.io.UnsupportedEncodingExcept
import java.security.Principal;
import java.util.List;
import java.util.Map;
+import java.util.Set;
import java.util.StringTokenizer;
+import com.google.common.collect.ImmutableSet;
import org.apache.commons.codec.binary.Base64;
import org.apache.http.Header;
-import org.apache.http.HttpException;
-import org.apache.http.HttpRequest;
-import org.apache.http.HttpRequestInterceptor;
import org.apache.http.auth.BasicUserPrincipal;
-import org.apache.http.impl.client.DefaultHttpClient;
import org.apache.http.message.BasicHeader;
-import org.apache.http.protocol.HttpContext;
-import org.apache.solr.client.solrj.impl.HttpClientConfigurer;
import org.apache.solr.common.SolrException;
-import org.apache.solr.common.params.SolrParams;
import org.apache.solr.util.CommandOperation;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
public class BasicAuthPlugin extends AuthenticationPlugin implements ConfigEditablePlugin {
+ private static final Logger log = LoggerFactory.getLogger(BasicAuthPlugin.class);
private AuthenticationProvider zkAuthentication;
private final static ThreadLocal<Header> authHeader = new ThreadLocal<>();
+ private boolean blockUnknown = false;
public boolean authenticate(String username, String pwd) {
return zkAuthentication.authenticate(username, pwd);
@@ -55,11 +54,31 @@ public class BasicAuthPlugin extends Aut
@Override
public void init(Map<String, Object> pluginConfig) {
+ Object o = pluginConfig.get(BLOCK_UNKNOWN);
+ if (o != null) {
+ try {
+ blockUnknown = Boolean.parseBoolean(o.toString());
+ } catch (Exception e) {
+ log.error(e.getMessage());
+ }
+ }
zkAuthentication = getAuthenticationProvider(pluginConfig);
}
@Override
public Map<String, Object> edit(Map<String, Object> latestConf, List<CommandOperation> commands) {
+ for (CommandOperation command : commands) {
+ if (command.name.equals("set-property")) {
+ for (Map.Entry<String, Object> e : command.getDataMap().entrySet()) {
+ if (PROPS.contains(e.getKey())) {
+ latestConf.put(e.getKey(), e.getValue());
+ } else {
+ command.addError("Unknown property " + e.getKey());
+ }
+ }
+ }
+ }
+ if (!CommandOperation.captureErrors(commands).isEmpty()) return null;
if (zkAuthentication instanceof ConfigEditablePlugin) {
ConfigEditablePlugin editablePlugin = (ConfigEditablePlugin) zkAuthentication;
return editablePlugin.edit(latestConf, commands);
@@ -120,8 +139,12 @@ public class BasicAuthPlugin extends Aut
}
}
} else {
- request.setAttribute(AuthenticationPlugin.class.getName(), zkAuthentication.getPromptHeaders());
- filterChain.doFilter(request, response);
+ if (blockUnknown) {
+ authenticationFailure(response, "require authentication");
+ } else {
+ request.setAttribute(AuthenticationPlugin.class.getName(), zkAuthentication.getPromptHeaders());
+ filterChain.doFilter(request, response);
+ }
}
}
@@ -143,5 +166,12 @@ public class BasicAuthPlugin extends Aut
Map<String, String> getPromptHeaders();
}
+ public boolean getBlockUnknown(){
+ return blockUnknown;
+ }
+
+ public static final String BLOCK_UNKNOWN = "blockUnknown";
+ private static final Set<String> PROPS = ImmutableSet.of(BLOCK_UNKNOWN);
+
}
Modified: lucene/dev/trunk/solr/core/src/test/org/apache/solr/security/TestSha256AuthenticationProvider.java
URL: http://svn.apache.org/viewvc/lucene/dev/trunk/solr/core/src/test/org/apache/solr/security/TestSha256AuthenticationProvider.java?rev=1720729&r1=1720728&r2=1720729&view=diff
==============================================================================
--- lucene/dev/trunk/solr/core/src/test/org/apache/solr/security/TestSha256AuthenticationProvider.java (original)
+++ lucene/dev/trunk/solr/core/src/test/org/apache/solr/security/TestSha256AuthenticationProvider.java Fri Dec 18 08:40:38 2015
@@ -24,6 +24,8 @@ import java.util.Map;
import org.apache.solr.SolrTestCaseJ4;
import org.apache.solr.util.CommandOperation;
+import static java.util.Collections.singletonMap;
+
public class TestSha256AuthenticationProvider extends SolrTestCaseJ4 {
public void testAuthenticate(){
Sha256AuthenticationProvider zkAuthenticationProvider = new Sha256AuthenticationProvider();
@@ -32,7 +34,7 @@ public class TestSha256AuthenticationPro
String pwd = "My#$Password";
String user = "noble";
Map latestConf = new LinkedHashMap<>();
- Map<String, Object> params = Collections.singletonMap(user, pwd);
+ Map<String, Object> params = singletonMap(user, pwd);
Map<String, Object> result = zkAuthenticationProvider.edit(latestConf,
Collections.singletonList(new CommandOperation("set-user",params )));
zkAuthenticationProvider = new Sha256AuthenticationProvider();
@@ -43,4 +45,23 @@ public class TestSha256AuthenticationPro
assertFalse(zkAuthenticationProvider.authenticate("unknownuser", "WrongPassword"));
}
+
+ public void testBasicAuthCommands(){
+ BasicAuthPlugin basicAuthPlugin = new BasicAuthPlugin();
+ basicAuthPlugin.init(Collections.emptyMap());
+
+ Map latestConf = new LinkedHashMap<>();
+
+ CommandOperation blockUnknown = new CommandOperation("set-property", singletonMap("blockUnknown", true));
+ basicAuthPlugin.edit(latestConf, Collections.singletonList(blockUnknown));
+ assertEquals(Boolean.TRUE, latestConf.get("blockUnknown"));
+ basicAuthPlugin.init(latestConf);
+ assertTrue(basicAuthPlugin.getBlockUnknown());
+ blockUnknown = new CommandOperation("set-property", singletonMap("blockUnknown", false));
+ basicAuthPlugin.edit(latestConf, Collections.singletonList(blockUnknown));
+ assertEquals(Boolean.FALSE, latestConf.get("blockUnknown"));
+ basicAuthPlugin.init(latestConf);
+ assertFalse(basicAuthPlugin.getBlockUnknown());
+
+ }
}