You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@lucene.apache.org by an...@apache.org on 2015/12/29 10:14:50 UTC
svn commit: r1722075 - in /lucene/dev/branches/lucene_solr_5_3: ./ solr/
solr/core/ solr/core/src/java/org/apache/solr/security/
solr/core/src/java/org/apache/solr/servlet/
solr/core/src/java/org/apache/solr/update/
Author: anshum
Date: Tue Dec 29 09:14:49 2015
New Revision: 1722075
URL: http://svn.apache.org/viewvc?rev=1722075&view=rev
Log:
SOLR-8355: fix for update permissions causing node recovery failures(backport from branch_5x for 5.3.2 release)
Modified:
lucene/dev/branches/lucene_solr_5_3/ (props changed)
lucene/dev/branches/lucene_solr_5_3/solr/ (props changed)
lucene/dev/branches/lucene_solr_5_3/solr/CHANGES.txt (contents, props changed)
lucene/dev/branches/lucene_solr_5_3/solr/core/ (props changed)
lucene/dev/branches/lucene_solr_5_3/solr/core/src/java/org/apache/solr/security/RuleBasedAuthorizationPlugin.java
lucene/dev/branches/lucene_solr_5_3/solr/core/src/java/org/apache/solr/servlet/HttpSolrCall.java
lucene/dev/branches/lucene_solr_5_3/solr/core/src/java/org/apache/solr/update/DefaultSolrCoreState.java
Modified: lucene/dev/branches/lucene_solr_5_3/solr/CHANGES.txt
URL: http://svn.apache.org/viewvc/lucene/dev/branches/lucene_solr_5_3/solr/CHANGES.txt?rev=1722075&r1=1722074&r2=1722075&view=diff
==============================================================================
--- lucene/dev/branches/lucene_solr_5_3/solr/CHANGES.txt (original)
+++ lucene/dev/branches/lucene_solr_5_3/solr/CHANGES.txt Tue Dec 29 09:14:49 2015
@@ -25,6 +25,8 @@ Bug Fixes
* SOLR-8167: Authorization framework does not work with POST params (noble)
+* SOLR-8355: update permissions were failing node recovery (noble , Anshum Gupta)
+
================== 5.3.1 ==================
Bug Fixes
Modified: lucene/dev/branches/lucene_solr_5_3/solr/core/src/java/org/apache/solr/security/RuleBasedAuthorizationPlugin.java
URL: http://svn.apache.org/viewvc/lucene/dev/branches/lucene_solr_5_3/solr/core/src/java/org/apache/solr/security/RuleBasedAuthorizationPlugin.java?rev=1722075&r1=1722074&r2=1722075&view=diff
==============================================================================
--- lucene/dev/branches/lucene_solr_5_3/solr/core/src/java/org/apache/solr/security/RuleBasedAuthorizationPlugin.java (original)
+++ lucene/dev/branches/lucene_solr_5_3/solr/core/src/java/org/apache/solr/security/RuleBasedAuthorizationPlugin.java Tue Dec 29 09:14:49 2015
@@ -141,6 +141,7 @@ public class RuleBasedAuthorizationPlugi
return MatchStatus.PERMITTED;
}
if (principal == null) {
+ log.info("request has come without principal. failed permission {} ",permission);
//this resource needs a principal but the request has come without
//any credential.
