SlideShare a Scribd company logo
O C T O B E R 1 3 - 1 6 , 2 0 1 6 • A U S T I N , T X
Understanding the Solr security framework
Anshum Gupta
Senior Software Engineer, IBM Watson
3
01
Who am I?
• Anshum Gupta, Apache Lucene/Solr PMC member
and committer, IBM Watson Search team.
• Interested in search and related stuff.
• Apache Lucene since 2006 and Solr since 2010.
• Organizations I am or have been a part of:
4
02
What is ?
• Apache Lucene is a free open source information
retrieval software library
• Originally written in Java by Doug Cutting.
• It is supported by the Apache Software Foundation
and is released under the Apache Software
License.
5
03
What is ?
• Solr (pronounced “solar”, not “solaar”) is an open
source enterprise search platform
• Written in Java,
• For a while now, a part of the Apache Lucene
project.
• Search on Lucene & Resin (SoLR)
• SolrCloud - Distributed feature set
6
"The only truly secure system is one that is powered off, cast
in a block of concrete and sealed in a lead-lined room with
armed guards." —Gene Spaford
7
01
Apache Solr is the most widely-used search
solution on the planet.
Solr has tens of thousands of
applications in production.
You use everyday.
8,000,000+
Total downloads
Solr is both established
and growing.
250,000+
Monthly downloads
2,500+
Open Solr jobs and the largest
community of developers.
8
01
SolrCloud Logical Architecture
Shard 1
(leader)
Followers
Shard 2
(leader)
Followers
ZooKeeper
ZooKeeper instance
Solr Instance
9
01
SolrCloud - Physical Architecture
ZooKeeper
Node 1 Node 2
Load
Balancer
Client
Client
Client
Client
Client
Client
Client
Client
Client
Lots
Of
Interaction
Coins by Creative Stall from the Noun Project
10
01
Why do we need it?
• Multi-tenant systems
• Access control
• Solr resources
• ZooKeeper
• Authentication
• Authorization
• Until recently: Nothing out of the box. Only locked-in, third
party!
11
01
Solr security - available options
• SSL support
• ZooKeeper ACLs
• Authentication framework
• Authorization framework
12
01
Security Framework Architecture
Incoming Request
Authenticate and
attach metadata Authorize Process Request
Error
Servlet Filter
Authentication Plugin
Authorization Plugin
Error
Return Response
with result
13
01
Enabling a plugin
• /security.json file in
ZooKeeper
• Contains security
config
• Custom plugins: More
meta-data can be
provided
{
"authentication" : {
     "class": “class.that.implements.authentication",
"other_data" : "..."
 },
 "authorization": {
     "class": “class.that.implements.authorization",
"other_data" : "..."
  }
}
14
01
Authentication Framework
Authentication
Plugin
Client side component
Server side component
Reconfigurer*Request Reconfigurer*
Inter-node
Requests
Inter-node
Requests
Inter-node
Requests
15
01
Available Authentication Plugins
• BasicAuth
• Kerberos
16
01
Kerberos Plugin
• Prerequisites:
• Enabled via /security.json before Solr instance starts
• Each Solr node must have:
• A Kerberos service principal and key tab file
• Client principal and a corresponding keytab file. Can be the
same as the service principal.
• Recommendation:
• Kerberized ZooKeeper
• Start Solr with the correct host-specific parameters.
Kerberized
Solr
Kerberized
ZooKeeper
Kerberos
EnabledClient
17
01
Authorization Plugins
• Rule based authorization plugin
• Apache Ranger plugin (external)
• DIY!
18
01
Rule based Authorization Plugin
• Rule based permissions - stored in
ZooKeeper
• Editable using API
• Auto-reload on update
• Well known permissions eg:
config-edit, collection-edit,
security-edit
SolrCloud
Cluster
ZooKeeper
Ensemble
19
Getting started with Basic Auth & Rule based plugin is easy!
• Upload security.json
• Add users and permissions using API calls!
curl --user solr:SolrRocks http://localhost:8983/solr/
admin/authorization -H 'Content-type:application/
json' -d '{"set-permission" : {"name":"collection-
admin-edit", "role":"admin"}}'
20
01
Benefits of the frameworks
• Secure operations in a multi-tenant setup
• Allows for features that couldn’t be added due to
lack of security e.g. registering handlers, and
uploading configs via API calls.
21
Writing your own plugin
• Authentication
• Extend AuthenticationPlugin
• Optional: extend HttpClientInterceptorPlugin
• Authorization
• Implement AuthorizationPlugin
• Optionally implement ConfigEditablePlugin
22
01
The eco-system
HDFS
ZooKeeper
And more…
23
01
"Security is not a product, but a process". —Bruce Schneier
• Better inter-node communication standard
• First-class support in SolrJ and bin scripts for basic
auth.
• More plugins!
24
01
Connect@
http://www.twitter.com/anshumgupta
http://www.linkedin.com/in/anshumgupta/
anshum@apache.org
Love Solr? We are hiring!
Ad

