0

I'm using a custom query parser in Solr 4.8.1 to provide document access control from a JWT passed as an fq param. So, something like:

localhost:8983/solr/search?q=*:*&fq={!acl auth=JSON.WEB.TOKEN}

The QueryParser is almost identical to the example in this blog (I just modified it to work with Solr 4.8 and added some logic to extract the authentication groups from the JWT): https://lucidworks.com/blog/custom-security-filtering-in-solr/

My question is: How do I set up a search handler in solrconfig.xml such that queries passed to /search? are required to have an access-control-list fq param? In other words, if a user queries:

localhost:8983/solr/search?q=*:*

I don't want any documents to be returned.

2
  • I would not enforce the presence of such a parameter. You do have a custom post-filter, right? So in that code return always false, if no token is given. As a result a user without a token will not retrieve results.
    – cheffe
    Mar 26, 2015 at 13:39
  • After reading the linked blog, this is what they do also. if (user == null && groups == null) return false;
    – cheffe
    Mar 26, 2015 at 13:41

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.