Apache Solr Reference Guide Covering Apache Solr 6.0

There are several things defined in this file:
Caveats
Basic authentication and rule-based authorization plugins are enabled.
A user called 'solr', with a password 'SolrRocks' has been defined.
'blockUknown:true' means that unauthenticated requests are not allowed to pass through
The 'admin' role has been defined, and it has permission to edit security settings.
The 'solr' user has been defined to the 'admin' role.
There are a few things to keep in mind when using the Basic authentication plugin.
Credentials are sent in plain text by default. It's recommended to use SSL for communication when Basic
authentication is enabled, as described in the section Enabling SSL.
A user who has access to write permissions to security.json will be able to modify all the permissions
and how users have been assigned permissions. Special care should be taken to only grant access to
editing security to appropriate users.
Your network should, of course, be secure. Even with Basic authentication enabled, you should not
unnecessarily expose Solr to the outside world.
Editing Authentication Plugin Configuration
An Authentication API allows modifying user IDs and passwords. The API provides an endpoint with specific
commands to set user details or delete a user.
API Entry Point
admin/authentication
This endpoint is not collection-specific, so users are created for the entire Solr cluster. If users need to be
restricted to a specific collection, that can be done with the authorization rules.
Add a User or Edit a Password
The set-user command allows you to add users and change their passwords. For example, the following
defines two users and their passwords:
curl --user solr:SolrRocks http://localhost:8983/solr/admin/authentication -H
'Content-type:application/json' -d '{
"set-user": {"tom" : "TomIsCool" ,
"harry":"HarrysSecret"}}'
Delete a User
The delete-user command allows you to remove a user. The user password does not need to be sent to
remove a user. In the following example, we've asked that user IDs 'tom' and 'harry' be removed from the
system.
curl --user solr:SolrRocks http://localhost:8983/solr/admin/authentication -H
'Content-type:application/json' -d '{
"delete-user": ["tom","harry"]}'
Set a property
Set arbitrary properties for authentication plugin. The only supported property is 'blockUnknown'
Apache Solr Reference Guide 6.0
514