You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@solr.apache.org by Martin Schober <m....@fz-juelich.de> on 2021/12/15 09:05:04 UTC
Read-only user in solr not working as expected
Dear solr community,
I would like to create two users in solr: An admin and a dev.
The dev should not be able to edit the solr metadata. This user should
not be able to use solr.add or solr delete, I would like him only to be
able to use solr.search for our metadata solr-core (in python pysolr).
However, the user can always use solr.add and solr.delete, no matter
what permissions I set for him. Here is my security.json:
{
"authentication":{
"blockUnknown":true,
"class":"solr.BasicAuthPlugin",
"credentials":{
"my_admin":"<creds>",
"my_dev":"<creds>"},
"forwardCredentials":false,
"":{"v":0}},
"authorization":{
"class":"solr.RuleBasedAuthorizationPlugin",
"user-role":{
"my_admin":["admin"],
"my_dev":["dev"]},
"permissions":[
{
"name":"security-edit",
"role":["admin"],
"index":1},
{
"name":"read",
"role":["dev"],
"index":2}],
"":{"v":0}}
}
I also tried `zk-read`, `metics-read`, `security-read`,
`collection-admin-read` instead of `read`, always with the same result.
The user my_dev can always use solr.add and solr.delete.
Greetings
Martin
--
Martin Schober
Arbeitsgruppe: Faserbahnarchitektur (FA)
Institut für Neurowissenschaften und Medizin
Strukturelle und funktionelle Organisation des Gehirns (INM-1)
Telefon: +49 2461 61-9148
E-Mail: m.schober@fz-juelich.de
Geb. 15.9, Raum 4017
Homepage: http://www.fz-juelich.de/SharedDocs/Personen/INM/INM-1/DE/Schober_Martin.html
---------------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------
Forschungszentrum Juelich GmbH
52425 Juelich
Sitz der Gesellschaft: Juelich
Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498
Vorsitzender des Aufsichtsrats: MinDir Volker Rieke
Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender),
Karsten Beneke (stellv. Vorsitzender), Prof. Dr. Astrid Lambrecht,
Prof. Dr. Frauke Melchior
---------------------------------------------------------------------------------------------
---------------------------------------------------------------------------------------------
Re: Read-only user in solr not working as expected
Posted by Timothy Potter <th...@gmail.com>.
Try adding the "all" permission with the "admin" role assigned (in the
last position in the permission list). Having all explicitly defined
(and last) will cover all other permissions that aren't explicitly
defined in your config.
On Wed, Dec 15, 2021 at 2:05 AM Martin Schober <m....@fz-juelich.de> wrote:
>
> Dear solr community,
>
> I would like to create two users in solr: An admin and a dev.
> The dev should not be able to edit the solr metadata. This user should
> not be able to use solr.add or solr delete, I would like him only to be
> able to use solr.search for our metadata solr-core (in python pysolr).
>
> However, the user can always use solr.add and solr.delete, no matter
> what permissions I set for him. Here is my security.json:
>
> {
> "authentication":{
> "blockUnknown":true,
> "class":"solr.BasicAuthPlugin",
> "credentials":{
> "my_admin":"<creds>",
> "my_dev":"<creds>"},
> "forwardCredentials":false,
> "":{"v":0}},
> "authorization":{
> "class":"solr.RuleBasedAuthorizationPlugin",
> "user-role":{
> "my_admin":["admin"],
> "my_dev":["dev"]},
> "permissions":[
> {
> "name":"security-edit",
> "role":["admin"],
> "index":1},
> {
> "name":"read",
> "role":["dev"],
> "index":2}],
> "":{"v":0}}
> }
>
> I also tried `zk-read`, `metics-read`, `security-read`,
> `collection-admin-read` instead of `read`, always with the same result.
> The user my_dev can always use solr.add and solr.delete.
>
> Greetings
> Martin
>
> --
> Martin Schober
>
> Arbeitsgruppe: Faserbahnarchitektur (FA)
> Institut für Neurowissenschaften und Medizin
> Strukturelle und funktionelle Organisation des Gehirns (INM-1)
>
> Telefon: +49 2461 61-9148
> E-Mail: m.schober@fz-juelich.de
> Geb. 15.9, Raum 4017
> Homepage: http://www.fz-juelich.de/SharedDocs/Personen/INM/INM-1/DE/Schober_Martin.html
>
> ---------------------------------------------------------------------------------------------
> ---------------------------------------------------------------------------------------------
> Forschungszentrum Juelich GmbH
> 52425 Juelich
> Sitz der Gesellschaft: Juelich
> Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498
> Vorsitzender des Aufsichtsrats: MinDir Volker Rieke
> Geschaeftsfuehrung: Prof. Dr.-Ing. Wolfgang Marquardt (Vorsitzender),
> Karsten Beneke (stellv. Vorsitzender), Prof. Dr. Astrid Lambrecht,
> Prof. Dr. Frauke Melchior
> ---------------------------------------------------------------------------------------------
> ---------------------------------------------------------------------------------------------
>