You are viewing a plain text version of this content. The canonical link for it is here.
Posted to solr-user@lucene.apache.org by Mark Todd1 <ma...@uk.ibm.com> on 2020/08/05 11:15:18 UTC
Incorrect Insecure Settings Check in CoreContainer
I've configured SolrCloud (8.5) with both SSL and Authentication which is working correctly. However, I get the following warning in the logs
Solr authentication is enabled, but SSL is off. Consider enabling SSL to protect user credentials and data with encryption
Looking at the source code for SolrCloud there appears to be a bug
if (authenticationPlugin !=null && StringUtils.isNotEmpty(System.getProperty("solr.jetty.https.port"))) {
log.warn("Solr authentication is enabled, but SSL is off. Consider enabling SSL to protect user credentials and data with encryption.");
}
Rather than checking for an empty system property (which would indicate SLL is off) its checking for a populated one which is what you get when SSL is on.
Should I raise this as a Jira bug?
Mark ToddUnless stated otherwise above:
IBM United Kingdom Limited - Registered in England and Wales with number 741598.
Registered office: PO Box 41, North Harbour, Portsmouth, Hampshire PO6 3AU
Re: Incorrect Insecure Settings Check in CoreContainer
Posted by Jason Gerlowski <ge...@gmail.com>.
Hey Mark,
I've fixed it for 8.7 as a part of this ticket here:
https://issues.apache.org/jira/browse/SOLR-14748. Thanks for reporting
this.
Jason
On Tue, Aug 11, 2020 at 3:19 PM Jason Gerlowski <ge...@gmail.com> wrote:
>
> Yikes, yeah it's hard to argue with that.
>
> I'm a little confused because I remember testing this, but maybe it
> snuck in at the last minute? In any case, I'll reopen that jira to
> fix the check there.
>
> Sorry guys.
>
> Jason
>
>
> On Wed, Aug 5, 2020 at 9:22 AM Jan Høydahl <ja...@cominvent.com> wrote:
> >
> > This seems to have been introduced in https://issues.apache.org/jira/browse/SOLR-13972 in 8.4
> > That test seems to be inverted for sure.
> >
> > Jason?
> >
> > Jan
> >
> > > 5. aug. 2020 kl. 13:15 skrev Mark Todd1 <ma...@uk.ibm.com>:
> > >
> > >
> > > I've configured SolrCloud (8.5) with both SSL and Authentication which is working correctly. However, I get the following warning in the logs
> > >
> > > Solr authentication is enabled, but SSL is off. Consider enabling SSL to protect user credentials and data with encryption
> > >
> > > Looking at the source code for SolrCloud there appears to be a bug
> > > if (authenticationPlugin !=null && StringUtils.isNotEmpty(System.getProperty("solr.jetty.https.port"))) {
> > >
> > > log.warn("Solr authentication is enabled, but SSL is off. Consider enabling SSL to protect user credentials and data with encryption.");
> > >
> > > }
> > >
> > > Rather than checking for an empty system property (which would indicate SLL is off) its checking for a populated one which is what you get when SSL is on.
> > >
> > > Should I raise this as a Jira bug?
> > >
> > > Mark ToddUnless stated otherwise above:
> > > IBM United Kingdom Limited - Registered in England and Wales with number 741598.
> > > Registered office: PO Box 41, North Harbour, Portsmouth, Hampshire PO6 3AU
> > >
> >
Re: Incorrect Insecure Settings Check in CoreContainer
Posted by Jason Gerlowski <ge...@gmail.com>.
Yikes, yeah it's hard to argue with that.
I'm a little confused because I remember testing this, but maybe it
snuck in at the last minute? In any case, I'll reopen that jira to
fix the check there.
Sorry guys.
Jason
On Wed, Aug 5, 2020 at 9:22 AM Jan Høydahl <ja...@cominvent.com> wrote:
>
> This seems to have been introduced in https://issues.apache.org/jira/browse/SOLR-13972 in 8.4
> That test seems to be inverted for sure.
>
> Jason?
>
> Jan
>
> > 5. aug. 2020 kl. 13:15 skrev Mark Todd1 <ma...@uk.ibm.com>:
> >
> >
> > I've configured SolrCloud (8.5) with both SSL and Authentication which is working correctly. However, I get the following warning in the logs
> >
> > Solr authentication is enabled, but SSL is off. Consider enabling SSL to protect user credentials and data with encryption
> >
> > Looking at the source code for SolrCloud there appears to be a bug
> > if (authenticationPlugin !=null && StringUtils.isNotEmpty(System.getProperty("solr.jetty.https.port"))) {
> >
> > log.warn("Solr authentication is enabled, but SSL is off. Consider enabling SSL to protect user credentials and data with encryption.");
> >
> > }
> >
> > Rather than checking for an empty system property (which would indicate SLL is off) its checking for a populated one which is what you get when SSL is on.
> >
> > Should I raise this as a Jira bug?
> >
> > Mark ToddUnless stated otherwise above:
> > IBM United Kingdom Limited - Registered in England and Wales with number 741598.
> > Registered office: PO Box 41, North Harbour, Portsmouth, Hampshire PO6 3AU
> >
>
Re: Incorrect Insecure Settings Check in CoreContainer
Posted by Jan Høydahl <ja...@cominvent.com>.
This seems to have been introduced in https://issues.apache.org/jira/browse/SOLR-13972 in 8.4
That test seems to be inverted for sure.
Jason?
Jan
> 5. aug. 2020 kl. 13:15 skrev Mark Todd1 <ma...@uk.ibm.com>:
>
>
> I've configured SolrCloud (8.5) with both SSL and Authentication which is working correctly. However, I get the following warning in the logs
>
> Solr authentication is enabled, but SSL is off. Consider enabling SSL to protect user credentials and data with encryption
>
> Looking at the source code for SolrCloud there appears to be a bug
> if (authenticationPlugin !=null && StringUtils.isNotEmpty(System.getProperty("solr.jetty.https.port"))) {
>
> log.warn("Solr authentication is enabled, but SSL is off. Consider enabling SSL to protect user credentials and data with encryption.");
>
> }
>
> Rather than checking for an empty system property (which would indicate SLL is off) its checking for a populated one which is what you get when SSL is on.
>
> Should I raise this as a Jira bug?
>
> Mark ToddUnless stated otherwise above:
> IBM United Kingdom Limited - Registered in England and Wales with number 741598.
> Registered office: PO Box 41, North Harbour, Portsmouth, Hampshire PO6 3AU
>