You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@solr.apache.org by "malliaridis (via GitHub)" <gi...@apache.org> on 2025/10/10 15:32:23 UTC
[PR] SOLR-17845: Implement OAuth support in new UI [solr]
malliaridis opened a new pull request, #3754:
URL: https://github.com/apache/solr/pull/3754
https://issues.apache.org/jira/browse/SOLR-17845
# Description
Multiple authentication options should be supported with the new UI, including OAuth.
# Solution
This PR adds support for OAuth in the new UI by using a Ktor server for handling callbacks to the app on desktop, and simple redirects for Web.
# Open Tasks
- [ ] Implement Web
- [ ] Update UI to display multiple authentication options when MultiAuthPlugin used
- [ ] Fix MultiAuthPlugin to send `X-Solr-Authdata` when more than one auth method available
- [ ] Write tests
# Tests
Please describe the tests you've developed or run to confirm this patch implements the feature or solves the problem.
# Checklist
Please review the following and check all that apply:
- [ ] I have reviewed the guidelines for [How to Contribute](https://github.com/apache/solr/blob/main/CONTRIBUTING.md) and my code conforms to the standards described there to the best of my ability.
- [ ] I have created a Jira issue and added the issue ID to my pull request title.
- [ ] I have given Solr maintainers [access](https://help.github.com/en/articles/allowing-changes-to-a-pull-request-branch-created-from-a-fork) to contribute to my PR branch. (optional but recommended, not available for branches on forks living under an organisation)
- [ ] I have developed this patch against the `main` branch.
- [ ] I have run `./gradlew check`.
- [ ] I have added tests for my changes.
- [ ] I have added documentation for the [Reference Guide](https://github.com/apache/solr/tree/main/solr/solr-ref-guide)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
Re: [PR] SOLR-17845: Implement OAuth support in new UI [solr]
Posted by "malliaridis (via GitHub)" <gi...@apache.org>.
malliaridis commented on code in PR #3754:
URL: https://github.com/apache/solr/pull/3754#discussion_r2807768220
##########
solr/ui/src/commonMain/kotlin/org/apache/solr/ui/components/auth/AuthUtils.kt:
##########
@@ -0,0 +1,91 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.solr.ui.components.auth
+
+import kotlin.io.encoding.Base64
+import kotlin.io.encoding.Base64.PaddingOption
+import kotlin.random.Random
+import okio.ByteString
+import okio.ByteString.Companion.encodeUtf8
+
+/**
+ * Characters allowed by RFC 7636 for the code verifier
+ */
+internal const val CODE_VERIFIER_CHARSET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~"
+
+internal const val CODE_VERIFIER_LENGTH = 128
+
+/**
+ * Characters to use for the state generation during OAuth flows.
+ */
+internal const val STATE_CHARSET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"
+
+/**
+ * Length of the state value during OAuth flows.
+ */
+internal const val STATE_LENGTH = 32
+
+/**
+ * Generates a code verifier that is used during OAuth flows.
+ *
+ * @return Code verifier that adheres to the allowed characters defined in [CODE_VERIFIER_CHARSET]
+ * and the required length as defined by [CODE_VERIFIER_LENGTH].
+ */
+internal fun generateCodeVerifier(): String = buildString {
+ repeat(CODE_VERIFIER_LENGTH) {
+ append(CODE_VERIFIER_CHARSET[Random.nextInt(CODE_VERIFIER_CHARSET.length)])
+ }
+}
+
+/**
+ * Generates a code challenge that is used during OAuth flows.
+ *
+ * @param verifier Code verifier as generated by [generateCodeVerifier].
+ * @return The URL-safe, Base64-encoded code challenge.
+ */
+internal fun generateCodeChallenge(verifier: String): String {
+ val sha256Bytes: ByteString = verifier.encodeUtf8().sha256()
+ return Base64.UrlSafe.withPadding(PaddingOption.ABSENT).encode(sha256Bytes.toByteArray())
+}
+
+/**
+ * Generates an OAuth state that is used during OAuth flows.
+ *
+ * @return State value with characters from [STATE_CHARSET] and length [STATE_LENGTH].
