JWT Authentication Plugin

Issuer Configuration

This plugin supports one or more token issuers (IdPs). Issuers are configured as a list of JSON objects under the issuers configuration key. The first issuer in the list is the "Primary Issuer", which is the one used for logging in to the Admin UI.

With JWKS URL

To start enforcing authentication for all users, requiring a valid JWT in the Authorization header, you need to configure the plugin with one or more JSON Web Keys (JWK). This is a JSON document containing the key used to sign/encrypt the JWT. It could be a symmetric or asymmetric key. The JWK can either be fetched (and cached) from an external HTTPS endpoint or specified directly in security.json. Below is an example of the former:

{
  "authentication": {
    "class": "solr.JWTAuthPlugin",
    "blockUnknown": true,
    "jwksUrl": "https://my.key.server/jwk.json"
  }
}

With Admin UI Support

The next example shows configuring using OpenID Connect Discovery with a well-known URI for automatic configuration of many common settings, including ability to use the Admin UI with an OpenID Connect enabled Identity Provider.

{
  "authentication": {
    "class": "solr.JWTAuthPlugin",
    "blockUnknown": true,
    "wellKnownUrl": "https://idp.example.com/.well-known/openid-configuration",
    "clientId": "xyz",
    "redirectUris": "https://my.solr.server:8983/solr/"
  }
}

In this case, jwksUrl, iss and authorizationEndpoint will be automatically configured from the fetched configuration.

Complex Example

Let’s look at a more complex configuration, this time with two issuers configured, where one uses a static embedded JWK:

{
  "authentication": {
    "class": "solr.JWTAuthPlugin", 
    "blockUnknown": true, 
    "principalClaim": "solruid", 
    "claimsMatch": { "foo" : "A|B", "dept" : "IT" }, 
    "scope": "solr:read solr:write solr:admin", 
    "algWhitelist" : [ "RS256", "RS384", "RS512" ], 
    "issuers": [ 
      {
        "name": "example1-static", 
        "jwk": { 
          "e": "AQAB",
          "kid": "k1",
          "kty": "RSA",
          "n": "3ZF6w....vjbCXxw"
        },
        "clientId": "solr-client-12345", 
        "iss": "https://example.com/idp", 
        "aud": "https://example.com/solr" 
      },
      {
        "name": "example2",
        "wellKnownUrl": "https://example2.com/.well-known/oidc", 
        "aud": "https://example2.com/solr"
      }
    ]
  }
}

Let’s comment on this config:

Using non-SSL URLs

In production environments you should always use SSL protected HTTPS connections, otherwise you open yourself up to attacks. However, in development, it may be useful to use regular HTTP URLs, and bypass the security check that Solr performs. To support this you can set the environment variable -Dsolr.auth.jwt.allowOutboundHttp=true at startup.

Multiple Authentication Schemes

Solr provides the MultiAuthPlugin to support multiple authentication schemes based on the Authorization header. This allows you to configure Solr to delegate user management and authentication to an OIDC provider using the JWTAuthPlugin, but also allow a small set of service accounts to use Basic authentication when using OIDC is not supported or practical.

Set a Configuration Property

Set properties for the authentication plugin. Each of the configuration keys in the table above can be used as parameter keys for the set-property command.

Example:

curl http://localhost:8983/solr/admin/authentication -H 'Content-type:application/json' -H 'Authorization: Bearer xxx.yyy.zzz' -d '{"set-property": {"blockUnknown":true, "wellKnownUrl": "https://example.com/.well-knwon/openid-configuration", "scope": "solr:read solr:write"}}'

curl http://localhost:8983/api/cluster/security/authentication -H 'Content-type:application/json' -H 'Authorization: Bearer xxx.yyy.zzz' -d -d '{"set-property": {"blockUnknown":true, "wellKnownUrl": "https://example.com/.well-knwon/openid-configuration", "scope": "solr:read solr:write"}}'

Insert a valid JWT access token in compact serialization format (xxx.yyy.zzz above) to authenticate with Solr once the plugin is active, or leave blockUnknown=false until configuration is complete and then switch it to true to start enforcing.

SolrJ

SolrJ does not currently support supplying JWT tokens per request.

cURL

To authenticate with Solr when using the cURL utility, supply a valid JWT access token in an Authorization header, as follows (replace xxxxxx.xxxxxx.xxxxxx with your JWT compact token):

curl -H "Authorization: Bearer xxxxxx.xxxxxx.xxxxxx" http://localhost:8983/solr/admin/info/system

Admin UI

When this plugin is enabled, users will be redirected to a login page in the Admin UI once they attempt to do a restricted action. The page has a button that users will click and be redirected to the Identity Provider’s login page. If more than one issuer (IdP) is configured, the first in the list will be used for Admin UI. Once authenticated, the user will be redirected back to Solr Admin UI to the last known location. The session will last as long as the JWT token expiry time and is valid for one Solr server only. That means you have to login again when navigating to another Solr node. There is also a logout menu in the left column where user can explicitly log out.