You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@solr.apache.org by GitBox <gi...@apache.org> on 2021/09/17 11:27:12 UTC
[GitHub] [solr] TheSench opened a new pull request #296: SOLR-15626: Fix `config-read` permission.
TheSench opened a new pull request #296:
URL: https://github.com/apache/solr/pull/296
https://issues.apache.org/jira/browse/SOLR-15626
# Description
The `config-read` permission was not including the `null` collection, preventing it from being matched on endpoints like `/amin/configs?action=LIST`, as they are not associated with a specific collection.
# Solution
I simply updated the `config-edit` to include both `null` and `"*"` in its list of collections like the `config-edit` permission is already doing.
# Tests
I created a `security.json` file that gave the `config-read` permission to one user and `all` to a different one. I then tested booting up Solr with and without this change. Without it, navigating to `/amin/configs?action=LIST` results in a 403 for the user with `config-read` permissions. With the change, that user is properly allowed to access this endpoint.
I did not find any unit tests related to these files.
# Checklist
Please review the following and check all that apply:
- [x] I have reviewed the guidelines for [How to Contribute](https://wiki.apache.org/solr/HowToContribute) and my code conforms to the standards described there to the best of my ability.
- [x] I have created a Jira issue and added the issue ID to my pull request title.
- [x] I have given Solr maintainers [access](https://help.github.com/en/articles/allowing-changes-to-a-pull-request-branch-created-from-a-fork) to contribute to my PR branch. (optional but recommended)
- [x] I have developed this patch against the `main` branch.
- [x] I have run `./gradlew check`.
- [ ] I have added tests for my changes.
- [N/A] I have added documentation for the [Reference Guide](https://github.com/apache/solr/tree/main/solr/solr-ref-guide)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
[GitHub] [solr] epugh commented on pull request #296: SOLR-15626: Fix `config-read` permission.
Posted by GitBox <gi...@apache.org>.
epugh commented on pull request #296:
URL: https://github.com/apache/solr/pull/296#issuecomment-937863808
Thanks @TheSench for your persistence, and sorry it took me so long to get comfortable with the patch, mostly due to my own nerves ;-) Feel free to tag me on any future PR's ;-)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
[GitHub] [solr] TheSench commented on pull request #296: SOLR-15626: Fix `config-read` permission.
Posted by GitBox <gi...@apache.org>.
TheSench commented on pull request #296:
URL: https://github.com/apache/solr/pull/296#issuecomment-922010030
> Also, as far as "integration" tests, in the Solr world, we just put them all together! If it's a long running test, we label them with that attribute, but in terms of the code layout, they all just go together.
Well, shall we open a new issue for three lack of permissions testing in general and keep this one as-is? If I have some spare time in the next few weeks, I don't mind taking a first crack at those tests.
I think my biggest current knowledge-gap is the list of possible endpoints to run tests for. Also, it was easy to map up some of the permissions to their endpoints, but others have a very roundabout way of going from an endpoint to where the permission is assigned. The documentation covers most of this, but a few of the built-in permissions were more vague to me.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
[GitHub] [solr] TheSench edited a comment on pull request #296: SOLR-15626: Fix `config-read` permission.
Posted by GitBox <gi...@apache.org>.
TheSench edited a comment on pull request #296:
URL: https://github.com/apache/solr/pull/296#issuecomment-936683714
As an alternate, you can also use this, which _should_ allow unauthenticated access to listing configSets (and will after the bugfix):
```jsonc
{
"authentication": {
"class": "solr.BasicAuthPlugin",
"credentials": {
// solr:SolrRocks
"solr": "IV0EHq1OnNrj6gvRCwvFwTrZ1+z1oBbnQdiVC3otuq0= Ndd7LKvVBAaZIF0QAVi1ekCfAJXr1GGfLtRUXhgrF8c="
},
"blockUnknown": false
},
"authorization": {
"class": "solr.RuleBasedAuthorizationPlugin",
"permissions": [
{
"name": "config-read",
"role": null
},
{
"name": "all",
"role": "admin"
}
],
"user-role": {
"solr": "admin"
}
}
}
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
[GitHub] [solr] TheSench commented on pull request #296: SOLR-15626: Fix `config-read` permission.
Posted by GitBox <gi...@apache.org>.
TheSench commented on pull request #296:
URL: https://github.com/apache/solr/pull/296#issuecomment-929656179
[SOLR-15662](https://issues.apache.org/jira/browse/SOLR-15662) created.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
[GitHub] [solr] TheSench commented on pull request #296: SOLR-15626: Fix `config-read` permission.
