CODEWITHSUNDEEP
securitysearchsolr
drigofonte
drigofonte

Reputation: 198

Fine grained security in Solr

Our team currently uses Solr as the backend for our search solution and we are currently looking into adding some security constraints to it. We are currently looking into different levels of security which may encompass:

1) Dataset/core level security: the whole index is blocked from access for unauthorised users.
2) Field level security: certain fields are blocked from access.
3) Document level security: certain documents are blocked from access.

So far my research has shown that most people have implemented URL path based security for Solr, but no one seems to have any experience with finer grained security as outlined above. Our current use case is in the spend analysis market, where access to datasets needs to be tightly controlled at differing levels of granularity.

Based on what we have found so far, our questions are:

1) Is it possible to extend Solr so that it handles these differing levels of security transparently? Or should we be looking at controlling all of this within our search application? 2) Are there any extensions or packages out there that already do anything similar?

Thanks in advance for the help!

Upvotes: 6

Views: 1913

Answers (2)

Oskar Austegard
Oskar Austegard

Reputation: 4639

I realize this is an old question but there have not been many (any?) advances in Solr to help with this since it was asked. There's an excellent general article at https://web.archive.org/web/20140625220726/http://www.searchtechnologies.com/search-engine-security.html that deals with this same question; it does not prescribe a specific implementation but discusses pros and cons of different approaches and is well worth the read.

Upvotes: 0

Mauricio Scheffer
Mauricio Scheffer

Reputation: 99750

As you already have found out, Solr does not current implement any kind of document-level security. Most people handle security at the HTTP level, or at the application level using simple filter queries. Obviously in this case, Solr access needs to be restricted to this application only, e.g. using HTTP auth.

That said, there are a couple of efforts towards implementing document-level security: SOLR-1834 and SOLR-1872. These patches are over a year old, so it will be probably cumbersome to apply them to a recent revision of Solr.

See also these discussions on the topic:

Upvotes: 4

Related Questions