You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@lucene.apache.org by eh...@apache.org on 2020/09/16 18:12:19 UTC
[lucene-solr] branch branch_8x updated (9cd3af5 -> b643de6)
This is an automated email from the ASF dual-hosted git repository.
ehatcher pushed a change to branch branch_8x
in repository https://gitbox.apache.org/repos/asf/lucene-solr.git.
from 9cd3af5 LUCENE-9525: Better handle small documents with Lucene87StoredFieldsFormat. (#1876)
new a2a718f SOLR-14799: JWT authentication plugin only requires sub claim when principalClaim=sub
new b643de6 SOLR-14799: add CHANGES entry
The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
solr/CHANGES.txt | 2 ++
.../java/org/apache/solr/security/JWTAuthPlugin.java | 8 +-------
.../org/apache/solr/security/JWTAuthPluginTest.java | 18 +++++++++++++++++-
3 files changed, 20 insertions(+), 8 deletions(-)
[lucene-solr] 01/02: SOLR-14799: JWT authentication plugin only
requires sub claim when principalClaim=sub
Posted by eh...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
ehatcher pushed a commit to branch branch_8x
in repository https://gitbox.apache.org/repos/asf/lucene-solr.git
commit a2a718f70d510cafaed3de7a396529df252342ee
Author: Erik Hatcher <er...@lucidworks.com>
AuthorDate: Mon Aug 31 18:47:05 2020 -0400
SOLR-14799: JWT authentication plugin only requires sub claim when principalClaim=sub
---
.../java/org/apache/solr/security/JWTAuthPlugin.java | 8 +-------
.../org/apache/solr/security/JWTAuthPluginTest.java | 18 +++++++++++++++++-
2 files changed, 18 insertions(+), 8 deletions(-)
diff --git a/solr/core/src/java/org/apache/solr/security/JWTAuthPlugin.java b/solr/core/src/java/org/apache/solr/security/JWTAuthPlugin.java
index 90c6561..238ac60 100644
--- a/solr/core/src/java/org/apache/solr/security/JWTAuthPlugin.java
+++ b/solr/core/src/java/org/apache/solr/security/JWTAuthPlugin.java
@@ -74,7 +74,6 @@ import org.slf4j.LoggerFactory;
public class JWTAuthPlugin extends AuthenticationPlugin implements SpecProvider, ConfigEditablePlugin {
private static final Logger log = LoggerFactory.getLogger(MethodHandles.lookup().lookupClass());
private static final String PARAM_BLOCK_UNKNOWN = "blockUnknown";
- private static final String PARAM_REQUIRE_SUBJECT = "requireSub";
private static final String PARAM_REQUIRE_ISSUER = "requireIss";
private static final String PARAM_PRINCIPAL_CLAIM = "principalClaim";
private static final String PARAM_ROLES_CLAIM = "rolesClaim";
@@ -95,7 +94,7 @@ public class JWTAuthPlugin extends AuthenticationPlugin implements SpecProvider,
static final String PRIMARY_ISSUER = "PRIMARY";
private static final Set<String> PROPS = ImmutableSet.of(PARAM_BLOCK_UNKNOWN,
- PARAM_REQUIRE_SUBJECT, PARAM_PRINCIPAL_CLAIM, PARAM_REQUIRE_EXPIRATIONTIME, PARAM_ALG_WHITELIST,
+ PARAM_PRINCIPAL_CLAIM, PARAM_REQUIRE_EXPIRATIONTIME, PARAM_ALG_WHITELIST,
PARAM_JWK_CACHE_DURATION, PARAM_CLAIMS_MATCH, PARAM_SCOPE, PARAM_REALM, PARAM_ROLES_CLAIM,
PARAM_ADMINUI_SCOPE, PARAM_REDIRECT_URIS, PARAM_REQUIRE_ISSUER, PARAM_ISSUERS,
// These keys are supported for now to enable PRIMARY issuer config through top-level keys
@@ -140,10 +139,6 @@ public class JWTAuthPlugin extends AuthenticationPlugin implements SpecProvider,
blockUnknown = Boolean.parseBoolean(String.valueOf(pluginConfig.getOrDefault(PARAM_BLOCK_UNKNOWN, false)));
requireIssuer = Boolean.parseBoolean(String.valueOf(pluginConfig.getOrDefault(PARAM_REQUIRE_ISSUER, "true")));
requireExpirationTime = Boolean.parseBoolean(String.valueOf(pluginConfig.getOrDefault(PARAM_REQUIRE_EXPIRATIONTIME, "true")));