Posted by GitBox <gi...@apache.org>.
TheSench commented on pull request #296:
URL: https://github.com/apache/solr/pull/296#issuecomment-937390843
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
[GitHub] [solr] TheSench commented on pull request #296: SOLR-15626: Fix `config-read` permission.
Posted by GitBox <gi...@apache.org>.
TheSench commented on pull request #296:
URL: https://github.com/apache/solr/pull/296#issuecomment-929471727
This PR still needs a maintainer to approve the running of workflows.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
[GitHub] [solr] epugh commented on pull request #296: SOLR-15626: Fix `config-read` permission.
Posted by GitBox <gi...@apache.org>.
epugh commented on pull request #296:
URL: https://github.com/apache/solr/pull/296#issuecomment-937781867
I went to merge this, and had a hangup on which CHANGES.txt file this goes in... @TheSench I am assuming you want this in the next Solr 8 release? If you don't care, I could just merge it to Solr 9 and not backport....
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
[GitHub] [solr] TheSench edited a comment on pull request #296: SOLR-15626: Fix `config-read` permission.
Posted by GitBox <gi...@apache.org>.
TheSench edited a comment on pull request #296:
URL: https://github.com/apache/solr/pull/296#issuecomment-922010030
> Also, as far as "integration" tests, in the Solr world, we just put them all together! If it's a long running test, we label them with that attribute, but in terms of the code layout, they all just go together.
Well, shall we open a new issue for three lack of permissions testing in general and keep this one as-is? If I have some spare time in the next few weeks, I don't mind taking a first crack at those tests under a new issue.
I think my biggest current knowledge-gap is the list of possible endpoints to run tests for. Also, it was easy to map up some of the permissions to their endpoints, but others have a very roundabout way of going from an endpoint to where the permission is assigned. The documentation covers most of this, but a few of the built-in permissions were more vague to me.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
[GitHub] [solr] epugh commented on pull request #296: SOLR-15626: Fix `config-read` permission.
Posted by GitBox <gi...@apache.org>.
epugh commented on pull request #296:
URL: https://github.com/apache/solr/pull/296#issuecomment-933765706
thanks for the legwork @janhoy going to give this a try!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
[GitHub] [solr] epugh merged pull request #296: SOLR-15626: Fix `config-read` permission.
Posted by GitBox <gi...@apache.org>.
epugh merged pull request #296:
URL: https://github.com/apache/solr/pull/296
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
[GitHub] [solr] epugh commented on pull request #296: SOLR-15626: Fix `config-read` permission.
Posted by GitBox <gi...@apache.org>.
epugh commented on pull request #296:
URL: https://github.com/apache/solr/pull/296#issuecomment-921968952
Also, as far as "integration" tests, in the Solr world, we just put them all together! If it's a long running test, we label them with that attribute, but in terms of the code layout, they all just go together.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
[GitHub] [solr] TheSench commented on pull request #296: SOLR-15626: Fix `config-read` permission.
Posted by GitBox <gi...@apache.org>.
TheSench commented on pull request #296:
URL: https://github.com/apache/solr/pull/296#issuecomment-937390843
Looks like the workflow is awaiting approval again after I fixed the merge conflict.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
[GitHub] [solr] TheSench commented on pull request #296: SOLR-15626: Fix `config-read` permission.
Posted by GitBox <gi...@apache.org>.
TheSench commented on pull request #296:
URL: https://github.com/apache/solr/pull/296#issuecomment-921930622
> Congrats on your first contribution! To make sure this does not stall, we could consider opening a new JIRA issue for adding an integration test, and be able to merge this one-liner with only manual testing for now.
>
> Please also add a line to CHANGES.txt. We may be able to back-port this to 8.10 in time for the first RC.
Ahh, I thought I had already pushed that up this morning, but apparently I did not. It should be there now. I put it in the `9.0.0` section, as I am assuming backporting (if it happens) would be done in a separate PR.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
[GitHub] [solr] TheSench edited a comment on pull request #296: SOLR-15626: Fix `config-read` permission.
Posted by GitBox <gi...@apache.org>.
TheSench edited a comment on pull request #296:
URL: https://github.com/apache/solr/pull/296#issuecomment-937823770
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
[GitHub] [solr] epugh commented on pull request #296: SOLR-15626: Fix `config-read` permission.