Recommended

Solr security frameworks
Solr security frameworks
Anshum Gupta
 
What's New in Apache Solr 4.10
What's New in Apache Solr 4.10
Anshum Gupta
 
SolrCloud Cluster management via APIs
SolrCloud Cluster management via APIs
Anshum Gupta
 
Apache Solr 5.0 and beyond
Apache Solr 5.0 and beyond
Anshum Gupta
 
Managing a SolrCloud cluster using APIs
Managing a SolrCloud cluster using APIs
Anshum Gupta
 
What's new in Solr 5.0
What's new in Solr 5.0
Anshum Gupta
 
Ease of use in Apache Solr
Ease of use in Apache Solr
Anshum Gupta
 
Scaling SolrCloud to a large number of Collections
Scaling SolrCloud to a large number of Collections
Anshum Gupta
 
Best practices for highly available and large scale SolrCloud
Best practices for highly available and large scale SolrCloud
Anshum Gupta
 
Deploying and managing Solr at scale
Deploying and managing Solr at scale
Anshum Gupta
 
Inside Solr 5 - Bangalore Solr/Lucene Meetup
Inside Solr 5 - Bangalore Solr/Lucene Meetup
Shalin Shekhar Mangar
 
Intro to Apache Solr
Intro to Apache Solr
Shalin Shekhar Mangar
 
Building a Solr Continuous Delivery Pipeline with Jenkins: Presented by James...
Building a Solr Continuous Delivery Pipeline with Jenkins: Presented by James...
Lucidworks
 
First oslo solr community meetup lightning talk janhoy
First oslo solr community meetup lightning talk janhoy
Cominvent AS
 
Scaling SolrCloud to a Large Number of Collections: Presented by Shalin Shekh...
Scaling SolrCloud to a Large Number of Collections: Presented by Shalin Shekh...
Lucidworks
 
Deploying and managing SolrCloud in the cloud using the Solr Scale Toolkit
Deploying and managing SolrCloud in the cloud using the Solr Scale Toolkit
thelabdude
 
Securing Search Data in the Cloud
Securing Search Data in the Cloud
SearchStax
 
Solrcloud Leader Election
Solrcloud Leader Election
ravikgiitk
 
Solr Exchange: Introduction to SolrCloud
Solr Exchange: Introduction to SolrCloud
thelabdude
 
How to make a simple cheap high availability self-healing solr cluster
How to make a simple cheap high availability self-healing solr cluster
lucenerevolution
 
Scaling search with SolrCloud
Scaling search with SolrCloud
Saumitra Srivastav
 
"Walk in a distributed systems park with Orleans" Евгений Бобров
"Walk in a distributed systems park with Orleans" Евгений Бобров
Fwdays
 
A Practical Introduction to Apache Solr
A Practical Introduction to Apache Solr
Angel Borroy López
 
Project Orleans - Actor Model framework
Project Orleans - Actor Model framework
Neil Mackenzie
 
How to Develop OpenStack
How to Develop OpenStack
Mehdi Ali Soltani
 
Bee con2016 lightning_20160125005_ocr
Bee con2016 lightning_20160125005_ocr
Angel Borroy López
 
October 2014 HUG : Oozie HA
October 2014 HUG : Oozie HA
Yahoo Developer Network
 
Generic Parse Server
Generic Parse Server
davidolesch
 
Webinar: Fusion for Business Intelligence
Webinar: Fusion for Business Intelligence
Lucidworks
 
Downtown SF Lucene/Solr Meetup: Developing Scalable User Search for PlayStati...
Downtown SF Lucene/Solr Meetup: Developing Scalable User Search for PlayStati...
Lucidworks
 

