[
https://issues.apache.org/jira/browse/SOLR-18614?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18136889#comment-18136889
]
Nick Shanin commented on SOLR-18614:
------------------------------------
This looks like the same root cause as SOLR-18579, which [PR
#5214|https://github.com/apache/solr/pull/5214] addresses for container-level
v2 APIs such as {{/api/node/health}}.
I reproduced the report with the released slim distributions in standalone mode
on JDK 21, using BasicAuth with {{blockUnknown=false}}, the predefined
{{health}} permission with {{role: null}}, and an {{all}} permission for an
admin role:
||Build||/solr/admin/info/health (anonymous)||/api/node/health (anonymous)||
|10.0.0|200|200|
|10.1.0|200|401|
|10.1.0 with the path-based workaround from the description|200|200|
|PR #5214 head {{69ba9fe0e9a3}}|200|200|
With TRACE logging on {{RuleBasedAuthorizationPluginBase}}, the anonymous
10.1.0 request is checked in {{HttpSolrCall}} with no handler ("Request handler
[null] is not a PermissionNameProvider, perm doesnt apply"), so {{all}} governs
the request before Jersey's {{SolrRequestAuthorizer}} can match {{health}}. The
endpoint moved to JAX-RS in SOLR-16458, which is in 10.1.0 but not 10.0.0. The
PR's own tests ({{JaxRsPredefinedPermissionTest}},
{{JaxRsRemoteProxyAuthzTest}}) pass at that head.
Not checked: SolrCloud mode, and the PR base built from source (the classes
involved are identical between the PR base and 10.1.0).
[~epugh], would it be reasonable to link this as a duplicate of SOLR-18579 and
list it in the PR #5214 changelog entry?
🤖 _AI text above_ 🤖 _(reviewed by Nick Shanin)_
> Predefined "health" permission does not grant anonymous access to v2 health
> endpoint
> ------------------------------------------------------------------------------------
>
> Key: SOLR-18614
> URL: https://issues.apache.org/jira/browse/SOLR-18614
> Project: Solr
> Issue Type: Bug
> Components: Authorization
> Affects Versions: 10.1
> Reporter: Marco Remy
> Priority: Minor
> Labels: authorization, health, health-check, monitoring
>
> After upgrading from Solr 10.0.0 to 10.1.0, anonymous access to the v2 health
> endpoint stopped working even though the predefined {{health}} permission and
> {{{}authentication.blockUnknown = false{}}}.
> *Steps to reproduce:*
> * Configure BasicAuth + RuleBasedAuthorizationPlugin with:
> * {{authentication.blockUnknown = false}}
> * Predefined permission {{\{"name": "health", "role": null, "index": 11\}}}
> Call the endpoints without credentials:
> {noformat}
> GET /solr/admin/info/health → 200 (works)
> GET /api/node/health → 401
> {noformat}
> *Workaround that restores access:*
> {code:json}
> {
> "name": "health-v2",
> "role": null,
> "collection": null,
> "path": ["/____v2/node/health"],
> "method": ["GET"],
> "params":{},
> "index": 12
> }
> {code}
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
