madrob commented on a change in pull request #168:
URL: https://github.com/apache/solr/pull/168#discussion_r649247022
##########
File path:
solr/solrj/src/java/org/apache/solr/client/solrj/impl/LBSolrClient.java
##########
@@ -217,6 +217,15 @@ public synchronized String nextOrError(Exception
previousEx) throws SolrServerEx
if (numServersTried > 0 && isTimeExceeded(timeAllowedNano, timeOutTime))
{
throw new SolrServerException("Time allowed to handle this request
exceeded"+suffix, previousEx);
}
+
+ // is authz related error
+ if (previousEx instanceof BaseHttpSolrClient.RemoteSolrException) {
+ BaseHttpSolrClient.RemoteSolrException rse =
(BaseHttpSolrClient.RemoteSolrException)previousEx;
+ if (rse.code() == 403) {
+ throw new SolrServerException(previousEx.getMessage(), previousEx);
+ }
+ }
Review comment:
Can we have a test case that exercises this?
##########
File path: solr/solr-ref-guide/src/parallel-sql-interface.adoc
##########
@@ -66,6 +66,14 @@ The `/sql` handler is the front end of the Parallel SQL
interface. All SQL queri
By default, the `/sql` request handler is configured as an implicit handler,
meaning that it is always enabled in every Solr installation and no further
configuration is required.
+==== Authorization for SQL Requests
+
+If your Solr cluster is configured to use the
<<rule-based-authorization-plugin.adoc#,Rule-based Authorization Plugin>>,
+then you need to grant `GET` and `POST` permission on the `/sql`, `/select`,
and `/export` endpoints for all collections you intend to execute SQL queries
against.
+
+Prior to Solr 9.0, you'll also need to grant `GET` permission on the
`/admin/luke` endpoint for all collections queried using SQL; the JDBC driver
uses this endpoint to get schema metadata for the collection.
+As of Solr 9.0, the Solr executes the request to the `/admin/luke` endpoint
using the internal PKI principal.
Review comment:
@ctargett you were talking about the proper ways to document "known
issues" previously, was wondering how you would handle this case specifically.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscr...@solr.apache.org
For additional commands, e-mail: issues-h...@solr.apache.org