More Related Content

What's hot (20)

Best practices for highly available and large scale SolrCloud
Best practices for highly available and large scale SolrCloud
Anshum Gupta
 
Deploying and managing Solr at scale
Deploying and managing Solr at scale
Anshum Gupta
 
Inside Solr 5 - Bangalore Solr/Lucene Meetup
Inside Solr 5 - Bangalore Solr/Lucene Meetup
Shalin Shekhar Mangar
 
Intro to Apache Solr
Intro to Apache Solr
Shalin Shekhar Mangar
 
Building a Solr Continuous Delivery Pipeline with Jenkins: Presented by James...
Building a Solr Continuous Delivery Pipeline with Jenkins: Presented by James...
Lucidworks
 
First oslo solr community meetup lightning talk janhoy
First oslo solr community meetup lightning talk janhoy
Cominvent AS
 
Scaling SolrCloud to a Large Number of Collections: Presented by Shalin Shekh...
Scaling SolrCloud to a Large Number of Collections: Presented by Shalin Shekh...
Lucidworks
 
Deploying and managing SolrCloud in the cloud using the Solr Scale Toolkit
Deploying and managing SolrCloud in the cloud using the Solr Scale Toolkit
thelabdude
 
Securing Search Data in the Cloud
Securing Search Data in the Cloud
SearchStax
 
Solrcloud Leader Election
Solrcloud Leader Election
ravikgiitk
 
Solr Exchange: Introduction to SolrCloud
Solr Exchange: Introduction to SolrCloud
thelabdude
 
How to make a simple cheap high availability self-healing solr cluster
How to make a simple cheap high availability self-healing solr cluster
lucenerevolution
 
Scaling search with SolrCloud
Scaling search with SolrCloud
Saumitra Srivastav
 
"Walk in a distributed systems park with Orleans" Евгений Бобров
"Walk in a distributed systems park with Orleans" Евгений Бобров
Fwdays
 
A Practical Introduction to Apache Solr
A Practical Introduction to Apache Solr
Angel Borroy López
 
Project Orleans - Actor Model framework
Project Orleans - Actor Model framework
Neil Mackenzie
 
How to Develop OpenStack
How to Develop OpenStack
Mehdi Ali Soltani
 
Bee con2016 lightning_20160125005_ocr
Bee con2016 lightning_20160125005_ocr
Angel Borroy López
 
October 2014 HUG : Oozie HA
October 2014 HUG : Oozie HA
Yahoo Developer Network
 
Generic Parse Server
Generic Parse Server
davidolesch
 
Best practices for highly available and large scale SolrCloud
Best practices for highly available and large scale SolrCloud
Anshum Gupta
 
Deploying and managing Solr at scale
Deploying and managing Solr at scale
Anshum Gupta
 
Inside Solr 5 - Bangalore Solr/Lucene Meetup
Inside Solr 5 - Bangalore Solr/Lucene Meetup
Shalin Shekhar Mangar
 
Building a Solr Continuous Delivery Pipeline with Jenkins: Presented by James...
Building a Solr Continuous Delivery Pipeline with Jenkins: Presented by James...
Lucidworks
 
First oslo solr community meetup lightning talk janhoy
First oslo solr community meetup lightning talk janhoy
Cominvent AS
 
Scaling SolrCloud to a Large Number of Collections: Presented by Shalin Shekh...
Scaling SolrCloud to a Large Number of Collections: Presented by Shalin Shekh...
Lucidworks
 
Deploying and managing SolrCloud in the cloud using the Solr Scale Toolkit
Deploying and managing SolrCloud in the cloud using the Solr Scale Toolkit
thelabdude
 
Securing Search Data in the Cloud
Securing Search Data in the Cloud
SearchStax
 
Solrcloud Leader Election
Solrcloud Leader Election
ravikgiitk
 
Solr Exchange: Introduction to SolrCloud
Solr Exchange: Introduction to SolrCloud
thelabdude
 
How to make a simple cheap high availability self-healing solr cluster
How to make a simple cheap high availability self-healing solr cluster
lucenerevolution
 
"Walk in a distributed systems park with Orleans" Евгений Бобров
"Walk in a distributed systems park with Orleans" Евгений Бобров
Fwdays
 
A Practical Introduction to Apache Solr
A Practical Introduction to Apache Solr
Angel Borroy López
 
