Apache Solr database plugin HTTP API

The Apache Solr database plugin is one of the supported plugins for the database secrets engine. This plugin generates database credentials dynamically based on configured roles against a Solr cluster's Security Plugin API.

Configure connection

In addition to the parameters defined by the Database Secrets Engine, this plugin has a number of parameters to further configure a connection.

Method	Path
POST	/database/config/:name

Parameters

• url (string: <required>) – Specifies the Solr base URL, e.g. http://solr.example.com:8983. All Security Plugin API requests are issued relative to this URL.

• username (string: <required>) – Specifies the root credential username OpenBao uses to authenticate to the Security Plugin API and issue/revoke dynamic users.

• password (string: <required>) – Specifies the root credential password corresponding to username.

• ca_cert (string: "") – Specifies a PEM-encoded CA certificate (or bundle) to use when validating the Solr server's TLS certificate.

• ca_path (string: "") – Specifies a filesystem path to a PEM-encoded CA certificate (or bundle) to use when validating the Solr server's TLS certificate.

• client_cert (string: "") – Specifies a PEM-encoded client certificate to present for mTLS. Must be set together with client_key.

• client_key (string: "") – Specifies the PEM-encoded private key corresponding to client_cert. Must be set together with client_cert.

• insecure (bool: false) – Skips TLS certificate verification when connecting to Solr. Intended for development only.

• username_template (string) - Template describing how dynamic usernames are generated.

Default Username Template

{{ printf "v-%s-%s-%s-%s" (.DisplayName | truncate 15) (.RoleName | truncate 15) (random 20) (unix_time) | replace "." "-" | truncate 100 }}

Example Usernames:

Example
DisplayName	token
RoleName	myrolename
Username	v-token-myrolename-uszt1n4cyhal4-1614294836

Sample payload

{
  "plugin_name": "solr-database-plugin",
  "allowed_roles": "reader",
  "url": "http://solr.example.com:8983",
  "username": "solr",
  "password": "SolrRocks"
}

Sample request

$ curl \
    --header "X-Vault-Token: ..." \
    --request POST \
    --data @payload.json \
    http://127.0.0.1:8200/v1/database/config/solr

Statements

Unlike SQL-style database plugins, this plugin does not use semicolon-separated statement lists. creation_statements is a single JSON document listing pre-existing Solr role names to bind to the new user. For more information on configuring roles see the Role API in the database secrets engine docs.

The following are the statements used by this plugin. If not mentioned in this list the plugin does not support that statement type.

• creation_statements (string: <required>) – Specifies a single JSON document listing the Solr roles to bind to the new user:

  { "roles": ["admin", "reader"] }

  roles is an array of bare role name strings that must already exist in the cluster's Rule-Based Authorization Plugin configuration; this plugin does not create roles. On the wire the plugin posts {"set-user": {"<name>": "<password>"}} to admin/authentication, then — if roles is non-empty — {"set-user-role": {"<name>": [...roles]}} to admin/authorization. If the role-binding request fails, the plugin posts {"delete-user": ["<name>"]} to admin/authentication before returning the error, so no half-configured user is left behind. There is no built-in default; a role without creation_statements, or with an empty creation_statements, fails to issue credentials.

revocation_statements, rollback_statements, and root_rotation_statements are accepted by the database secrets engine framework but are not used by this plugin. Revocation always posts {"delete-user": ["<name>"]} to admin/authentication, which Solr answers with a 200 even when the user does not exist, making the operation idempotent. Password rotation for static roles always posts {"set-user": {"<name>": "<new-password>"}} to admin/authentication.

Static roles

Static roles rotate the password of an existing Solr user on a schedule, via set-user:

$ bao write database/static-roles/svc \
    db_name=solr \
    username=svc \
    rotation_period=24h