Apache Solr Reference Guide Covering Apache Solr 6.0

curl --user solr:SolrRocks http://localhost:8983/solr/admin/authentication -H
'Content-type:application/json' -d '{
"set-property": {"blockUnknown":false}}'
Using BasicAuth with SolrJ
In SolrJ the basic auth credentials need to be set for each request as in this example:
SolrRequest req ;//create a new request object
req.setBasicAuthCredentials(userName, password);
solrClient.request(req);
Securing inter-node requests
There are a lot of requests that originate from the Solr nodes itself. e.g: requests from overseer to nodes,
recovery threads etc . These requests do not carry any basic auth credentials because no user initiated these
requests. This means the user is Solr itself. Solr uses a special internode authentication mechanism where each
Solr node is a super user and is fully trusted by other Solr nodes.
PKIAuthenticationPlugin
This kicks in when there is any request going on between 2 Solr nodes. It is enabled only when the
Authentication plugin does not wish to handle inter-node security (only BasicAuthPlugin as of now) .For each
outgoing request PKIAuthenticationPlugin adds a special header 'SolrAuth' which carries the
timestamp and principal encrypted using the private key of that node. The public key is exposed through an API
so that any node can read it whenever it needs it. Any node who gets the request with that header, would get the
public key from the sender and decrypt the information. if it is able to decrypt the data, the request trusted. It is
invalid if the timestamp is more than 5 secs old. This assumes that the clocks of different nodes in the cluster are
synchronized. The timeout is configurable through a system property called 'pkiauth.ttl'. For example , if you wish
to bump up the ttl to 10 seconds , start each node with a a property '-Dpkiauth.ttl=10' .
Kerberos Authentication Plugin
If you are using Kerberos to secure your network environment, the Kerberos authentication plugin can be used to
secure a Solr cluster. This allows Solr to use a Kerberos service principal and keytab file to authenticate with
ZooKeeper and between nodes of the Solr cluster. Users of the Admin UI and alll clients (such as SolrJ) would
also need to have a valid ticket before being able to use the UI or send requests to Solr.
Support for the Kerberos authentication plugin is only available in SolrCloud mode.
If you are using Solr with a Hadoop cluster secured with Kerberos and intend to store your Solr indexes
in HDFS, also see the section Running Solr on HDFS for additional steps to configure Solr for that
purpose. The instructions on this page apply only to scenarios where Solr will be secured with Kerberos.
If you only need to store your indexes in a Kerberized HDFS system, please see the other section
referenced above.
How Solr Works With Kerberos
When setting up Solr to use Kerberos, configurations are put in place for Solr to use a service principal, or a
Kerberos username, which is registered with the Key Distribution Center (KDC) to authenticate requests. The
configurations define the service principal name and the location of the keytab file that contains the credentials.
Apache Solr Reference Guide 6.0
515