Project Orleans - Actor Model framework
Project Orleans - Actor Model framework
Neil Mackenzie
 
Bee con2016 lightning_20160125005_ocr
Bee con2016 lightning_20160125005_ocr
Angel Borroy López
 
Generic Parse Server
Generic Parse Server
davidolesch
 

Viewers also liked (18)

Webinar: Fusion for Business Intelligence
Webinar: Fusion for Business Intelligence
Lucidworks
 
Downtown SF Lucene/Solr Meetup: Developing Scalable User Search for PlayStati...
Downtown SF Lucene/Solr Meetup: Developing Scalable User Search for PlayStati...
Lucidworks
 
Webinar: Search and Recommenders
Webinar: Search and Recommenders
Lucidworks
 
Webinar: Fusion 2.3 Preview - Enhanced Features with Solr & Spark
Webinar: Fusion 2.3 Preview - Enhanced Features with Solr & Spark
Lucidworks
 
Solr JDBC: Presented by Kevin Risden, Avalon Consulting
Solr JDBC: Presented by Kevin Risden, Avalon Consulting
Lucidworks
 
it's just search
it's just search
Erik Hatcher
 
Cross Data Center Replication for the Enterprise: Presented by Adam Williams,...
Cross Data Center Replication for the Enterprise: Presented by Adam Williams,...
Lucidworks
 
Using Apache Solr for Images as Big Data: Presented by Kerry Koitzsch, Wipro...
Using Apache Solr for Images as Big Data: Presented by Kerry Koitzsch, Wipro...
Lucidworks
 
Downtown SF Lucene/Solr Meetup: Developing Scalable Search for User Generated...
Downtown SF Lucene/Solr Meetup: Developing Scalable Search for User Generated...
Lucidworks
 
Working with deeply nested documents in Apache Solr
Working with deeply nested documents in Apache Solr
Anshum Gupta
 
Coffee, Danish & Search: Presented by Alan Woodward & Charlie Hull, Flax
Coffee, Danish & Search: Presented by Alan Woodward & Charlie Hull, Flax
Lucidworks
 
Webinar: Replace Google Search Appliance with Lucidworks Fusion
Webinar: Replace Google Search Appliance with Lucidworks Fusion
Lucidworks
 
Slash n near real time indexing
Slash n near real time indexing
Umesh Prasad
 
Building a Vibrant Search Ecosystem @ Bloomberg: Presented by Steven Bower & ...
Building a Vibrant Search Ecosystem @ Bloomberg: Presented by Steven Bower & ...
Lucidworks
 
Solr Highlighting at Full Speed: Presented by Timothy Rodriguez, Bloomberg & ...
Solr Highlighting at Full Speed: Presented by Timothy Rodriguez, Bloomberg & ...
Lucidworks
 
Working with deeply nested documents in Apache Solr
Working with deeply nested documents in Apache Solr
Anshum Gupta
 
Webinar: What's New in Solr 6
Webinar: What's New in Solr 6
Lucidworks
 
Webinar: OpenNLP and Solr for Superior Relevance
Webinar: OpenNLP and Solr for Superior Relevance
Lucidworks
 
Webinar: Fusion for Business Intelligence
Webinar: Fusion for Business Intelligence
Lucidworks
 
Downtown SF Lucene/Solr Meetup: Developing Scalable User Search for PlayStati...
Downtown SF Lucene/Solr Meetup: Developing Scalable User Search for PlayStati...
Lucidworks
 
Webinar: Search and Recommenders
Webinar: Search and Recommenders
Lucidworks
 
Webinar: Fusion 2.3 Preview - Enhanced Features with Solr & Spark
Webinar: Fusion 2.3 Preview - Enhanced Features with Solr & Spark
Lucidworks
 
Solr JDBC: Presented by Kevin Risden, Avalon Consulting
Solr JDBC: Presented by Kevin Risden, Avalon Consulting
Lucidworks
 
Cross Data Center Replication for the Enterprise: Presented by Adam Williams,...
Cross Data Center Replication for the Enterprise: Presented by Adam Williams,...
Lucidworks
 
Using Apache Solr for Images as Big Data: Presented by Kerry Koitzsch, Wipro...
Using Apache Solr for Images as Big Data: Presented by Kerry Koitzsch, Wipro...
Lucidworks
 