+ */
+internal fun generateOAuthState(): String = buildString {
+ repeat(STATE_LENGTH) {
+ append(STATE_CHARSET[Random.nextInt(STATE_CHARSET.length)])
+ }
+}
+
+/**
+ * Retrieve the redirect URI for the OAuth flow.
+ *
+ * This URI is platform-specific, as it generates different redirect URIs based on the current
+ * target / origin.
+ *
+ * Note that in future scenarios we will have to support a changed location path, as the user is
+ * allowed to customize the base path that is right now /solr/ui/.
Review Comment:
I think parameterizing this should not be difficult, just a topic we have to cover with some tests.
##########
solr/ui/src/commonMain/kotlin/org/apache/solr/ui/components/auth/AuthUtils.kt:
##########
@@ -0,0 +1,91 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.solr.ui.components.auth
+
+import kotlin.io.encoding.Base64
+import kotlin.io.encoding.Base64.PaddingOption
+import kotlin.random.Random
+import okio.ByteString
+import okio.ByteString.Companion.encodeUtf8
+
+/**
+ * Characters allowed by RFC 7636 for the code verifier
+ */
+internal const val CODE_VERIFIER_CHARSET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~"
+
+internal const val CODE_VERIFIER_LENGTH = 128
+
+/**
+ * Characters to use for the state generation during OAuth flows.
+ */
+internal const val STATE_CHARSET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"
+
+/**
+ * Length of the state value during OAuth flows.
+ */
+internal const val STATE_LENGTH = 32
+
+/**
+ * Generates a code verifier that is used during OAuth flows.
+ *
+ * @return Code verifier that adheres to the allowed characters defined in [CODE_VERIFIER_CHARSET]
+ * and the required length as defined by [CODE_VERIFIER_LENGTH].
+ */
+internal fun generateCodeVerifier(): String = buildString {
+ repeat(CODE_VERIFIER_LENGTH) {
+ append(CODE_VERIFIER_CHARSET[Random.nextInt(CODE_VERIFIER_CHARSET.length)])
+ }
+}
+
+/**
+ * Generates a code challenge that is used during OAuth flows.
+ *
+ * @param verifier Code verifier as generated by [generateCodeVerifier].
+ * @return The URL-safe, Base64-encoded code challenge.
+ */
+internal fun generateCodeChallenge(verifier: String): String {
+ val sha256Bytes: ByteString = verifier.encodeUtf8().sha256()
+ return Base64.UrlSafe.withPadding(PaddingOption.ABSENT).encode(sha256Bytes.toByteArray())
+}
+
+/**
+ * Generates an OAuth state that is used during OAuth flows.
+ *
+ * @return State value with characters from [STATE_CHARSET] and length [STATE_LENGTH].
+ */
+internal fun generateOAuthState(): String = buildString {
+ repeat(STATE_LENGTH) {
+ append(STATE_CHARSET[Random.nextInt(STATE_CHARSET.length)])
+ }
+}
+
+/**
+ * Retrieve the redirect URI for the OAuth flow.
+ *
+ * This URI is platform-specific, as it generates different redirect URIs based on the current
+ * target / origin.
+ *
+ * Note that in future scenarios we will have to support a changed location path, as the user is
+ * allowed to customize the base path that is right now /solr/ui/.
+ *
+ * TODO Implement the function so that it also allows overriding the callback path. This will
+ * allow us to customize the base path of Solr without affecting the new UI.
Review Comment:
I have seen some implementation in the server / webapp files that are allowing the configuration of the base path. Not sure if that is a thing, but as you mentioned, it may be possible that people run Solr under a different base path with a proxy and it would render the authentication invalid. So we may have to handle this more dynamically, but it would require additional testing.
