[GitHub] [solr] thelabdude commented on a change in pull request #168: SOLR-15451: SolrSchema (for SQL) should use PKI principal for request to /admin/luke

[GitBox <gi...@apache.org>]

thelabdude commented on a change in pull request #168:
URL: https://github.com/apache/solr/pull/168#discussion_r648629727



##########
File path: solr/core/src/java/org/apache/solr/handler/sql/SolrSchema.java
##########
@@ -90,17 +95,34 @@ public boolean isClosed() {
     return builder.build();
   }
 
-  private Map<String, LukeResponse.FieldInfo> getFieldInfo(String collection) {
-    String zk = this.properties.getProperty("zk");
-    CloudSolrClient cloudSolrClient = solrClientCache.getCloudSolrClient(zk);
+  @SuppressForbidden(reason = "Do not want the MDC to propagate the user principal, need PKI principal")
+  private Map<String, LukeResponse.FieldInfo> getFieldInfo(final String collection) {
+    final String zk = this.properties.getProperty("zk");
+    // Need to run this in a background server thread so the PKI principal is used to authn / authz the luke request
+    // Not using the MDC aware executor framework b/c that propagates the principal from this thread, which is what we don't want here
+    ExecutorService service = Executors.newSingleThreadExecutor(threadFactory);

Review comment:
       I'm not aware of any "internal handler" that exists for this ... I'll add a cached thread pool service to the `PKIAuthenticationPlugin` to run the request in ... I just wasn't sure how common this problem is across the codebase to warrant adding something reusable.
   
   




-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@solr.apache.org
For additional commands, e-mail: issues-help@solr.apache.org