Downtown SF Lucene/Solr Meetup: Developing Scalable Search for User Generated...
Downtown SF Lucene/Solr Meetup: Developing Scalable Search for User Generated...
Lucidworks
 
Working with deeply nested documents in Apache Solr
Working with deeply nested documents in Apache Solr
Anshum Gupta
 
Coffee, Danish & Search: Presented by Alan Woodward & Charlie Hull, Flax
Coffee, Danish & Search: Presented by Alan Woodward & Charlie Hull, Flax
Lucidworks
 
Webinar: Replace Google Search Appliance with Lucidworks Fusion
Webinar: Replace Google Search Appliance with Lucidworks Fusion
Lucidworks
 
Slash n near real time indexing
Slash n near real time indexing
Umesh Prasad
 
Building a Vibrant Search Ecosystem @ Bloomberg: Presented by Steven Bower & ...
Building a Vibrant Search Ecosystem @ Bloomberg: Presented by Steven Bower & ...
Lucidworks
 
Solr Highlighting at Full Speed: Presented by Timothy Rodriguez, Bloomberg & ...
Solr Highlighting at Full Speed: Presented by Timothy Rodriguez, Bloomberg & ...
Lucidworks
 
Working with deeply nested documents in Apache Solr
Working with deeply nested documents in Apache Solr
Anshum Gupta
 
Webinar: What's New in Solr 6
Webinar: What's New in Solr 6
Lucidworks
 
Webinar: OpenNLP and Solr for Superior Relevance
Webinar: OpenNLP and Solr for Superior Relevance
Lucidworks
 
Ad

Similar to Understanding the Solr security framework - Lucene Solr Revolution 2015 (20)

State of Solr Security 2016: Presented by Ishan Chattopadhyaya, Lucidworks
State of Solr Security 2016: Presented by Ishan Chattopadhyaya, Lucidworks
Lucidworks
 
Solr 8 interview
Solr 8 interview
Alihossein shahabi
 
Solr Security: Tips and Tricks and Things You Really Ought to Know - Kevin Co...
Solr Security: Tips and Tricks and Things You Really Ought to Know - Kevin Co...
Lucidworks
 
Secure Search - Using Apache Sentry to Add Authentication and Authorization S...
Secure Search - Using Apache Sentry to Add Authentication and Authorization S...
Lucidworks
 
Introduction to Apache Solr
Introduction to Apache Solr
Christos Manios
 
Solr
Solr
Mohammad Reza Dehghani Tafti
 
Meet Solr For The Tirst Again
Meet Solr For The Tirst Again
Varun Thacker
 
Introduction to Apache Lucene/Solr
Introduction to Apache Lucene/Solr
Rahul Jain
 
Suche mit Apache Lucene & Co.
Suche mit Apache Lucene & Co.
inovex GmbH
 
Solr cluster with SolrCloud at lucenerevolution (tutorial)
Solr cluster with SolrCloud at lucenerevolution (tutorial)
searchbox-com
 
Alfresco tech talk live on solr august 2012
Alfresco tech talk live on solr august 2012
Alfresco Software
 
DEF CON 27 - MICHAEL STEPANKIN - apache solr injection
DEF CON 27 - MICHAEL STEPANKIN - apache solr injection
Felipe Prado
 
Solr on Cloud
Solr on Cloud
Gulcin Yildirim Jelinek
 
Solr Flair
Solr Flair
Erik Hatcher
 
Search Engine Building with Lucene and Solr (So Code Camp San Diego 2014)
Search Engine Building with Lucene and Solr (So Code Camp San Diego 2014)
Kai Chan
 
Intro to Apache Lucene and Solr
Intro to Apache Lucene and Solr
Grant Ingersoll
 
SOLR
SOLR
Matthew McCullough
 
Apache Solr
Apache Solr
Minh Tran
 
Apache solr liferay
Apache solr liferay
Binesh Gummadi
 
Apache SolrCloud
Apache SolrCloud
Michał Warecki
 
State of Solr Security 2016: Presented by Ishan Chattopadhyaya, Lucidworks
State of Solr Security 2016: Presented by Ishan Chattopadhyaya, Lucidworks
Lucidworks
 
Solr Security: Tips and Tricks and Things You Really Ought to Know - Kevin Co...
Solr Security: Tips and Tricks and Things You Really Ought to Know - Kevin Co...
Lucidworks
 
