solr入门之solr安全控制的研究和实践(一)
本研究基于solr官方文档:
链接：http://pan.baidu.com/s/1geAadZ9 密码：02x0
solr从5.3.0开始提供了安全验证的机制,具体有以下几种方式:
Kerberos Authentication Plugin
Basic Authentication Plugin
Rule-Based Authorization Plugin
Custom authentication or authorization plugin
具体使用要求如下:
Basic authentication: SolrCloud only.
Kerberos authentication: SolrCloud or standalone mode.
Rule-based authorization: SolrCloud only.
要是使用集群模式,需要上传一个文件到zookeeper中,即
security.json格式如下
{
"authentication" : {
"class": "class.that.implements.authentication"
},
"authorization": {
"class": "class.that.implements.authorization"
}
}
上传脚本:
server/scripts/cloud-scripts/zkcli.sh -zkhost localhost:2181 -cmd put
/security.json
今天先到这里,mark一下到501页.
Solr has two implementations of authentication plugins:
Kerberos Authentication Plugin
Basic Authentication Plugin
这两个插件的安全验证部分是已经实现了的.直接在security.json中配置就可以了
授权部分需要自己去实现AuthorizationPlugin
Authorization
An authorization plugin can be written for Solr by extending the AuthorizationPlugin interface.
加载自定义插件
Loading a Custom Plugin
Make sure that the plug-in implementation is in the classpath.
The plugin can then be initialized by specifying the same in security.json in the following manner:
{
"authorization": {
"class": "org.apache.solr.security.MockAuthorizationPlugin",
"other_data" : "..."}
}
注意:这中配置仅仅支持集群模式,而且重新加载授权时需要重启solr服务
也有一个已经实现的授权插件
Available Authorization Plugins
Solr has one implementation of an authorization plugin:
Rule-Based Authorization Plugin
Basic Authentication Plugin
要将security.json上传到zookeeper中
{
"authentication":{
"blockUnknown": true,
"class":"solr.BasicAuthPlugin",
"credentials":{"solr":"IV0EHq1OnNrj6gvRCwvFwTrZ1+z1oBbnQdiVC3otuq0=
Ndd7LKvVBAaZIF0QAVi1ekCfAJXr1GGfLtRUXhgrF8c="}
},
"authorization":{
"class":"solr.RuleBasedAuthorizationPlugin",
"permissions":[{"name":"security-edit",
"role":"admin"}],
"user-role":{"solr":"admin"}
}}
Basic authentication and rule-based authorization plugins are enabled.
A user called 'solr', with a password has been defined.
Unauthenticated requests are not allowed to pass through
The 'admin' role has been defined, and it has permission to edit security settings.
The 'solr' user has been defined to the 'admin' role.
基本安全和基本规则插件要被启用
一个用户solr,密码要被定义
未认证的请求不允许访问
定义了admin角色,有权限修改安全设置
solr用户被定义为admin用户
Editing User Details(编辑用户信息)
An Authentication API allows modifying user IDs and passwords.
The API provides an endpoint with specific
commands to set user details or delete a user.
认证API允许去修改用户的id和密码.这个API提供了指定的命令去设置用户详细信息及
删除一个用户.
API Entry Point(API的入口)
admin/authentication
This endpoint is not collection-specific, so users are created for the entire Solr cluster.
If users need to be
restricted to a specific collection,
that can be done with the authorization rules.
这里没有指定集合,所以用户能够操作整个solr集群 ,如果使用者想去限制指定的集合,那么
可以在授权规则中去设置.
下面是添加,删除,及solrJ连接的例子(493和494)
solr集群中节点之间的通信请求是以超级用户的身份进行的(节点自己识别)
PKIAuthenticationPlugin
任何两个节点之间通过,公钥和密钥来进行身份验证,并且通信的信息中携带了时间戳,
如果超过5s那么就失败了,这里默认两个节点之间的时间是同步的.可以在启动solr时
设置过期时间
'-Dpkiauth.ttl=10' 为10s过期
Kerberos Authentication Plugin
原理好像是字典表的模式--具体可看文档
下面是协议的参考资料
http://idior.cnblogs.com/archive/2006/03/20/354027.html
配置使用:
同样是配置
security.json文件上传到zookeeper中
还有一个系统配置的方式
-DauthenticationPlugin=org.apache.solr.security.KerberosPlugin
单机版本仅仅只能使用这个模式,集群模式建议使用配置文件的方式
Kerberized ZooKeeper
看这个例子:
starting Zookeeper in Kerberos mode
Browser Configuration
对于浏览器访问UI界面,有些浏览器是不支持的入谷歌.如果支持的话,看看你的电脑如何去
设置系统管理员的kerberized来访问UI界面
Plugin Configuration(配置插件)
Configuration of the Kerberos plugin has several parts:
Create service principals and keytab files
ZooKeeper configuration
Create or update /security.json
Define jaas-client.conf
Solr startup parameters
配置kerberos插件要有以下几个部分:
创建服务主体和字典密码文件
zookeeper的配置
创建或者更新secutity.json
定义jass连接配置
solr的启动参数
具体实例见(496-500)
Rule-Based Authorization Plugin(基本授权规则插件)
solr允许配置规则来控制用户访问系统.能够通过规则对用户进行权限的分配
角色的权限是可以定制的如访问一个特定的集合,请求处理器,请求参数和请求方法
Enable the Authorization Plugin(启用权限控制插件)
上传security.json到zookeeper中
下面是一个Basic authentication plugin + Rule-Based Authorization Plugin 插件的例子
{
"authentication":{
"class":"solr.BasicAuthPlugin",
"blockUnknown": true,
"credentials":{"solr":"IV0EHq1OnNrj6gvRCwvFwTrZ1+z1oBbnQdiVC3otuq0=
Ndd7LKvVBAaZIF0QAVi1ekCfAJXr1GGfLtRUXhgrF8c="}
},
"authorization":{
"class":"solr.RuleBasedAuthorizationPlugin",
"permissions":[{"name":"security-edit",
"role":"admin"}]
"user-role":{"solr":"admin"}
}}
例子的解释:
Basic authentication and rule-based authorization plugins are enabled.
A user called 'solr', with a password has been defined.
All requests w/o credentials will be rejected with a 401 error. Set 'blockUnknown' to false (or remove it
altogether) if you wish to let unauthenticated requests to go through. However, if a particular resource is
protected by a rule, they are rejected anyway with a 401 error.
The 'admin' role has been defined, and it has permission to edit security settings.
The 'solr' user has been defined to the 'admin' role.
大部分和上文中的一致,只有
"blockUnknown": true,是当无访问权限时显示401错误.
今天先到这里,mark一下到501页.