thelabdude commented on a change in pull request #168:
URL: https://github.com/apache/solr/pull/168#discussion_r651965550
##########
File path: solr/solr-ref-guide/src/parallel-sql-interface.adoc
##########
@@ -66,6 +66,14 @@ The `/sql` handler is the front end of the Parallel SQL
interface. All SQL queri
By default, the `/sql` request handler is configured as an implicit handler,
meaning that it is always enabled in every Solr installation and no further
configuration is required.
+==== Authorization for SQL Requests
+
+If your Solr cluster is configured to use the
<<rule-based-authorization-plugin.adoc#,Rule-based Authorization Plugin>>,
+then you need to grant `GET` and `POST` permission on the `/sql`, `/select`,
and `/export` endpoints for all collections you intend to execute SQL queries
against.
+
+Prior to Solr 9.0, you'll also need to grant `GET` permission on the
`/admin/luke` endpoint for all collections queried using SQL; the JDBC driver
uses this endpoint to get schema metadata for the collection.
+As of Solr 9.0, the Solr executes the request to the `/admin/luke` endpoint
using the internal PKI principal.
Review comment:
Your approach sounds good to me @ctargett ... I'll make some changes to
branch_8x! Thanks.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscr...@solr.apache.org
For additional commands, e-mail: issues-h...@solr.apache.org
