All geek questions in one place

Fine Grain Safety at Solr

Our team is currently using Solr as the basis for our search solution, and we are currently exploring some security limitations. We are currently studying various levels of security that may cover:

1) Dataset / base level security: the entire index is blocked from access for unauthorized users.
2) Field level security: certain fields are blocked from access.
3) Document level security: certain documents are blocked from access.

So far, my research has shown that most people have implemented URL-based protection for Solr, but no one seems to have experience with finer security, as described above. Our current use case is in the cost analysis market, where access to data sets should be strictly controlled at different levels of detail.

Based on what we have found so far, our questions are:

1) Can Solr be expanded to transparently handle these security levels? Or should we control all of this in our search application? 2) Are there any extensions or packages that already do something similar?

Thanks in advance for your help!

+6
source share
2 answers

As you already learned, Solr does not implement any security at the document level. Most people handle security at the HTTP or application level using simple filter requests. Obviously, in this case access to Solr should be limited only to this application, for example. using HTTP authentication.

However, there are several document-level security efforts: SOLR-1834 and SOLR-1872 . These fixes are older than a year, so it will probably be cumbersome to apply them to the recent version of Solr.

See also these related discussions:

+4
source

I understand this is an old question, but there were not many (any?) Successes at Solr to help with this, since it was asked. There is an excellent general article at http://www.searchtechnologies.com/search-engine-security.html that addresses the same issue; it does not prescribe a specific implementation, but discusses the pros and cons of various approaches and deserves attention.

0
source

Source: https://habr.com/ru/post/893490/

More articles:


All Articles