So I decided to add it as a technical debt for now to focus on more important topics.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
Re: [PR] SOLR-17845: Implement OAuth support in new UI [solr]
Posted by "malliaridis (via GitHub)" <gi...@apache.org>.
malliaridis commented on PR #3754:
URL: https://github.com/apache/solr/pull/3754#issuecomment-3922977019
> it seems like you had to write a lot of code to support oAuth
About this, I am currently investigating a different component constellation to reduce the amount of code needed tor un stuff, and by maintaining the testability of the source code of course. If it proves better in the project I am testing this I will simultaneously migrate the current components of the new UI to the new format.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
Re: [PR] SOLR-17845: Implement OAuth support in new UI [solr]
Posted by "epugh (via GitHub)" <gi...@apache.org>.
epugh commented on PR #3754:
URL: https://github.com/apache/solr/pull/3754#issuecomment-3794557180
when you think this is ready... I'll test it out with my current https://github.com/querqy/chorus setup that has Solr + Keycloak set up for the existing admin ui.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
Re: [PR] SOLR-17845: Implement OAuth support in new UI [solr]
Posted by "malliaridis (via GitHub)" <gi...@apache.org>.
malliaridis commented on PR #3754:
URL: https://github.com/apache/solr/pull/3754#issuecomment-3806988094
@epugh I have successfully tested with a keycloak instance in docker and the following OAuth configuration:
```json
{
"authentication": {
"realm": "oauth",
"class": "solr.JWTAuthPlugin",
"blockUnknown": true,
"wellKnownUrl": "http://127.0.0.1:3000/realms/master/.well-known/openid-configuration",
"clientId": "solr-jwt",
"scope": "solr:admin",
"redirectUris": [
"http://127.0.0.1:8088/callback",
"http://127.0.0.1:8983/solr/ui/callback"
],
"authorizationFlow": "code_pkce"
}
}
```
You can give it a try and provide first feedback. I believe it is almost ready, thinking of a few more tests I'd like to add before finalizing, and a few edge cases or customizations that we may add in the future (e.g. customizing paths, redirect URLs and so on).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
Re: [PR] SOLR-17845: Implement OAuth support in new UI [solr]
Posted by "epugh (via GitHub)" <gi...@apache.org>.
epugh commented on code in PR #3754:
URL: https://github.com/apache/solr/pull/3754#discussion_r2807535147
##########
solr/ui/src/commonMain/kotlin/org/apache/solr/ui/components/auth/AuthUtils.kt:
##########
@@ -0,0 +1,91 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.solr.ui.components.auth
+
+import kotlin.io.encoding.Base64
+import kotlin.io.encoding.Base64.PaddingOption
+import kotlin.random.Random
+import okio.ByteString
+import okio.ByteString.Companion.encodeUtf8
+
+/**
+ * Characters allowed by RFC 7636 for the code verifier
+ */
+internal const val CODE_VERIFIER_CHARSET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~"
+
+internal const val CODE_VERIFIER_LENGTH = 128
+
+/**
+ * Characters to use for the state generation during OAuth flows.
+ */
+internal const val STATE_CHARSET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"
+
+/**
+ * Length of the state value during OAuth flows.
+ */
+internal const val STATE_LENGTH = 32
+
+/**
+ * Generates a code verifier that is used during OAuth flows.
+ *
+ * @return Code verifier that adheres to the allowed characters defined in [CODE_VERIFIER_CHARSET]
+ * and the required length as defined by [CODE_VERIFIER_LENGTH].
+ */
+internal fun generateCodeVerifier(): String = buildString {
+ repeat(CODE_VERIFIER_LENGTH) {
+ append(CODE_VERIFIER_CHARSET[Random.nextInt(CODE_VERIFIER_CHARSET.length)])
+ }
+}
+
+/**
+ * Generates a code challenge that is used during OAuth flows.
+ *
+ * @param verifier Code verifier as generated by [generateCodeVerifier].
+ * @return The URL-safe, Base64-encoded code challenge.
+ */
+internal fun generateCodeChallenge(verifier: String): String {
+ val sha256Bytes: ByteString = verifier.encodeUtf8().sha256()
+ return Base64.UrlSafe.withPadding(PaddingOption.ABSENT).encode(sha256Bytes.toByteArray())
+}
+
+/**
+ * Generates an OAuth state that is used during OAuth flows.
+ *
+ * @return State value with characters from [STATE_CHARSET] and length [STATE_LENGTH].
+ */
+internal fun generateOAuthState(): String = buildString {
+ repeat(STATE_LENGTH) {
+ append(STATE_CHARSET[Random.nextInt(STATE_CHARSET.length)])
+ }
+}
+
+/**
+ * Retrieve the redirect URI for the OAuth flow.
