Apache SolrCloud Kerberos Configuration

I’ve been working on securing Apache SolrCloud with kerberos. This includes configuring Zookeeper. So after struggling and lots of searching I came up with a working kerberized solution for SolrCloud, with Zookeeper, and Apache Ranger for Authorization. First I tried to secure a standalone Solr instance by updating to the Solr 6x branch which is a SNAPSHOT specifically for this JIRA https://issues.apache.org/jira/browse/SOLR-9481. But this JIRA does not work Apache Ranger Solr Plugin as the Apache Ranger Solr Plugin only works with Collections and not Cores. So this automatically pushed me over to SolrCloud specifically sin I wanted to use the Apache Ranger Solr Plugin.

• Utilize the setup_solr.sh from my github.com/solr_config_scripts. This is a custom script to setup SolrCloud after installation it sets permissions and copies configuration files into place. This script also install libxml2 for xmllint package if it’s not installed as xmllint is used by create_collection.sh and zkcli.sh to grab some additional configuration parameters to simplify life.
• Create solr@EXAMPLE.COM kerberos principals in the local KDC being used for your Hadoop cluster.
  • [root@solrhost1 solr]# kinit gsenia/admin Password for gsenia/admin@EXAMPLE.COM:
  • [root@solrhost1 solr_server]# kadmin
  • Authenticating as principal gsenia/admin@EXAMPLE.COM with password.
  • Password for gsenia/admin@EXAMPLE.COM:
  • kadmin: addprinc -randkey solr@EXAMPLE.COM
  • WARNING: no policy specified for solr@EXAMPLE.COM; defaulting to no policy Principal “solr@EXMAPLE.COM”
  • created.
  • kadmin: xst -k /etc/security/keytabs/solr.headless.keytab solr@EXAMPLE.COM
  • Entry for principal solr@EXAMPLE.COM with kvno 2, encryption type aes256-cts-hmac-sha1-96 added to keytab
  • WRFILE:/etc/security/keytabs/solr.headless.keytab
  • Entry for principal solr@EXAMPLE.COM with kvno 2, encryption type aes128-cts-hmac-sha1-96 added to keytab WRFILE:/etc/security/keytabs/solr.headless.keytab
  • Entry for principal solr@EXAMPLE.COM with kvno 2, encryption type arcfour-hmac added to keytab WRFILE:/etc/security/keytabs/solr.headless.keytab
  • kadmin: quit
  • [root@solrhost1 solr]# chown -R 400 /etc/security/keytabs/solr.headless.keytab
  • [root@solrhost1 solr_server]# chown -R solr:hadoop /etc/security/keytabs/solr.headless.keytab
  • [root@solrhost1 solr]# chmod -R 400 /etc/security/keytabs/solr.headless.keytab