Secure Search - Using Apache Sentry to Add Authentication and Authorization S...
Secure Search - Using Apache Sentry to Add Authentication and Authorization S...
Lucidworks
 
Introduction to Apache Solr
Introduction to Apache Solr
Christos Manios
 
Meet Solr For The Tirst Again
Meet Solr For The Tirst Again
Varun Thacker
 
Introduction to Apache Lucene/Solr
Introduction to Apache Lucene/Solr
Rahul Jain
 
Suche mit Apache Lucene & Co.
Suche mit Apache Lucene & Co.
inovex GmbH
 
Solr cluster with SolrCloud at lucenerevolution (tutorial)
Solr cluster with SolrCloud at lucenerevolution (tutorial)
searchbox-com
 
Alfresco tech talk live on solr august 2012
Alfresco tech talk live on solr august 2012
Alfresco Software
 
DEF CON 27 - MICHAEL STEPANKIN - apache solr injection
DEF CON 27 - MICHAEL STEPANKIN - apache solr injection
Felipe Prado
 
Search Engine Building with Lucene and Solr (So Code Camp San Diego 2014)
Search Engine Building with Lucene and Solr (So Code Camp San Diego 2014)
Kai Chan
 
Intro to Apache Lucene and Solr
Intro to Apache Lucene and Solr
Grant Ingersoll
 
Ad

Recently uploaded (20)

SAP PM Module Level-IV Training Complete.ppt
SAP PM Module Level-IV Training Complete.ppt
MuhammadShaheryar36
 
Advance Doctor Appointment Booking App With Online Payment
Advance Doctor Appointment Booking App With Online Payment
AxisTechnolabs
 
The Anti-Masterclass Live - Peak of Data & AI 2025
The Anti-Masterclass Live - Peak of Data & AI 2025
Safe Software
 
How Automation in Claims Handling Streamlined Operations
How Automation in Claims Handling Streamlined Operations
Insurance Tech Services
 
Y - Recursion The Hard Way GopherCon EU 2025
Y - Recursion The Hard Way GopherCon EU 2025
Eleanor McHugh
 
Best MLM Compensation Plans for Network Marketing Success in 2025
Best MLM Compensation Plans for Network Marketing Success in 2025
LETSCMS Pvt. Ltd.
 
Folding Cheat Sheet # 9 - List Unfolding 𝑢𝑛𝑓𝑜𝑙𝑑 as the Computational Dual of ...
Folding Cheat Sheet # 9 - List Unfolding 𝑢𝑛𝑓𝑜𝑙𝑑 as the Computational Dual of ...
Philip Schwarz
 
Which Hiring Management Tools Offer the Best ROI?
Which Hiring Management Tools Offer the Best ROI?
HireME
 
Sysinfo OST to PST Converter Infographic
Sysinfo OST to PST Converter Infographic
SysInfo Tools
 
Azure AI Foundry: The AI app and agent factory
Azure AI Foundry: The AI app and agent factory
Maxim Salnikov
 
Best Practice for LLM Serving in the Cloud
Best Practice for LLM Serving in the Cloud
Alluxio, Inc.
 
Application Modernization with Choreo - The AI-Native Internal Developer Plat...
Application Modernization with Choreo - The AI-Native Internal Developer Plat...
WSO2
 
Simplify Task, Team, and Project Management with Orangescrum Work
Simplify Task, Team, and Project Management with Orangescrum Work
Orangescrum
 
Download Adobe Illustrator Crack free for Windows 2025?
Download Adobe Illustrator Crack free for Windows 2025?
grete1122g
 
IDM Crack with Internet Download Manager 6.42 Build 41 [Latest 2025]
IDM Crack with Internet Download Manager 6.42 Build 41 [Latest 2025]
pcprocore
 
Milwaukee Marketo User Group June 2025 - Optimize and Enhance Efficiency - Sm...
Milwaukee Marketo User Group June 2025 - Optimize and Enhance Efficiency - Sm...
BradBedford3
 
On-Device AI: Is It Time to Go All-In, or Do We Still Need the Cloud?
On-Device AI: Is It Time to Go All-In, or Do We Still Need the Cloud?
Hassan Abid
 
