Apache Solr Reference Guide Covering Apache Solr 6.0

to support fine-grained user access control. When creating security.json you can add the permissions to the
file, or you can use the Authorization API described below to add them as needed.
This example security.json shows how the Basic authentication plugin can work with this authorization
plugin:
{
"authentication":{
"class":"solr.BasicAuthPlugin",
"blockUnknown": true,
"credentials":{"solr":"IV0EHq1OnNrj6gvRCwvFwTrZ1+z1oBbnQdiVC3otuq0=
Ndd7LKvVBAaZIF0QAVi1ekCfAJXr1GGfLtRUXhgrF8c="}
},
"authorization":{
"class":"solr.RuleBasedAuthorizationPlugin",
"permissions":[{"name":"security-edit",
"role":"admin"}]
"user-role":{"solr":"admin"}
}}
There are several things defined in this example:
Basic authentication and rule-based authorization plugins are enabled.
A user called 'solr', with a password has been defined.
All requests w/o credentials will be rejected with a 401 error. Set 'blockUnknown' to false (or remove it
altogether) if you wish to let unauthenticated requests to go through. However, if a particular resource is
protected by a rule, they are rejected anyway with a 401 error.
The 'admin' role has been defined, and it has permission to edit security settings.
The 'solr' user has been defined to the 'admin' role.
Permission Attributes
Each role is comprised of one or more permissions which define what the user is allowed to do. Each permission
is made up of several attributes that define the allowed activity. There are some pre-defined permissions which
cannot be modified.
The permissions are consulted in order they appear in security.json. The first permission that matches is
applied for each user, so the strictest permissions should be at the top of the list. Permissions order can be
controlled with a parameter of the Authorization API, as described below.
Pre-defined Permissions
There are several permissions that are pre-defined. These have fixed default values, which cannot be modified,
and new attributes cannot be added. To use these attributes, simply define a role that includes this permission,
and then assign a user to that role.
The pre-defined permissions are:
security-edit: this permission is allowed to edit the security configuration, meaning any update action that
modifies security.json through the APIs will be allowed.
security-read: this permission is allowed to read the security configuration, meaning any action that reads
security.json settings through the APIs will be allowed.
schema-edit: this permission is allowed to edit a collection's schema using the Schema API. Note that
this allows schema edit permissions for all collections. If edit permissions should only be applied to
specific collections, a custom permission would need to be created.
schema-read: this permission is allowed to read a collection's schema using the Schema API. Note that
this allows schema read permissions for all collections. If read permissions should only be applied to
specific collections, a custom permission would need to be created.
config-edit: this permission is allowed to edit a collection's configuration using the Config API, the Reque
Apache Solr Reference Guide 6.0
522