Getting authenticated user inside DocTransformer plugin

[mosheB <mo...@mail.com>]

We are using Solr's kerberos authentication plugin and we are trying to
implement field-level filtering based on the authenticated user and
DocTransformer class:

public class FieldAclTransformerFactory extends TransformerFactory {
	@Override
	public DocTransformer create(String field, SolrParams params,
SolrQueryRequest req) {
		String user = req.getUserPrincipal().getName();
		return new FieldAclTransformer(user);
	}
}
//****************************************************
public class FieldAclTransformer extends DocTransformer {
	String user;
	public FieldAclTransformer(String user) {
		this.user = user;
	}

	@Override
	public void transform(SolrDocument doc, int docid, float score) {
		//filter fields according to applicative logic, based on the authenticated
user.
    }
}

For simplicity, we do not use authorization plugin (here is our complete
security.json file):
{
	"authentication":{
		"class": "org.apache.solr.security.KerberosPlugin"
	}
}

During develop phase plugin was tested against collection with single shard
and everything worked as expected (Solr 8.3.1).
After moving to production, plugin failed. During debug we saw that the
reason is that SOME shards were getting incorrect user from
/req.getUserPrincipal().getName()/: instead of the ORIGINAL user, Solr's SPN
is returned.
Our best guess is that failing requests are the distributed requests (the
requests the are routed from the node that received the original request),
and indeed, if we add `/distrib=false/` to our request plugin wasnt failing.

So, back to the question... is this a bug in solr, or is that just not way
we suppose to get the authenticated user?
Thanks.



--
Sent from: https://lucene.472066.n3.nabble.com/Solr-User-f472068.html

Re: Getting authenticated user inside DocTransformer plugin

[Ishan Chattopadhyaya <ic...@gmail.com>]

This is a problem, indeed. I've opened
https://issues.apache.org/jira/browse/SOLR-14491 to address this.

On Mon, Feb 3, 2020 at 11:08 PM mosheB <mo...@mail.com> wrote:

> We are using Solr's kerberos authentication plugin and we are trying to
> implement field-level filtering based on the authenticated user and
> DocTransformer class:
>
> public class FieldAclTransformerFactory extends TransformerFactory {
>         @Override
>         public DocTransformer create(String field, SolrParams params,
> SolrQueryRequest req) {
>                 String user = req.getUserPrincipal().getName();
>                 return new FieldAclTransformer(user);
>         }
> }
> //****************************************************
> public class FieldAclTransformer extends DocTransformer {
>         String user;
>         public FieldAclTransformer(String user) {
>                 this.user = user;
>         }
>
>         @Override
>         public void transform(SolrDocument doc, int docid, float score) {
>                 //filter fields according to applicative logic, based on
> the authenticated
> user.
>     }
> }
>
> For simplicity, we do not use authorization plugin (here is our complete
> security.json file):
> {
>         "authentication":{
>                 "class": "org.apache.solr.security.KerberosPlugin"
>         }
> }
>
> During develop phase plugin was tested against collection with single shard
> and everything worked as expected (Solr 8.3.1).
> After moving to production, plugin failed. During debug we saw that the
> reason is that SOME shards were getting incorrect user from
> /req.getUserPrincipal().getName()/: instead of the ORIGINAL user, Solr's
> SPN
> is returned.
> Our best guess is that failing requests are the distributed requests (the
> requests the are routed from the node that received the original request),
> and indeed, if we add `/distrib=false/` to our request plugin wasnt
> failing.
>
> So, back to the question... is this a bug in solr, or is that just not way
> we suppose to get the authenticated user?
> Thanks.
>
>
>
> --
> Sent from: https://lucene.472066.n3.nabble.com/Solr-User-f472068.html
>