[D] Database connection: proxy in front of solr [superset]

["xueyun0512 (via GitHub)" <gi...@apache.org>]

GitHub user xueyun0512 created a discussion: Database connection: proxy in front of solr

### Bug description

Hello, 
I want to connect to Apache Solr. However, since I have configured Solr to use Kerberos, I can't connect to the Solr server directly (as solr-sqlalchemy does not support Kerberos authentication protocol). 
Therefore, I have set an proxy in front of Solr. I'm using Knox Gateway.  

When I tried the following URi 
solr://username:password@my.knox.vip.com:443/europe-italy/team-tiramisu/solr/cheese_collection

Where:
443: port 
europe-italy/team-tiramisu: knox gateway topology
cheese_collection: my Solr collection name 

I got the error:
ERROR: Expecting value: line 1 column 1 (char 0)

Can you help me please? 

In this case, what is the easiest solution? 
1) Change the source code solr-sqlalchemy to support Kerberos?
2) Change the source code solr-sqlalchemy to use Knox Gateway ? 


### Screenshots/recordings

_No response_

### Superset version

master / latest-dev

### Python version

3.11

### Node version

I don't know

### Browser

Chrome

### Additional context

_No response_

### Checklist

- [x] I have searched Superset docs and Slack and didn't find a solution to my problem.
- [x] I have searched the GitHub issue tracker and didn't find a similar bug report.
- [x] I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.

GitHub link: https://github.com/apache/superset/discussions/40727

----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [D] Database connection: proxy in front of solr [superset]

["FrancescoCastaldi (via GitHub)" <gi...@apache.org>]

GitHub user FrancescoCastaldi added a comment to the discussion: Database connection: proxy in front of solr

The error `ERROR: Expecting value: line 1 column 1 (char 0)` is a Python `json.decoder.JSONDecodeError`. It occurs when `solr-sqlalchemy` sends an HTTP request expecting a JSON response from Solr, but the server (in this case, Knox Gateway) returns an HTML document or an empty response (such as an HTTP 401/403 authentication challenge or an HTML login redirect).

Between modifying `solr-sqlalchemy` for Kerberos vs Knox Gateway, using Knox Gateway is by far the cleaner and standard approach because Knox is explicitly designed to handle the Kerberos/SPNEGO authentication on the Hadoop/Solr side while offering simple HTTP Basic Auth to external clients like Superset.

Here is how to resolve the connection through Knox:

### 1. Fix the Knox Gateway URL Path Structure
Apache Knox topologies expose services under `/gateway/<topology_name>/<service_name>`.
Your connection URI should include the `/gateway/` path prefix:

```text
solr://username:password@my.knox.vip.com:443/gateway/europe-italy/team-tiramisu/solr/cheese_collection
```

If your Knox topology is mapped with SSL on port 443, ensure `use_ssl=true` is passed so requests use `https://` instead of `http://`.

### 2. Configure Engine Parameters and SSL Verification in Superset
In Superset, go to **Settings -> Database Connections -> Edit -> Advanced -> Other**, and configure the **Engine Parameters** with proper HTTP headers and SSL certificates:

```json
{
  "connect_args": {
    "scheme": "https",
    "verify_ssl": true
  }
}
```

### 3. Verify the Knox Endpoint Directly via cURL
Before testing in Superset, verify from the Superset server shell that Knox is accepting your Basic Auth credentials and returning valid Solr JSON:

```bash
curl -k -u "username:password" \
  "https://my.knox.vip.com:443/gateway/europe-italy/team-tiramisu/solr/cheese_collection/select?q=*:*&wt=json"
```

If this returns an HTML page containing "Knox Authentication Failed" or a 302 redirect, check your Knox service role permissions for the `solr` service in that topology. Once cURL returns a raw JSON object starting with `{ "responseHeader": ... }`, the SQLAlchemy Solr driver will connect successfully.


GitHub link: https://github.com/apache/superset/discussions/40727#discussioncomment-19164774

----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org