Yeah, it beats me. If you've made sure that the security.json in
ZooKeeper is exactly the same as the one I posted but you're still
getting different results, then I'm stumped. Maybe someone else here
has an idea.
Out of curiosity, are you setting your security.json via the
authentication/author
Hi Jason,
Apologies for the late reply. My laptop was broken and I got it today from
service centre.
I am still having issues with solr-user able to view the Collections list
as follow.
Testing permissions for user [solr]
Request [/admin/collections?action=LIST] returned status [200]
Req
Thanks a lot Jason,
I will try this out and let you know.
Thanks again.
On Wed 28 Aug, 2019, 7:45 PM Jason Gerlowski, wrote:
> Hi Salmaan,
>
> Are you still seeing this behavior, or were you able to figure things out?
>
> I just got a chance to try out the security.json in Solr 7.6 myself,
> a
Hi Salmaan,
Are you still seeing this behavior, or were you able to figure things out?
I just got a chance to try out the security.json in Solr 7.6 myself,
and I can't reproduce the behavior you're seeing.
It might be helpful to level set here. Make sure that our
security.json settings and our
Hi,
Any suggestions as to what can be done?
Regards,
Salmaan
On Wed, Aug 21, 2019 at 4:33 PM Jason Gerlowski
wrote:
> Ah, ok. SOLR-13355 still affects 7.6, so that explains why you're
> seeing this behavior.
>
> You could upgrade to get the new behavior, but you don't need to-
> there's a wo
Hi Jason,
Unfortunately, the above mentioned workaround does not work for me.
I modified your script a little bit as follow and it still doesn't work.
{"name": "update", "collection": ["collection1", "collection2"],
"role": "dev"},
{"name": "read", "collection": ["collection1", "collection2"],
Ah, ok. SOLR-13355 still affects 7.6, so that explains why you're
seeing this behavior.
You could upgrade to get the new behavior, but you don't need to-
there's a workaround. You just need to add a few extra rules to your
security.json. The problem in SOLR-13355 is that the "all" permission
is
Hi Jason,
Is there a way to fix this in version 7.6?
Or is it mandatory to upgrade to other versions?
If I have to upgrade to a higher version, then what is the best way to do
this without effecting the current configuration and indexed data?
Thanks,
Salmaan
On Wed, Aug 21, 2019 at 4:13 PM S
Hi Jason,
I am using version 7.6 of Solr.
Thanks,
Salmaan
On Wed, Aug 21, 2019 at 4:12 PM Jason Gerlowski
wrote:
> The "all" permissions _should_ block solr-user from accessing all of
> those resources, and I believe it does in newer versions of Solr.
> There was a bug with it that was fixed
The "all" permissions _should_ block solr-user from accessing all of
those resources, and I believe it does in newer versions of Solr.
There was a bug with it that was fixed a few versions back though- it
sounds like you might be running into that. (see
https://issues.apache.org/jira/browse/SOLR-13
Hi Jason,
Thanks for your prompt reply.
Your code does address few of my concerns like restricting *solr-user* from
accessing the dashboard and from executing other request methods apart from
*"update"* and *"read"*.
But I am still able to access other collections such as *"Collection3",
"Collec
Hi Salmaan,
Solr's RuleBasedAuthorizationPlugin allows requests through if none of
the specified permissions apply. I think that's what you're running
into in your example above. If you want to lockdown a particular API
(or set of APIs) then you need to explicitly add a permission that
restricts
Hi Solr Users,
I want to create a user that has restricted access to Solr. I did the
follwowing:-
1. {
2. "authentication":{
3."blockUnknown": true,
4."class":"solr.BasicAuthPlugin",
5."credentials":{
6. "solr-admin":
"2IUJD9dxRhxSXaJGdMP5z8ggSn4I285Ty9GCWeRNMUg=
13 matches
Mail list logo
