1

I am running solr and I wanted to restrict access to the admin panel since the url is localhost:8983/solr/#/core_1 and localhost:8983/solr/#/core_2

You see it has a # symbol where its the admin page and when you just want to do a normal search, you go to localhost:8983/solr/core_1browse?q=asdf There is no hash in here so i can omit it

In my webdefault.xml the line url-pattern works but it blocks people from using the web app alltogether, since * means any character. I have tried the following in place of the /* all of which did nothing, and yes I restarted the jetty server each time I tried these out.

Tried : /solr Tried : /#/ Tried : # Tried : s

<security-constraint>
<web-resource-collection>
  <web-resource-name>Solr authenticated application</web-resource-name>
  <url-pattern>/*</url-pattern>
</web-resource-collection>
<auth-constraint>
  <role-name>admin-solr3</role-name>
</auth-constraint>


<login-config>
<auth-method>BASIC</auth-method>
<realm-name>Test Realm</realm-name>
</login-config>
Henrey Bellchester
  • 153
  • 1
  • 10

1 Answers1

1

The "#" symbol in your URL cannot be used as a url-pattern.

The use of "#" in a URL indicates a URL fragment/anchor and as such, that part of the request URL is not sent to the server by web browsers (custom HTTP client libraries on the other hand can send the fragment/anchor portion)

Joakim Erdfelt
  • 46,896
  • 7
  • 86
  • 136
  • I got this working by making the root be passworded then I whitelisted the suburls. But I have an issue still, I can do /collection1/* but When i want to only allow them to use the browse feature I can't do the following /collection1/brow* – Henrey Bellchester Aug 20 '12 at 23:35
  • That's correct. The servlet spec indicates that a url-pattern string is not a regex, but rather a set of rules as outlined by SRV.11.2 in the servlet spec. See old answer on this here http://stackoverflow.com/questions/26732/invalid-url-pattern-servlet-mapping-in-tomcat-6-0 – Joakim Erdfelt Aug 20 '12 at 23:42