SOLR-18215 JWT auth module now defaults to blockUnknown=true#4373
Open
janhoy wants to merge 5 commits intoapache:mainfrom
Open
SOLR-18215 JWT auth module now defaults to blockUnknown=true#4373janhoy wants to merge 5 commits intoapache:mainfrom
janhoy wants to merge 5 commits intoapache:mainfrom
Conversation
The ref-guide documented true as the default, but the code defaulted to false, allowing unauthenticated pass-through. Align the implementation with the documented security behavior. Fix the one unit test (wellKnownConfigNoHeaderPassThrough) that implicitly relied on the old false default by making its blockUnknown=false explicit. Add a note under Solr 10.1 in major-changes-in-solr-10.adoc so upgraders from 10.0 know to set blockUnknown: false if they need pass-through.
github-actions
Bot
added
documentation
Contributor
There was a problem hiding this comment.
Pull request overview
Updates Solr’s JWT Authentication plugin to use a more secure default behavior by blocking requests that don’t include a valid JWT, and aligns UI/docs/tests/changelog with this change.
Changes:
- Change JWTAuthPlugin
blockUnknowndefault fromfalse(pass-through) totrue(block by default). - Update Admin UI controller logic to treat missing
blockUnknownastrue. - Update one JWT auth test and add upgrade note + changelog entry documenting upgrade impact.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| solr/webapp/web/js/angular/controllers/security.js | Adjusts Admin UI default and fallback logic for blockUnknown. |
| solr/solr-ref-guide/modules/upgrade-notes/pages/major-changes-in-solr-10.adoc | Documents the default behavior change and upgrade impact. |
| solr/modules/jwt-auth/src/test/org/apache/solr/security/jwt/JWTAuthPluginTest.java | Makes pass-through behavior explicit in the one test that relied on the old implicit default. |
| solr/modules/jwt-auth/src/java/org/apache/solr/security/jwt/JWTAuthPlugin.java | Changes plugin default to block unauthenticated requests by default. |
| changelog/unreleased/SOLR-18215-jwt-auth-blockUnknown-default-true.yml | Adds an unreleased changelog entry for the behavior change. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
…in-solr-10.adoc Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
https://issues.apache.org/jira/browse/SOLR-18215
Changes the default value of the
blockUnknownsetting in the JWT Authentication plugin fromfalsetotrue.A documentation bug introduced in v9.0 caused the reference guide to state
trueas the default, while the code has always defaulted tofalse(pass-through). Rather than reverting the docs as first proposed in #4337, this PR modifies the default totruewhich we planned to do at some point anyway, as this is the more secure and least surprising default.Changes
JWTAuthPlugin.java— default forblockUnknownchanged fromfalsetotruesecurity.js(Admin UI) — initial display state and the fallback whenblockUnknownis absent fromsecurity.jsonboth corrected to default totrue, so the checkbox reflects the actual plugin behaviorJWTAuthPluginTest.java—wellKnownConfigNoHeaderPassThroughtest now setsblockUnknown: falseexplicitly (it was the only test relying on the implicitfalsedefault)major-changes-in-solr-10.adoc— added a note under the Solr 10.1 section documenting the behavior change and the documentation error in 10.0Upgrade impact
Users who configured JWT auth in Solr 10.0 without explicitly setting
blockUnknownand relied on unauthenticated requests passing through must add"blockUnknown": falseto theirsecurity.jsonafter upgrading.Note:
solr auth enabledoes not yet support JWT, so there is no CLI impact.