You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@lucene.apache.org by "Koji Sekiguchi (JIRA)" <ji...@apache.org> on 2011/09/16 17:54:10 UTC
[jira] [Commented] (SOLR-1895) LCF SearchComponent plugin for
enforcing LCF security at search time
[ https://issues.apache.org/jira/browse/SOLR-1895?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13106544#comment-13106544 ]
Koji Sekiguchi commented on SOLR-1895:
--------------------------------------
I talked with Shinichiro and I was aware of this is awesome!
Some comments:
- Can you post a patch-style file rather than java file?
- Class name should be renamed to something else other than LCF.
- How about moving it to contrib/security or contrib/auth or somewhere else?
- Likewise FacetComponent or MoreLikeThisComponent, isn't security=on|off or auth=on|off flag needed?
- I see there are three while-loop in the attached file. For two of them, I like for-loop rather than while in terms of readability.
- To support distributed search mode, prepare() method should be executed only on Solr server.
- How do you think the idea of having a cache for users' access tokens in this SearchComponent. If I remember it correctly, MCF has similar cache in Authority Service, but if Solr has a cache, it helps search performance. Hopefully can turn on|off, set size and expiration time, etc.
> LCF SearchComponent plugin for enforcing LCF security at search time
> --------------------------------------------------------------------
>
> Key: SOLR-1895
> URL: https://issues.apache.org/jira/browse/SOLR-1895
> Project: Solr
> Issue Type: New Feature
> Components: SearchComponents - other
> Reporter: Karl Wright
> Labels: document, security, solr
> Fix For: 3.5, 4.0
>
> Attachments: LCFSecurityFilter.java, LCFSecurityFilter.java, LCFSecurityFilter.java, LCFSecurityFilter.java
>
>
> I've written an LCF SearchComponent which filters returned results based on access tokens provided by LCF's authority service. The component requires you to configure the appropriate authority service URL base, e.g.:
> <!-- LCF document security enforcement component -->
> <searchComponent name="lcfSecurity" class="LCFSecurityFilter">
> <str name="AuthorityServiceBaseURL">http://localhost:8080/lcf-authority-service</str>
> </searchComponent>
> Also required are the following schema.xml additions:
> <!-- Security fields -->
> <field name="allow_token_document" type="string" indexed="true" stored="false" multiValued="true"/>
> <field name="deny_token_document" type="string" indexed="true" stored="false" multiValued="true"/>
> <field name="allow_token_share" type="string" indexed="true" stored="false" multiValued="true"/>
> <field name="deny_token_share" type="string" indexed="true" stored="false" multiValued="true"/>
> Finally, to tie it into the standard request handler, it seems to need to run last:
> <requestHandler name="standard" class="solr.SearchHandler" default="true">
> <arr name="last-components">
> <str>lcfSecurity</str>
> </arr>
> ...
> I have not set a package for this code. Nor have I been able to get it reviewed by someone as conversant with Solr as I would prefer. It is my hope, however, that this module will become part of the standard Solr 1.5 suite of search components, since that would tie it in with LCF nicely.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@lucene.apache.org
For additional commands, e-mail: dev-help@lucene.apache.org