Posted by GitBox <gi...@apache.org>.
epugh commented on pull request #296:
URL: https://github.com/apache/solr/pull/296#issuecomment-937781867
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
[GitHub] [solr] epugh commented on pull request #296: SOLR-15626: Fix `config-read` permission.
Posted by GitBox <gi...@apache.org>.
epugh commented on pull request #296:
URL: https://github.com/apache/solr/pull/296#issuecomment-929570213
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
[GitHub] [solr] epugh commented on pull request #296: SOLR-15626: Fix `config-read` permission.
Posted by GitBox <gi...@apache.org>.
epugh commented on pull request #296:
URL: https://github.com/apache/solr/pull/296#issuecomment-921728331
So... Thoughts on putting in a Unit Test? I think there is going to be a LOT of these types of issues, and that having tests would be great. I think you might be creating a new style of unit testing (well, really integration test), and would add a lot!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
[GitHub] [solr] epugh commented on pull request #296: SOLR-15626: Fix `config-read` permission.
Posted by GitBox <gi...@apache.org>.
epugh commented on pull request #296:
URL: https://github.com/apache/solr/pull/296#issuecomment-932263972
I am manually testing this now... ;-) Just want to confirm it all works as advertised since I haven't worked in this area a lot....
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
[GitHub] [solr] TheSench commented on pull request #296: SOLR-15626: Fix `config-read` permission.
Posted by GitBox <gi...@apache.org>.
TheSench commented on pull request #296:
URL: https://github.com/apache/solr/pull/296#issuecomment-936683714
As an alternate, you can also use this, which _should_ allow unauthenticated access to listing configSets (and will after the bugfix):
```json
{
"authentication": {
"class": "solr.BasicAuthPlugin",
"credentials": {
// solr:SolrRocks
"solr": "IV0EHq1OnNrj6gvRCwvFwTrZ1+z1oBbnQdiVC3otuq0= Ndd7LKvVBAaZIF0QAVi1ekCfAJXr1GGfLtRUXhgrF8c="
},
"blockUnknown": false
},
"authorization": {
"class": "solr.RuleBasedAuthorizationPlugin",
"permissions": [
{
"name": "config-read",
"role": null
},
{
"name": "all",
"role": "admin"
}
],
"user-role": {
"solr": "admin"
}
}
}
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
[GitHub] [solr] TheSench edited a comment on pull request #296: SOLR-15626: Fix `config-read` permission.
Posted by GitBox <gi...@apache.org>.
TheSench edited a comment on pull request #296:
URL: https://github.com/apache/solr/pull/296#issuecomment-937823770
The next Solr 8 would be ideal, but only so that more users can benefit. In using a workaround already on my end.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
[GitHub] [solr] TheSench commented on pull request #296: SOLR-15626: Fix `config-read` permission.
Posted by GitBox <gi...@apache.org>.
TheSench commented on pull request #296:
URL: https://github.com/apache/solr/pull/296#issuecomment-921732111
> So... Thoughts on putting in a Unit Test? I think there is going to be a LOT of these types of issues, and that having tests would be great. I think you might be creating a new style of unit testing (well, really integration test), and would add a lot!
>
> Some sort of way of having many security.json? `security-config-read.json` and `security-block-everyone.json` etc..?
I agree that this would be very beneficial. I'm still new to the codebase and my time for digging into this is currently quite limited. It might take me a few weeks before I'm able to put some unit tests together for these. Where are the integration tests currently located (or are there any existing integration tests)?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
[GitHub] [solr] janhoy commented on pull request #296: SOLR-15626: Fix `config-read` permission.
Posted by GitBox <gi...@apache.org>.
janhoy commented on pull request #296:
URL: https://github.com/apache/solr/pull/296#issuecomment-921736920
Congrats on your first contribution! To make sure this does not stall, we could consider opening a new JIRA issue for adding an integration test, and be able to merge this one-liner with only manual testing for now.
Please also add a line to CHANGES.txt. We may be able to back-port this to 8.10 in time for the first RC.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
[GitHub] [solr] TheSench edited a comment on pull request #296: SOLR-15626: Fix `config-read` permission.
Posted by GitBox <gi...@apache.org>.
TheSench edited a comment on pull request #296:
URL: https://github.com/apache/solr/pull/296#issuecomment-937823770
The next Solr 8 would be ideal, but only so that more users can benefit. I'm using a workaround already on my end, so I wouldn't be personally impacted if this waited until Solr 9.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
[GitHub] [solr] TheSench edited a comment on pull request #296: SOLR-15626: Fix `config-read` permission.