MOVIE RECOMMENDATION SYSTEM, UDUMULA GOPI REDDY, Y24MC13085.pptx
MOVIE RECOMMENDATION SYSTEM, UDUMULA GOPI REDDY, Y24MC13085.pptx
Maharshi Mallela
 
ElectraSuite_Prsentation(online voting system).pptx
ElectraSuite_Prsentation(online voting system).pptx
mrsinankhan01
 
Emvigo Capability Deck 2025: Accelerating Innovation Through Intelligent Soft...
Emvigo Capability Deck 2025: Accelerating Innovation Through Intelligent Soft...
Emvigo Technologies
 
SAP PM Module Level-IV Training Complete.ppt
SAP PM Module Level-IV Training Complete.ppt
MuhammadShaheryar36
 
Advance Doctor Appointment Booking App With Online Payment
Advance Doctor Appointment Booking App With Online Payment
AxisTechnolabs
 
The Anti-Masterclass Live - Peak of Data & AI 2025
The Anti-Masterclass Live - Peak of Data & AI 2025
Safe Software
 
How Automation in Claims Handling Streamlined Operations
How Automation in Claims Handling Streamlined Operations
Insurance Tech Services
 
Y - Recursion The Hard Way GopherCon EU 2025
Y - Recursion The Hard Way GopherCon EU 2025
Eleanor McHugh
 
Best MLM Compensation Plans for Network Marketing Success in 2025
Best MLM Compensation Plans for Network Marketing Success in 2025
LETSCMS Pvt. Ltd.
 
Folding Cheat Sheet # 9 - List Unfolding 𝑢𝑛𝑓𝑜𝑙𝑑 as the Computational Dual of ...
Folding Cheat Sheet # 9 - List Unfolding 𝑢𝑛𝑓𝑜𝑙𝑑 as the Computational Dual of ...
Philip Schwarz
 
Which Hiring Management Tools Offer the Best ROI?
Which Hiring Management Tools Offer the Best ROI?
HireME
 
Sysinfo OST to PST Converter Infographic
Sysinfo OST to PST Converter Infographic
SysInfo Tools
 
Azure AI Foundry: The AI app and agent factory
Azure AI Foundry: The AI app and agent factory
Maxim Salnikov
 
Best Practice for LLM Serving in the Cloud
Best Practice for LLM Serving in the Cloud
Alluxio, Inc.
 
Application Modernization with Choreo - The AI-Native Internal Developer Plat...
Application Modernization with Choreo - The AI-Native Internal Developer Plat...
WSO2
 
Simplify Task, Team, and Project Management with Orangescrum Work
Simplify Task, Team, and Project Management with Orangescrum Work
Orangescrum
 
Download Adobe Illustrator Crack free for Windows 2025?
Download Adobe Illustrator Crack free for Windows 2025?
grete1122g
 
IDM Crack with Internet Download Manager 6.42 Build 41 [Latest 2025]
IDM Crack with Internet Download Manager 6.42 Build 41 [Latest 2025]
pcprocore
 
Milwaukee Marketo User Group June 2025 - Optimize and Enhance Efficiency - Sm...
Milwaukee Marketo User Group June 2025 - Optimize and Enhance Efficiency - Sm...
BradBedford3
 
On-Device AI: Is It Time to Go All-In, or Do We Still Need the Cloud?
On-Device AI: Is It Time to Go All-In, or Do We Still Need the Cloud?
Hassan Abid
 
MOVIE RECOMMENDATION SYSTEM, UDUMULA GOPI REDDY, Y24MC13085.pptx
MOVIE RECOMMENDATION SYSTEM, UDUMULA GOPI REDDY, Y24MC13085.pptx
Maharshi Mallela
 
ElectraSuite_Prsentation(online voting system).pptx
ElectraSuite_Prsentation(online voting system).pptx
mrsinankhan01
 
Emvigo Capability Deck 2025: Accelerating Innovation Through Intelligent Soft...
Emvigo Capability Deck 2025: Accelerating Innovation Through Intelligent Soft...
Emvigo Technologies
 

