Securing Solr | Apache Solr Reference Guide 8.4

No Solr API, including the Admin UI, is designed to be exposed to non-trusted parties. Tune your firewall so that only trusted computers and people are allowed access. Because of this, the project will not regard e.g., Admin UI XSS issues as security vulnerabilities. However, we still ask you to report such issues in JIRA.

When planning how to secure Solr, you should consider which of the available features or approaches are right for you:

Encryption with TLS (SSL) Certificates

Ecrypting traffic to/from Solr and between Solr nodes prevents sensitive data to be leaked out on the network. TLS is also normally a requirement to prevent credential sniffing when using Authentication.

See the page Enabling TLS (SSL) for details.

Authentication, Authorization and Audit Logging

See chapter Configuring Authentication, Authorization and Audit Logging plugins to learn how to work with the security.json file.

Authentication Plugins

Authentication makes sure you know the identity of your users. The authentication plugins shipping with Solr are:

Authorization Plugins

Authorization makes sure that only users with the necessary roles/permissions can access any given resource. The authorization plugins shipping with Solr are:

Rule-Based Authorization Plugin

Audit Logging Plugins

Audit logging will record an audit trail of incoming reqests to your cluster, such as users being denied access to admin APIs. Learn more about audit logging and how to implement an audit logger plugin here in the Audit Logging chapter.

Securing ZooKeeper Traffic

ZooKeeper is a central and important part of a SolrCloud cluster and understanding how to secure its content is covered in the ZooKeeper Access Control page.