return MatchStatus.USER_REQUIRED;
@@ -150,8 +151,10 @@ public class RuleBasedAuthorizationPlugi
Set<String> userRoles = usersVsRoles.get(principal.getName());
if (userRoles != null && userRoles.contains(role)) return MatchStatus.PERMITTED;
}
+ log.info("This resource is configured to have a permission {}, The principal {} does not have the right role ", permission, principal);
return MatchStatus.FORBIDDEN;
}
+ log.debug("No permissions configured for the resource {} . So allowed to access", context.getResource());
return MatchStatus.NO_PERMISSIONS_FOUND;
}
Modified: lucene/dev/branches/lucene_solr_5_3/solr/core/src/java/org/apache/solr/servlet/HttpSolrCall.java
URL: http://svn.apache.org/viewvc/lucene/dev/branches/lucene_solr_5_3/solr/core/src/java/org/apache/solr/servlet/HttpSolrCall.java?rev=1722075&r1=1722074&r2=1722075&view=diff
==============================================================================
--- lucene/dev/branches/lucene_solr_5_3/solr/core/src/java/org/apache/solr/servlet/HttpSolrCall.java (original)
+++ lucene/dev/branches/lucene_solr_5_3/solr/core/src/java/org/apache/solr/servlet/HttpSolrCall.java Tue Dec 29 09:14:49 2015
@@ -431,6 +431,7 @@ public class HttpSolrCall {
log.debug("USER_REQUIRED "+req.getHeader("Authorization")+" "+ req.getUserPrincipal());
}
if (!(authResponse.statusCode == HttpStatus.SC_ACCEPTED) && !(authResponse.statusCode == HttpStatus.SC_OK)) {
+ log.info("USER_REQUIRED auth header {} context : {} ", req.getHeader("Authorization"), context);
sendError(authResponse.statusCode,
"Unauthorized request, Response code: " + authResponse.statusCode);
return RETURN;
@@ -496,8 +497,10 @@ public class HttpSolrCall {
private boolean shouldAuthorize() {
if(PKIAuthenticationPlugin.PATH.equals(path)) return false;
//admin/info/key is the path where public key is exposed . it is always unsecured
- if( cores.getPkiAuthenticationPlugin() != null && req.getUserPrincipal() != null){
- return cores.getPkiAuthenticationPlugin().needsAuthorization(req);
+ if (cores.getPkiAuthenticationPlugin() != null && req.getUserPrincipal() != null) {
+ boolean b = cores.getPkiAuthenticationPlugin().needsAuthorization(req);
+ log.debug("PkiAuthenticationPlugin says authorization required : {} ", b);
+ return b;
}
return true;
}
@@ -1007,6 +1010,7 @@ public class HttpSolrCall {
response.delete(response.length() - 1, response.length());
response.append("], Path: [").append(resource).append("]");
+ response.append(" path : ").append(path).append(" params :").append(solrReq.getParams());
return response.toString();
}
Modified: lucene/dev/branches/lucene_solr_5_3/solr/core/src/java/org/apache/solr/update/DefaultSolrCoreState.java
URL: http://svn.apache.org/viewvc/lucene/dev/branches/lucene_solr_5_3/solr/core/src/java/org/apache/solr/update/DefaultSolrCoreState.java?rev=1722075&r1=1722074&r2=1722075&view=diff
==============================================================================
--- lucene/dev/branches/lucene_solr_5_3/solr/core/src/java/org/apache/solr/update/DefaultSolrCoreState.java (original)
+++ lucene/dev/branches/lucene_solr_5_3/solr/core/src/java/org/apache/solr/update/DefaultSolrCoreState.java Tue Dec 29 09:14:49 2015
@@ -18,12 +18,14 @@ package org.apache.solr.update;
*/
import java.io.IOException;
+import java.util.concurrent.ExecutionException;
+import java.util.concurrent.Future;
import java.util.concurrent.locks.Lock;
import java.util.concurrent.locks.ReentrantLock;
import org.apache.lucene.index.IndexWriter;
-import org.apache.solr.cloud.RecoveryStrategy;
import org.apache.solr.cloud.ActionThrottle;
+import org.apache.solr.cloud.RecoveryStrategy;
import org.apache.solr.common.SolrException;
import org.apache.solr.common.SolrException.ErrorCode;
import org.apache.solr.core.CoreContainer;
@@ -54,6 +56,7 @@ public final class DefaultSolrCoreState
private volatile boolean recoveryRunning;
private RecoveryStrategy recoveryStrat;
+ private Future future;
private volatile boolean lastReplicationSuccess = true;
private RefCounted<IndexWriter> refCntWriter;
@@ -328,7 +331,7 @@ public final class DefaultSolrCoreState
recoveryStrat = new RecoveryStrategy(cc, cd, this);
recoveryStrat.setRecoveringAfterStartup(recoveringAfterStartup);
- recoveryStrat.start();
+ future = cc.getUpdateShardHandler().getUpdateExecutor().submit(recoveryStrat);
recoveryRunning = true;
}
} finally {
@@ -343,10 +346,12 @@ public final class DefaultSolrCoreState
recoveryStrat.close();
while (true) {
try {
- recoveryStrat.join();
+ future.get();
} catch (InterruptedException e) {
// not interruptible - keep waiting
continue;
+ } catch (ExecutionException e) {
+ break;
}
break;
}