You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@solr.apache.org by "Jesssullivan (via GitHub)" <gi...@apache.org> on 2025/10/24 01:44:27 UTC
[PR] SOLR-17977: Fix Admin UI security detection in SolrCloud with reverse proxies [solr]
Jesssullivan opened a new pull request, #3807:
URL: https://github.com/apache/solr/pull/3807
Hi There,
I'd like to address / consider if there is additional clarity to be added around BasicAuth detection behind proxies and/or complex k8s ingress service chains in SolrCloud mode for Solr 10 onward. I've hummed and hawed about opening a ticket with this, but I figure as more SolrCloud instances land in kuberentes behind various proxies and ingresses, the general assumption is it'd be preferable to handle this gracefully from the admin UI.
### Description
Admin UI shows 'Security not enabled' when BasicAuth is configured behind reverse proxies because proxy injects auth headers, making System API return 200 OK instead of 401. This makes for inaccurate reporting in the UI in CloudMode when basic Auth is enabled with common k8s ingress patterns.
### Solution
I think one way to address this would be to add fallback detection methods in security.js for BasicAuth detection:
1. System API check (existing sole Admin UI behavior)
2. Security API endpoint check for auth data/WWW-Authenticate headers
3. Direct ZooKeeper /security.json verification (cloudmode-specific)
### Tests
Please describe the tests you've developed or run to confirm this patch implements the feature or solves the problem.
- [ ] I am game to add a test or two; while this deals with the security functionality of solr in CloudMode, it is primarily cosmetic. going to think on how best to programmatically additional test for each of the two fail over modes without a full blown e2e test.
### Checklist
Please review the following and check all that apply:
- [x] I have reviewed the guidelines for [How to Contribute](https://github.com/apache/solr/blob/main/CONTRIBUTING.md) and my code conforms to the standards described there to the best of my ability.
- [x] I have created a Jira issue and added the issue ID to my pull request title.
- [x] I have developed this patch against the `main` branch.
- [x] I have run `./gradlew check`.
- [x] I have given Solr maintainers [access](https://help.github.com/en/articles/allowing-changes-to-a-pull-request-branch-created-from-a-fork) to contribute to my PR branch. (optional but recommended, not available for branches on forks living under an organisation)
- [ ] I have added tests for my changes.
- [ ] I have added documentation for the [Reference Guide](https://github.com/apache/solr/tree/main/solr/solr-ref-guide)
- [x] I have added a [changelog entry](https://github.com/apache/solr/blob/main/dev-docs/changelog.adoc) for my change
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
Re: [PR] SOLR-17977: Fix Admin UI security detection in SolrCloud with reverse proxies [solr]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] closed pull request #3807: SOLR-17977: Fix Admin UI security detection in SolrCloud with reverse proxies
URL: https://github.com/apache/solr/pull/3807
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
Re: [PR] SOLR-17977: Fix Admin UI security detection in SolrCloud with reverse proxies [solr]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #3807:
URL: https://github.com/apache/solr/pull/3807#issuecomment-3700902711
This PR has had no activity for 60 days and is now labeled as stale. Any new activity will remove the stale label. To attract more reviewers, please tag people who might be familiar with the code area and/or notify the dev@solr.apache.org mailing list. To exempt this PR from being marked as stale, make it a draft PR or add the label "exempt-stale". If left unattended, this PR will be closed after another 60 days of inactivity. Thank you for your contribution!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
Re: [PR] SOLR-17977: Fix Admin UI security detection in SolrCloud with reverse proxies [solr]
Posted by "malliaridis (via GitHub)" <gi...@apache.org>.
malliaridis commented on PR #3807:
URL: https://github.com/apache/solr/pull/3807#issuecomment-3469003530
I was trying to review this PR and share my point of view about the current implementation of BasicAuth and MultiAuth plugins, as I have faced some limitations as well and still need to address a few more in an open PR (see draft).
> because proxy injects auth headers,
Could you explain eventually why your proxy is injecting auth headers? This sounds to me like a very special case.
From your Caddyfile, I believe the following is the relevant part?
```
handle /solr/* {
reverse_proxy solr-baseline:8983 {
# ...
# Pass through client Authorization header
header_up Authorization {header.Authorization}
# ...
```
Judging by the setup you provided in the test stack, it seems that the auth header is always injected. Is that a correct interpretation?
If so, and if the proxy would only inject auth header if the client is providing them during a request forwarding, it would not be an issue, right?
