question How to limit user access to Solr indexes? in Archives of Support Questions (Read Only)

How to limit user access to Solr indexes?

jpayne1 — Tue, 21 Apr 2026 13:46:51 GMT

I'm interested in being able to prohibit users from interacting with, or even being aware of the existence of, specific indexes in Solr. For example, when a user in HUE looks at available indexes in HUE, they can only see the indexes they have permission to interact with.

Is this possible with the Cloudera distribution? I'm running CDH 5.10.

Thanks!!

Re: How to limit user access to Solr indexes?

saranvisa — Wed, 19 Apr 2017 13:56:31 GMT

@jpayne1

You can achieve this with Apache Sentry

https://www.cloudera.com/documentation/enterprise/5-9-x/topics/sg_sentry_overview.html

Re: How to limit user access to Solr indexes?

jpayne1 — Thu, 20 Apr 2017 20:05:20 GMT

Can this be done at the collections/parent level in HUE/Sentry so that any time a user creates an index in Solr only the user who created it has access?

In other words, what I'm trying to avoid having to do is setting permissions each time an index is created by a user. So if a user creates an index, Sentry automatically adds/updates the appropriate permissions.

I don't see any explicit reference to this capability in the docs.

Re: How to limit user access to Solr indexes?

pdvorak — Thu, 20 Apr 2017 22:01:56 GMT

There isn't any current functionality to handle this. Part of the issue is, for a newly created collection, what is considered 'appropriate' permissions? Someone normally needs to determine what those are for that new specific collection

-pd

Re: How to limit user access to Solr indexes?

jpayne1 — Fri, 21 Apr 2017 13:13:00 GMT

That is a fair question of what is 'appropriate'. I was hoping there would be an option to select a default behavior to do so. For example, upon 'usr1' creating an index, the following permission would be generated:

collection='the_new_idx"->user=usr1->action=*

I imagine other global default behaviors could exist such that the auto-generated permission sets access for new collections at a role level instead of user level.