Posted by GitBox <gi...@apache.org>.
TheSench edited a comment on pull request #296:
URL: https://github.com/apache/solr/pull/296#issuecomment-937823770
The next Solr 8 would be ideal, but only so that more users can benefit. I'm using a workaround already on my end, so I wouldn't be personally impacted of this waited until Solr 9.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
[GitHub] [solr] TheSench commented on pull request #296: SOLR-15626: Fix `config-read` permission.
Posted by GitBox <gi...@apache.org>.
TheSench commented on pull request #296:
URL: https://github.com/apache/solr/pull/296#issuecomment-929656179
[SOLR-15662](https://issues.apache.org/jira/browse/SOLR-15662) created.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
[GitHub] [solr] janhoy commented on pull request #296: SOLR-15626: Fix `config-read` permission.
Posted by GitBox <gi...@apache.org>.
janhoy commented on pull request #296:
URL: https://github.com/apache/solr/pull/296#issuecomment-933760301
@epugh I managed to reproduce the issue both on main and 8.10, and to verify the fix on this branch. The security.json I used was this
```json
{
"authentication": {
"blockUnknown": true,
"class": "solr.BasicAuthPlugin",
"credentials": {
"solr": "66HnQCUN0FcnpeoLFQYg91wc4S1RqwmsLmM5LOEoInM= 1qNFcGO1IWaEg5mcvvQCl36GYBjj/paXGXc7B6pyvr4=",
"root": "66HnQCUN0FcnpeoLFQYg91wc4S1RqwmsLmM5LOEoInM= 1qNFcGO1IWaEg5mcvvQCl36GYBjj/paXGXc7B6pyvr4="
}
},
"authorization": {
"class": "solr.RuleBasedAuthorizationPlugin",
"permissions": [
{
"name": "config-read",
"role": ["solr"]
},
{
"name": "all",
"role": "admin"
}
],
"user-role": {
"admin": "admin",
"solr": "solr"
}
}
}
```
Then I hit http://localhost:8983/solr/admin/configs?action=LIST in Firefox and enter either 'solr/solr' or 'root/solr' as user/pass. The 'solr' user does not gain access without this patch.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
[GitHub] [solr] TheSench commented on pull request #296: SOLR-15626: Fix `config-read` permission.
Posted by GitBox <gi...@apache.org>.
TheSench commented on pull request #296:
URL: https://github.com/apache/solr/pull/296#issuecomment-929471727
This PR still needs a maintainer to approve the running of workflows.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
[GitHub] [solr] epugh commented on pull request #296: SOLR-15626: Fix `config-read` permission.
Posted by GitBox <gi...@apache.org>.
epugh commented on pull request #296:
URL: https://github.com/apache/solr/pull/296#issuecomment-933652367
@janhoy I've been trying to duplicate this bug (and the fix) but haven't been able to duplicate it, it all seems to work as expected without being on this branch. I'd love your thoughts on if we should just go ahead and merge this change? the code makes sense to me when I read it! and maybe I just don't have the reight environment to test...
Makes me wish we had a good way of firing up techproducts with a realistic security.json ;-)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
[GitHub] [solr] epugh edited a comment on pull request #296: SOLR-15626: Fix `config-read` permission.
Posted by GitBox <gi...@apache.org>.
epugh edited a comment on pull request #296:
URL: https://github.com/apache/solr/pull/296#issuecomment-921728331
So... Thoughts on putting in a Unit Test? I think there is going to be a LOT of these types of issues, and that having tests would be great. I think you might be creating a new style of unit testing (well, really integration test), and would add a lot!
Some sort of way of having many security.json? `security-config-read.json` and `security-block-everyone.json` etc..?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
[GitHub] [solr] TheSench commented on pull request #296: SOLR-15626: Fix `config-read` permission.
Posted by GitBox <gi...@apache.org>.
TheSench commented on pull request #296:
URL: https://github.com/apache/solr/pull/296#issuecomment-937823770
The next Solr would be ideal, but only so that more users can benefit. In using a workaround already on my end.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
[GitHub] [solr] epugh merged pull request #296: SOLR-15626: Fix `config-read` permission.
Posted by GitBox <gi...@apache.org>.
epugh merged pull request #296:
URL: https://github.com/apache/solr/pull/296
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org