Understanding the Solr security framework - Lucene Solr Revolution 2015

  • 1. O C T O B E R 1 3 - 1 6 , 2 0 1 6 • A U S T I N , T X
  • 2. Understanding the Solr security framework Anshum Gupta Senior Software Engineer, IBM Watson
  • 3. 3 01 Who am I? • Anshum Gupta, Apache Lucene/Solr PMC member and committer, IBM Watson Search team. • Interested in search and related stuff. • Apache Lucene since 2006 and Solr since 2010. • Organizations I am or have been a part of:
  • 4. 4 02 What is ? • Apache Lucene is a free open source information retrieval software library • Originally written in Java by Doug Cutting. • It is supported by the Apache Software Foundation and is released under the Apache Software License.
  • 5. 5 03 What is ? • Solr (pronounced “solar”, not “solaar”) is an open source enterprise search platform • Written in Java, • For a while now, a part of the Apache Lucene project. • Search on Lucene & Resin (SoLR) • SolrCloud - Distributed feature set
  • 6. 6 "The only truly secure system is one that is powered off, cast in a block of concrete and sealed in a lead-lined room with armed guards." —Gene Spaford
  • 7. 7 01 Apache Solr is the most widely-used search solution on the planet. Solr has tens of thousands of applications in production. You use everyday. 8,000,000+ Total downloads Solr is both established and growing. 250,000+ Monthly downloads 2,500+ Open Solr jobs and the largest community of developers.
  • 8. 8 01 SolrCloud Logical Architecture Shard 1 (leader) Followers Shard 2 (leader) Followers ZooKeeper ZooKeeper instance Solr Instance
  • 9. 9 01 SolrCloud - Physical Architecture ZooKeeper Node 1 Node 2 Load Balancer Client Client Client Client Client Client Client Client Client Lots Of Interaction Coins by Creative Stall from the Noun Project
  • 10. 10 01 Why do we need it? • Multi-tenant systems • Access control • Solr resources • ZooKeeper • Authentication • Authorization • Until recently: Nothing out of the box. Only locked-in, third party!
  • 11. 11 01 Solr security - available options • SSL support • ZooKeeper ACLs • Authentication framework • Authorization framework
  • 12. 12 01 Security Framework Architecture Incoming Request Authenticate and attach metadata Authorize Process Request Error Servlet Filter Authentication Plugin Authorization Plugin Error Return Response with result
  • 13. 13 01 Enabling a plugin • /security.json file in ZooKeeper • Contains security config • Custom plugins: More meta-data can be provided { "authentication" : {      "class": “class.that.implements.authentication", "other_data" : "..."  },  "authorization": {      "class": “class.that.implements.authorization", "other_data" : "..."   } }
  • 14. 14 01 Authentication Framework Authentication Plugin Client side component Server side component Reconfigurer*Request Reconfigurer* Inter-node Requests Inter-node Requests Inter-node Requests
  • 16. 16 01 Kerberos Plugin • Prerequisites: • Enabled via /security.json before Solr instance starts • Each Solr node must have: • A Kerberos service principal and key tab file • Client principal and a corresponding keytab file. Can be the same as the service principal. • Recommendation: • Kerberized ZooKeeper • Start Solr with the correct host-specific parameters. Kerberized Solr Kerberized ZooKeeper Kerberos EnabledClient
  • 17. 17 01 Authorization Plugins • Rule based authorization plugin • Apache Ranger plugin (external) • DIY!
  • 18. 18 01 Rule based Authorization Plugin • Rule based permissions - stored in ZooKeeper • Editable using API • Auto-reload on update • Well known permissions eg: config-edit, collection-edit, security-edit SolrCloud Cluster ZooKeeper Ensemble
  • 19. 19 Getting started with Basic Auth & Rule based plugin is easy! • Upload security.json • Add users and permissions using API calls! curl --user solr:SolrRocks http://localhost:8983/solr/ admin/authorization -H 'Content-type:application/ json' -d '{"set-permission" : {"name":"collection- admin-edit", "role":"admin"}}'
  • 20. 20 01 Benefits of the frameworks • Secure operations in a multi-tenant setup • Allows for features that couldn’t be added due to lack of security e.g. registering handlers, and uploading configs via API calls.
  • 21. 21 Writing your own plugin • Authentication • Extend AuthenticationPlugin • Optional: extend HttpClientInterceptorPlugin • Authorization • Implement AuthorizationPlugin • Optionally implement ConfigEditablePlugin
  • 23. 23 01 "Security is not a product, but a process". —Bruce Schneier • Better inter-node communication standard • First-class support in SolrJ and bin scripts for basic auth. • More plugins!