- if (pluginConfig.get(PARAM_REQUIRE_SUBJECT) != null) {
- log.warn("Parameter {} is no longer used and may generate error in a later version. A subject claim is now always required",
- PARAM_REQUIRE_SUBJECT);
- }
principalClaim = (String) pluginConfig.getOrDefault(PARAM_PRINCIPAL_CLAIM, "sub");
rolesClaim = (String) pluginConfig.get(PARAM_ROLES_CLAIM);
@@ -511,7 +506,6 @@ public class JWTAuthPlugin extends AuthenticationPlugin implements SpecProvider,
} else {
jwtConsumerBuilder.setSkipDefaultAudienceValidation();
}
- jwtConsumerBuilder.setRequireSubject();
if (requireExpirationTime)
jwtConsumerBuilder.setRequireExpirationTime();
if (algWhitelist != null)
diff --git a/solr/core/src/test/org/apache/solr/security/JWTAuthPluginTest.java b/solr/core/src/test/org/apache/solr/security/JWTAuthPluginTest.java
index 95cc59e..cc6a86d 100644
--- a/solr/core/src/test/org/apache/solr/security/JWTAuthPluginTest.java
+++ b/solr/core/src/test/org/apache/solr/security/JWTAuthPluginTest.java
@@ -93,6 +93,7 @@ public class JWTAuthPluginTest extends SolrTestCaseJ4 {
claims.unsetClaim("iss");
claims.unsetClaim("aud");
claims.unsetClaim("exp");
+ claims.setSubject(null);
jws.setPayload(claims.toJson());
String slimJwt = jws.getCompactSerialization();
slimHeader = "Bearer" + " " + slimJwt;
@@ -127,6 +128,7 @@ public class JWTAuthPluginTest extends SolrTestCaseJ4 {
testConfig = new HashMap<>();
testConfig.put("class", "org.apache.solr.security.JWTAuthPlugin");
+ testConfig.put("principalClaim", "customPrincipal");
testConfig.put("jwk", testJwk);
plugin.init(testConfig);
@@ -216,11 +218,25 @@ public class JWTAuthPluginTest extends SolrTestCaseJ4 {
public void authenticateOk() {
JWTAuthPlugin.JWTAuthenticationResponse resp = plugin.authenticate(testHeader);
assertTrue(resp.isAuthenticated());
- assertEquals("solruser", resp.getPrincipal().getName());
+ assertEquals("custom", resp.getPrincipal().getName()); // principalClaim = customPrincipal, not sub here
}
@Test
public void authFailedMissingSubject() {
+ minimalConfig.put("principalClaim","sub"); // minimalConfig has no subject specified
+ plugin.init(minimalConfig);
+ JWTAuthPlugin.JWTAuthenticationResponse resp = plugin.authenticate(testHeader);
+ assertFalse(resp.isAuthenticated());
+ assertEquals(JWTAuthPlugin.JWTAuthenticationResponse.AuthCode.JWT_VALIDATION_EXCEPTION, resp.getAuthCode());
+
+ testConfig.put("principalClaim","sub"); // testConfig has subject = solruser
+ plugin.init(testConfig);
+ resp = plugin.authenticate(testHeader);
+ assertTrue(resp.isAuthenticated());
+ }
+
+ @Test
+ public void authFailedMissingIssuer() {
testConfig.put("iss", "NA");
plugin.init(testConfig);
JWTAuthPlugin.JWTAuthenticationResponse resp = plugin.authenticate(testHeader);
[lucene-solr] 02/02: SOLR-14799: add CHANGES entry
Posted by eh...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
ehatcher pushed a commit to branch branch_8x
in repository https://gitbox.apache.org/repos/asf/lucene-solr.git
commit b643de6f1747d67389460a7e9ea156fc809be040
Author: Erik Hatcher <er...@lucidworks.com>
AuthorDate: Wed Sep 16 14:11:53 2020 -0400
SOLR-14799: add CHANGES entry
---
solr/CHANGES.txt | 2 ++
1 file changed, 2 insertions(+)
diff --git a/solr/CHANGES.txt b/solr/CHANGES.txt
index 6f7ed9c..480c1ac 100644
--- a/solr/CHANGES.txt
+++ b/solr/CHANGES.txt
@@ -48,6 +48,8 @@ Improvements
* SOLR-14722: Track timeAllowed from earlier in the request lifecycle. (David Smiley)
+* SOLR-14799: JWT authentication plugin only requires "sub" claim when principalClaim=sub. (Erik Hatcher)
+
Optimizations
---------------------