You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@solr.apache.org by "Hodder, Rick (Property and Casualty CIO)" <Ri...@thehartford.com.INVALID> on 2024/09/24 20:42:24 UTC
RE: Security - Solr in UserManaged Mode (Encrypted Delivery)
>> Regarding authentication on replication. I have not tested yet, but did discover Auth parameters for follower configuration.
Where did you find the Auth parameters for follower configuration ?
Thanks,
RICK HODDER
Staff Software Engineer
Global Specialty
[The Hartford]<https://www.thehartford.com/>
The Hartford
83 Wooster Heights Rd. | 2nd floor
Danbury, CT, 06810
W: 475-329-6251
Email: Richard.Hodder@theHartford.com<ma...@theHartford.com>
www.thehartford.com<https://www.thehartford.com/>
www.facebook.com/thehartford<https://www.facebook.com/thehartford>
twitter.com/thehartford<https://twitter.com/thehartford>
From: mtn search <se...@gmail.com>
Sent: Tuesday, September 24, 2024 3:59 PM
To: users@solr.apache.org
Subject: Re: Security - Solr in UserManaged Mode
CAUTION: This email originated from outside the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.
Update:
After following the documented Basic Auth instructions and setting up security.json (with setting "forwardCredentials": true) on all nodes involved I was able to observe security enabled for the Solr Admin UI and for basic /select queries, however was not able to execute queries with a "shards" parameter set to URLs to Solr cores.
However, after enabling the following settings on all 3 Solr nodes - the shard list query worked!!
solr/bin/solr.in.sh<https://urldefense.com/v3/__http:/solr.in.sh__;!!PZ0xAML5PpHLxYfxmvfEjrhN5g!XTl_yE-8a24ZH3oLWPAO8hYJOs8XbEtxvd72A9lukxuMe3O0Z1ZW1B3QkZnQrM6yP3K_iKgR8HwOszzMzqITmFy52g$>
SOLR_AUTH_TYPE="basic"
SOLR_AUTHENTICATION_OPTS="-Dbasicauth=solr:SolrRocks"
I was a little surprised about this (but glad I found it). I figured the security.json with forwardCredentials was all that would be needed for forwarding queries to shards.
Regarding authentication on replication. I have not tested yet, but did discover Auth parameters for follower configuration.
[cid:ii_m1guxazk0]
On Mon, Sep 23, 2024 at 12:18 PM mtn search <se...@gmail.com>> wrote:
Hello,
I see from the documentation - https://solr.apache.org/guide/solr/latest/deployment-guide/securing-solr.html<https://urldefense.com/v3/__https:/solr.apache.org/guide/solr/latest/deployment-guide/securing-solr.html__;!!PZ0xAML5PpHLxYfxmvfEjrhN5g!XTl_yE-8a24ZH3oLWPAO8hYJOs8XbEtxvd72A9lukxuMe3O0Z1ZW1B3QkZnQrM6yP3K_iKgR8HwOszzMzqKFj-P1bw$> - there are a number of options to secure Solr.
Any recommendations for securing Solr in User-Managed mode? Particularly how to handle these cases:
* Security between leader and follower for replication calls.
* Security between Solr nodes, when an aggregator node makes a query to another Solr node in the shards list to fulfill the original query.
Thanks,
Matt
******************************************************************************************************
This communication, including attachments, is for the exclusive use of addressee and may contain proprietary, confidential and/or privileged information. If you are not the intended recipient, any use, copying, disclosure, dissemination or distribution is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, delete this communication and destroy all copies.
******************************************************************************************************
Re: Security - Solr in UserManaged Mode (Encrypted Delivery)
Posted by mtn search <se...@gmail.com>.
Auth params found here -
https://solr.apache.org/guide/solr/latest/deployment-guide/user-managed-index-replication.html#configuring-a-follower-server
On Tue, Sep 24, 2024 at 2:43 PM Hodder, Rick (Property and Casualty CIO)
<Ri...@thehartford.com.invalid> wrote:
> >> Regarding authentication on replication. I have not tested yet, but
> did discover Auth parameters for follower configuration.
