Restrict Solr Admin Access

       0

   solr searchengine tips

---

We aggregate and tag open source projects. We have collections of more than one million projects. Check out the projects section.

Solr is a search engine built on top of Lucene. It supports REST interface and has lot of built-in capabilities. Solr package has Admin UI interface which has support to perform query and even delete the contents of the index. If you are using Solr in production then you may need to restrict access. I saw couple of questions in the group related to this topic. Thought to write an article explaining few tips to restrict the user access to Solr admin UI.

Below are the tips to restrict access to the Solr admin UI but Solr clients will work as usual. This is with respect to Tomcat.

Simple method: This method helps to restrict the access but administrator could access the UI.

1. Rename or remove index.jsp
2. Rename admin folder to some other name, say admin-xyz
3. Access the admin UI using http://localhost/solr/admin-xyz

Restrict access to all users: Copy the below xml and paste it in web.xml available under . This will restrict access to all users including administrator. <security-constraint>
 <web-resource-collection>
 <web-resource-name>
  Restrict access to Solr admin
</web-resource-name>
 <url-pattern>/admin/*</url-pattern>
 <http-method>DELETE</http-method>
 <http-method>GET</http-method>
 <http-method>POST</http-method>
 <http-method>PUT</http-method>
 </web-resource-collection>
 <auth-constraint />
 <user-data-constraint>
 <transport-guarantee>NONE</transport-guarantee>
 </user-data-constraint>
</security-constraint>

Restrict access, but allow privileged user: Sometimes we may need to restrict access to normal users but administrator might want to access the admin interface. In this case, Add username and password information to tomcat-users.xml and do the below change to get access to the privileged user.
Add user information to tomcat-users.xml <user username="admin" password="new-password" roles="admin, manager"/> Add below xml to web.xml <security-constraint>
 <web-resource-collection>
 <web-resource-name>
  Restrict access to Solr admin
</web-resource-name>
 <url-pattern>/admin/*</url-pattern>
 <http-method>DELETE</http-method>
 <http-method>GET</http-method>
 <http-method>POST</http-method>
 <http-method>PUT</http-method>
 </web-resource-collection>
 <auth-constraint >
 <role-name>manager</role-name>  </auth-constraint>  <user-data-constraint>
 <transport-guarantee>NONE</transport-guarantee>
 </user-data-constraint>
</security-constraint>

<login-config>
<auth-method>BASIC</auth-method>
<realm-name>default</realm-name>
</login-config>
Conclusion: If you are using Solr in production then better remove the admin folder and don't package it. In case there is any issue, there are sufficient logs to analyze it.

We aggregate and tag open source projects. We have collections of more than one million projects. Check out the projects section.