+ *
+ * This URI is platform-specific, as it generates different redirect URIs based on the current
+ * target / origin.
+ *
+ * Note that in future scenarios we will have to support a changed location path, as the user is
+ * allowed to customize the base path that is right now /solr/ui/.
+ *
+ * TODO Implement the function so that it also allows overriding the callback path. This will
+ * allow us to customize the base path of Solr without affecting the new UI.
Review Comment:
In olden days you COULD deploy solr at various base paths. so /myapp_search or /solr_prod, but over time we went away from that. These days, we assume the base path is /solr or /api. Now, maybe you are suggesting that with a proxy in front, maybe it would be tools.mycompany.com/servers/prod/solr? I don't know if that would actualy work with Solr!
##########
solr/ui/src/commonMain/kotlin/org/apache/solr/ui/components/auth/AuthUtils.kt:
##########
@@ -0,0 +1,91 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.solr.ui.components.auth
+
+import kotlin.io.encoding.Base64
+import kotlin.io.encoding.Base64.PaddingOption
+import kotlin.random.Random
+import okio.ByteString
+import okio.ByteString.Companion.encodeUtf8
+
+/**
+ * Characters allowed by RFC 7636 for the code verifier
+ */
+internal const val CODE_VERIFIER_CHARSET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~"
+
+internal const val CODE_VERIFIER_LENGTH = 128
+
+/**
+ * Characters to use for the state generation during OAuth flows.
+ */
+internal const val STATE_CHARSET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"
+
+/**
+ * Length of the state value during OAuth flows.
+ */
+internal const val STATE_LENGTH = 32
+
+/**
+ * Generates a code verifier that is used during OAuth flows.
+ *
+ * @return Code verifier that adheres to the allowed characters defined in [CODE_VERIFIER_CHARSET]
+ * and the required length as defined by [CODE_VERIFIER_LENGTH].
+ */
+internal fun generateCodeVerifier(): String = buildString {
+ repeat(CODE_VERIFIER_LENGTH) {
+ append(CODE_VERIFIER_CHARSET[Random.nextInt(CODE_VERIFIER_CHARSET.length)])
+ }
+}
+
+/**
+ * Generates a code challenge that is used during OAuth flows.
+ *
+ * @param verifier Code verifier as generated by [generateCodeVerifier].
+ * @return The URL-safe, Base64-encoded code challenge.
+ */
+internal fun generateCodeChallenge(verifier: String): String {
+ val sha256Bytes: ByteString = verifier.encodeUtf8().sha256()
+ return Base64.UrlSafe.withPadding(PaddingOption.ABSENT).encode(sha256Bytes.toByteArray())
+}
+
+/**
+ * Generates an OAuth state that is used during OAuth flows.
+ *
+ * @return State value with characters from [STATE_CHARSET] and length [STATE_LENGTH].
+ */
+internal fun generateOAuthState(): String = buildString {
+ repeat(STATE_LENGTH) {
+ append(STATE_CHARSET[Random.nextInt(STATE_CHARSET.length)])
+ }
+}
+
+/**
+ * Retrieve the redirect URI for the OAuth flow.
+ *
+ * This URI is platform-specific, as it generates different redirect URIs based on the current
+ * target / origin.
+ *
+ * Note that in future scenarios we will have to support a changed location path, as the user is
+ * allowed to customize the base path that is right now /solr/ui/.
Review Comment:
why would we want to make a change to the base path? Why not just always be /solr/ui?
##########
solr/ui/src/commonMain/kotlin/org/apache/solr/ui/components/start/integration/HttpStartStoreClient.kt:
##########
@@ -91,11 +98,36 @@ class HttpStartStoreClient(
// Split by comma, as there is the chance that headers will be merged and separated by
// comma (e.g. on web target)
.flatMap { header -> header.split(",") }
- .map { authHeader ->
+ .map(String::trim)
+ .mapIndexed { index, authHeader ->
val (scheme, params) = parseWwwAuthenticate(authHeader)
when (scheme.lowercase()) {
"basic", "xbasic" -> AuthMethod.BasicAuthMethod(realm = params["realm"])
Review Comment:
i will say, the basic/xbasic, which isn't what this is about, i know, but it would be nice to figure out how to avoid the need for xbasic. Seems like we need to fix something solr server side.
