Description
Solr needs a well defined plugin point to implement audit logging functionality, which is independent from whatever AuthenticationPlugin or AuthorizationPlugin are in use at the time.
It seems reasonable to introduce a new plugin type AuditLoggerPlugin. It could be configured in solr.xml or it could be a third type of plugin defined in security.json, i.e.
{
"authentication" : { "class" : ... },
"authorization" : { "class" : ... },
"auditlogging" : { "class" : "x.y.MyAuditLogger", ... }
}
We could then instrument SolrDispatchFilter to the audit plugin with an AuditEvent at important points such as successful authentication:
auditLoggerPlugin.audit(new SolrAuditEvent(EventType.AUTHENTICATED, request));
We will mark the impl as @lucene.experimental in the first release to let it settle as people write their own plugin implementations.
Attachments
Issue Links
- causes
-
SOLR-13465 CoreContainer.auditloggerPlugin should be volatile
-
- Closed
-
- is related to
-
SENTRY-1475 Integrate Sentry with Solr 7 authorization framework
-
- Resolved
-
-
SOLR-11781 Pass impersonator info to the authorization plugin
-
- Open
-
- is required by
-
-
- Closed
-
- relates to
-
-
- Closed
-
- links to