>
>
>
> Where did you find the Auth parameters for follower configuration ?
>
>
>
>
>
> Thanks,
>
>
>
> *RICK HODDER*
> Staff Software Engineer
> Global Specialty
>
> [image: The Hartford] <https://www.thehartford.com/>
>
> The Hartford
> 83 Wooster Heights Rd. | 2nd floor
> Danbury, CT, 06810
> W: 475-329-6251
>
> Email: Richard.Hodder@theHartford.com
>
> www.thehartford.com
> www.facebook.com/thehartford
> twitter.com/thehartford
>
>
>
>
>
>
>
> *From:* mtn search <se...@gmail.com>
> *Sent:* Tuesday, September 24, 2024 3:59 PM
> *To:* users@solr.apache.org
> *Subject:* Re: Security - Solr in UserManaged Mode
>
>
>
> *CAUTION:* This email originated from outside the organization. Do not
> click links or open attachments unless you recognize the sender and know
> the content is safe.
>
>
>
> Update:
>
>
>
> After following the documented Basic Auth instructions and setting up
> security.json (with setting "forwardCredentials": true) on all nodes
> involved I was able to observe security enabled for the Solr Admin UI and
> for basic /select queries, however was not able to execute queries with a
> "shards" parameter set to URLs to Solr cores.
>
>
>
> However, after enabling the following settings on all 3 Solr nodes - the
> shard list query worked!!
>
> solr/bin/solr.in.sh
> <https://urldefense.com/v3/__http:/solr.in.sh__;!!PZ0xAML5PpHLxYfxmvfEjrhN5g!XTl_yE-8a24ZH3oLWPAO8hYJOs8XbEtxvd72A9lukxuMe3O0Z1ZW1B3QkZnQrM6yP3K_iKgR8HwOszzMzqITmFy52g$>
>
> SOLR_AUTH_TYPE="basic"
> SOLR_AUTHENTICATION_OPTS="-Dbasicauth=solr:SolrRocks"
>
>
>
> I was a little surprised about this (but glad I found it). I figured the
> security.json with forwardCredentials was all that would be needed for
> forwarding queries to shards.
>
>
>
> Regarding authentication on replication. I have not tested yet, but did
> discover Auth parameters for follower configuration.
>
>
>
>
>
>
>
> On Mon, Sep 23, 2024 at 12:18 PM mtn search <se...@gmail.com> wrote:
>
> Hello,
>
>
>
> I see from the documentation -
> https://solr.apache.org/guide/solr/latest/deployment-guide/securing-solr.html
> <https://urldefense.com/v3/__https:/solr.apache.org/guide/solr/latest/deployment-guide/securing-solr.html__;!!PZ0xAML5PpHLxYfxmvfEjrhN5g!XTl_yE-8a24ZH3oLWPAO8hYJOs8XbEtxvd72A9lukxuMe3O0Z1ZW1B3QkZnQrM6yP3K_iKgR8HwOszzMzqKFj-P1bw$>
> - there are a number of options to secure Solr.
>
>
>
> Any recommendations for securing Solr in User-Managed mode?
> Particularly how to handle these cases:
>
> - Security between leader and follower for replication calls.
> - Security between Solr nodes, when an aggregator node makes a query
> to another Solr node in the shards list to fulfill the original query.
>
> Thanks,
>
> Matt
>
>
> ******************************************************************************************************
> This communication, including attachments, is for the exclusive use of
> addressee and may contain proprietary, confidential and/or privileged
> information. If you are not the intended recipient, any use, copying,
> disclosure, dissemination or distribution is strictly prohibited. If you
> are not the intended recipient, please notify the sender immediately by
> return e-mail, delete this communication and destroy all copies.
>
>
> ******************************************************************************************************
>