##########
solr/ui/src/commonMain/kotlin/org/apache/solr/ui/utils/HttpClientUtils.kt:
##########
@@ -79,3 +87,23 @@ fun getHttpClientWithCredentials(
}
}
}
+
+fun getHttpClientWithBearerTokens(
+ accessToken: String,
+ refreshToken: String? = null,
+ url: Url = Url("http://127.0.0.1:8983/"),
Review Comment:
is this url supposed to be hardcoded to a localhost?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
Re: [PR] SOLR-17845: Implement OAuth support in new UI [solr]
Posted by "epugh (via GitHub)" <gi...@apache.org>.
epugh commented on PR #3754:
URL: https://github.com/apache/solr/pull/3754#issuecomment-3393633878
This is exciting... I have a setup where Solr authenticates via oAuth against a Keycloak server. Does that mean in this case the UI would authenticate int he same way? oAuth makes my brain hurt.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
Re: [PR] SOLR-17845: Implement OAuth support in new UI [solr]
Posted by "malliaridis (via GitHub)" <gi...@apache.org>.
malliaridis commented on code in PR #3754:
URL: https://github.com/apache/solr/pull/3754#discussion_r2807773795
##########
solr/ui/src/commonMain/kotlin/org/apache/solr/ui/utils/HttpClientUtils.kt:
##########
@@ -79,3 +87,23 @@ fun getHttpClientWithCredentials(
}
}
}
+
+fun getHttpClientWithBearerTokens(
+ accessToken: String,
+ refreshToken: String? = null,
+ url: Url = Url("http://127.0.0.1:8983/"),
Review Comment:
No, but the new UI is currently configured to work only with 127.0.0.1:8983, as a quick solution. I guess I will address this next in a separate PR, as this limits the usage of the application. I believe I have 1-2 other places where this is hardcoded, which I should not do. 🤕
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
Re: [PR] SOLR-17845: Implement OAuth support in new UI [solr]
Posted by "malliaridis (via GitHub)" <gi...@apache.org>.
malliaridis commented on PR #3754:
URL: https://github.com/apache/solr/pull/3754#issuecomment-3939629899
I will move forward and merge this in a few hours / tomorrow, so that I can continue with other features in the new UI.
In case you identify any bug / limitation with the code, just let me know or create a jira issue and send it to me. Due to the current state of the new UI I think it is fine to have these kind of "early access issues".
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
Re: [PR] SOLR-17845: Implement OAuth support in new UI [solr]
Posted by "malliaridis (via GitHub)" <gi...@apache.org>.
malliaridis commented on code in PR #3754:
URL: https://github.com/apache/solr/pull/3754#discussion_r2807771557
##########
solr/ui/src/commonMain/kotlin/org/apache/solr/ui/components/start/integration/HttpStartStoreClient.kt:
##########
@@ -91,11 +98,36 @@ class HttpStartStoreClient(
// Split by comma, as there is the chance that headers will be merged and separated by
// comma (e.g. on web target)
.flatMap { header -> header.split(",") }
- .map { authHeader ->
+ .map(String::trim)
+ .mapIndexed { index, authHeader ->
val (scheme, params) = parseWwwAuthenticate(authHeader)
when (scheme.lowercase()) {
"basic", "xbasic" -> AuthMethod.BasicAuthMethod(realm = params["realm"])
Review Comment:
The `xbasic` is actually a workaround used in many application, so it is not just a Solr thing. If we use `basic` as scheme, the browser is displaying a credentials prompt automatically before rendering the site, and this prompt is not customizable. Therefore, many applications provide an `xbasic` scheme to work around this default behavior of browsers.
_From Gemini_
> Basic authentication is an HTTP protocol mechanism where a browser displays a native,, non-customizable popup dialog asking for a username and password. It is triggered when a server sends a 401 Unauthorized status and a WWW-Authenticate: Basic header.
