Эх сурвалжийг харах

[libsolr] Add a config flag for setting CA authority checking

Romain Rigaux 10 жил өмнө
parent
commit
aab72a8

+ 10 - 0
desktop/conf.dist/hue.ini

@@ -945,6 +945,16 @@
   ## latest=false
 
 
+###########################################################################
+# Settings to configure Solr API lib
+###########################################################################
+
+[libsolr]
+
+  # Choose whether Hue should validate certificates received from the server.
+  ## ssl_cert_ca_verify=true
+
+
 ###########################################################################
 # Settings to configure Solr Indexer
 ###########################################################################

+ 10 - 0
desktop/conf/pseudo-distributed.ini.tmpl

@@ -949,6 +949,16 @@
   ## latest=false
 
 
+###########################################################################
+# Settings to configure Solr API lib
+###########################################################################
+
+[libsolr]
+
+  # Choose whether Hue should validate certificates received from the server.
+  ## ssl_cert_ca_verify=true
+
+
 ###########################################################################
 # Settings to configure Solr Indexer
 ###########################################################################

+ 5 - 4
desktop/libs/hadoop/src/hadoop/conf.py

@@ -15,16 +15,17 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-from django.utils.translation import ugettext_lazy as _t
-from desktop.lib.conf import Config, UnspecifiedConfigSection, ConfigSection, coerce_bool
-from desktop.conf import default_ssl_validate
 import fnmatch
 import logging
 import os
 
-DEFAULT_NN_HTTP_PORT = 50070
+from django.utils.translation import ugettext_lazy as _t
+from desktop.lib.conf import Config, UnspecifiedConfigSection, ConfigSection, coerce_bool
+from desktop.conf import default_ssl_validate
 
 LOG = logging.getLogger(__name__)
+DEFAULT_NN_HTTP_PORT = 50070
+
 
 def find_file_recursive(desired_glob, root):
   def f():

+ 6 - 2
desktop/libs/libsolr/src/libsolr/api.py

@@ -18,6 +18,7 @@
 
 import json
 import logging
+import re
 import urllib
 
 from itertools import groupby
@@ -31,7 +32,8 @@ from desktop.lib.rest import resource
 
 from search.conf import EMPTY_QUERY, SECURITY_ENABLED
 from search.api import _compute_range_facet
-import re
+
+from libsolr.conf import SSL_CERT_CA_VERIFY
 
 
 LOG = logging.getLogger(__name__)
@@ -47,7 +49,7 @@ class SolrApi(object):
   """
   http://wiki.apache.org/solr/CoreAdmin#CoreAdminHandler
   """
-  def __init__(self, solr_url, user, security_enabled=SECURITY_ENABLED.get()):
+  def __init__(self, solr_url, user, security_enabled=SECURITY_ENABLED.get(), ssl_cert_ca_verify=SSL_CERT_CA_VERIFY.get()):
     self._url = solr_url
     self._user = user
     self._client = HttpClient(self._url, logger=LOG)
@@ -56,6 +58,8 @@ class SolrApi(object):
     if self.security_enabled:
       self._client.set_kerberos_auth()
 
+    self._client.set_verify(ssl_cert_ca_verify)
+
     self._root = resource.Resource(self._client)
 
     # The Kerberos handshake requires two requests in order to authenticate,

+ 13 - 0
desktop/libs/libsolr/src/libsolr/conf.py

@@ -14,3 +14,16 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
+
+from django.utils.translation import ugettext_lazy as _t
+
+from desktop.lib.conf import Config, coerce_bool
+from desktop.conf import default_ssl_validate
+
+
+SSL_CERT_CA_VERIFY = Config(
+  key="ssl_cert_ca_verify",
+  help=_t("In secure mode (HTTPS), if Solr SSL certificates have to be verified against certificate authority"),
+  dynamic_default=default_ssl_validate,
+  type=coerce_bool
+)