One of the limitations I am still facing is that the `WWW-Authenticate` is not provided for all authentication methods available when using MultiAuth.
And an additional note, if you take into acocunt the additional `X-Requested-With` header sent by the client, you are still facing the auth issue you are trying to solve here, right?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
Re: [PR] SOLR-17977: Fix Admin UI security detection in SolrCloud with reverse proxies [solr]
Posted by "Jesssullivan (via GitHub)" <gi...@apache.org>.
Jesssullivan commented on PR #3807:
URL: https://github.com/apache/solr/pull/3807#issuecomment-3444440963
> @malliaridis
Awesome! The new UI looks neat, thanks for the pointer to @malliaridis's 17885. 🙏 AFAICT the new UI addresses these issues (parses WWW-Authenticate headers, checks for HTTP 401, always sends credentials via Ktor sendWithoutRequest = true), though I'll need to actually test this too.
I'll try to find some time this afternoon to glue together a minimal podman test stack for this. This'll also let us verify the new UI's behavior 🤘
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
Re: [PR] SOLR-17977: Fix Admin UI security detection in SolrCloud with reverse proxies [solr]
Posted by "Jesssullivan (via GitHub)" <gi...@apache.org>.
Jesssullivan commented on PR #3807:
URL: https://github.com/apache/solr/pull/3807#issuecomment-3445443855
@epugh A baseline [test stack available here](https://github.com/Jesssullivan/solr/tree/dev/SOLR-17977-tests/tests/solr-17977-admin-ui-detection). Unsure if there would be merit to adding long lived solr docker tests for this, going to keep thinking on how to integrate proxy detection with the extant Solr `/solr/docker/tests/cases` pattern. 🤔 🌁
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
Re: [PR] SOLR-17977: Fix Admin UI security detection in SolrCloud with reverse proxies [solr]
Posted by "Jesssullivan (via GitHub)" <gi...@apache.org>.
Jesssullivan commented on PR #3807:
URL: https://github.com/apache/solr/pull/3807#issuecomment-3473369675
> Could you explain eventually why your proxy is injecting auth headers? This sounds to me like a very special case.
Sure! With solr in CloudMode in kubernetes we are horizontally scaling solr pods sharing a proxy service, the proxy itself behind the ingress. This is a fairly common pattern for making things HPA friendly (at least I think it is, perhaps just in my corner of the world).
> If so, and if the proxy would only inject auth header if the client is providing them during a request forwarding, it would not be an issue, right?
Right! It shouldn't be, this is primarily what this MR seeks to fix in the UI. This is already true for auth, but the extant UI does not yet accurately reflect this, despite forwarding (with Caddy as the example, `header_up Authorization {header.Authorization}`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
Re: [PR] SOLR-17977: Fix Admin UI security detection in SolrCloud with reverse proxies [solr]
Posted by "Jesssullivan (via GitHub)" <gi...@apache.org>.
Jesssullivan commented on PR #3807:
URL: https://github.com/apache/solr/pull/3807#issuecomment-3461703993
> Podman is similiar to docker right? On osx you would use brew install podman?
>
> I will give it a try!
Totally, yes! Podman can get a bit weird with apple silicon + existing docker installations as a forewarning. I'll may take some time this afternoon on proxy testing with the new UI.
```zsh
# osx:
brew install podman
podman machine init
podman machine start
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
Re: [PR] SOLR-17977: Fix Admin UI security detection in SolrCloud with reverse proxies [solr]
Posted by "epugh (via GitHub)" <gi...@apache.org>.
epugh commented on code in PR #3807:
URL: https://github.com/apache/solr/pull/3807#discussion_r2460757354
##########
solr/licenses/cuvs-java-25.10.0.jar.sha1:
##########
Review Comment:
Sigh, this issue hopefully is getting resolved and when you pull from main it will go away!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
Re: [PR] SOLR-17977: Fix Admin UI security detection in SolrCloud with reverse proxies [solr]
Posted by "epugh (via GitHub)" <gi...@apache.org>.
epugh commented on PR #3807:
URL: https://github.com/apache/solr/pull/3807#issuecomment-3446635692
Podman is similiar to docker right? On osx you would use brew install podman?
I will give it a try!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org
Re: [PR] SOLR-17977: Fix Admin UI security detection in SolrCloud with reverse proxies [solr]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #3807:
URL: https://github.com/apache/solr/pull/3807#issuecomment-3978688238
This PR is now closed due to 60 days of inactivity after being marked as stale. Re-opening this PR is still possible, in which case it will be marked as active again.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org