Although this is not a problem to use, it is a less appealing application behavior.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
Re: [PR] SOLR-17845: Implement OAuth support in new UI [solr]
Posted by "malliaridis (via GitHub)" <gi...@apache.org>.
malliaridis commented on PR #3754:
URL: https://github.com/apache/solr/pull/3754#issuecomment-3390816948
@epugh PR is still WIP but you can test the current implementation for OAuth on the desktop app (browser not implemented yet). You can run the desktop app via `./gradlew solr:solr.ui:run`.
The implementation supports the OAuth flow with PKCE, which is currently the recommended way of authenticating. Sadly, it is not straight-forward to add support for opening the desktop app from the browser via deep links (this dialog in browser that asks you if you want to open the app). So the solution on desktop relies on an embedded server which is listening to `http://127.0.0.1:8088/callback` for the `code` and `state`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
Re: [PR] SOLR-17845: Implement OAuth support in new UI [solr]
Posted by "malliaridis (via GitHub)" <gi...@apache.org>.
malliaridis merged PR #3754:
URL: https://github.com/apache/solr/pull/3754
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
Re: [PR] SOLR-17845: Implement OAuth support in new UI [solr]
Posted by "malliaridis (via GitHub)" <gi...@apache.org>.
malliaridis commented on PR #3754:
URL: https://github.com/apache/solr/pull/3754#issuecomment-3393711795
> Does that mean in this case the UI would authenticate int he same way?
Yes, I used keycloak for testing as well. I just haven't made everything configurable yet. So you would have to run Solr on 127.0.0.1:8983 and add keycloak with the [JWT auth plugin](https://solr.apache.org/guide/solr/latest/deployment-guide/jwt-authentication-plugin.html). I haven't completed the changes yet, but it should likely work with other Solr instances as well.
FYI I had to configure the keycloak instance correctly to generate a proper JWT token for Solr, but if you already have a running configuration, it should work as expected as long as you add the redirect URL `http://127.0.0.1:8088/callback` to your keycloak client configuration. This redirect URL is the server URL of the Solr desktop app for catching the auth data and signing you in (currently hardcoded).
If you need more information about my testing setup DM me on slack. :)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
Re: [PR] SOLR-17845: Implement OAuth support in new UI [solr]
Posted by "malliaridis (via GitHub)" <gi...@apache.org>.
malliaridis commented on code in PR #3754:
URL: https://github.com/apache/solr/pull/3754#discussion_r2807774584
##########
solr/ui/src/commonMain/kotlin/org/apache/solr/ui/utils/HttpClientUtils.kt:
##########
@@ -79,3 +87,23 @@ fun getHttpClientWithCredentials(
}
}
}
+
+fun getHttpClientWithBearerTokens(
+ accessToken: String,
+ refreshToken: String? = null,
+ url: Url = Url("http://127.0.0.1:8983/"),
Review Comment:
Does this prevents you from testing the new UI with chorus?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
Re: [PR] SOLR-17845: Implement OAuth support in new UI [solr]
Posted by "malliaridis (via GitHub)" <gi...@apache.org>.
malliaridis commented on code in PR #3754:
URL: https://github.com/apache/solr/pull/3754#discussion_r2838616532
##########
solr/ui/src/commonMain/kotlin/org/apache/solr/ui/utils/HttpClientUtils.kt:
##########
@@ -79,3 +87,23 @@ fun getHttpClientWithCredentials(
}
}
}
+
+fun getHttpClientWithBearerTokens(
+ accessToken: String,
+ refreshToken: String? = null,
+ url: Url = Url("http://127.0.0.1:8983/"),
+ realm: String? = null,
+) = getDefaultClient(url) {
+ install(Auth) {
+ bearer {
+ loadTokens {
+ BearerTokens(accessToken, refreshToken)
+ }
+ refreshTokens {
+ TODO("Not implemented yet")
Review Comment:
Now that this PR has been merged, this should be addressed in the same ticket but separate PR.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
Re: [PR] SOLR-17845: Implement OAuth support in new UI [solr]
Posted by "epugh (via GitHub)" <gi...@apache.org>.
epugh commented on PR #3754:
URL: https://github.com/apache/solr/pull/3754#issuecomment-3939683575
Totally!!!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org