Skip to content
English
Manage and Create Tickets
  • There are no suggestions because the search field is empty.

FileCloud Search Not Working After Enabling Solr Basic Authentication

Original Question or Issue:

This article describes how to configure Solr Basic Authentication, synchronize the credentials with FileCloud, and restrict access to Solr port 8983. If FileCloud cannot authenticate with Solr, search functionality may stop working.

Solr should not be exposed to the network without authentication and firewall restrictions.

Environment:

  • Product - FileCloud Server
  • Version - 23.253.3
  • Platform - Windows and Linux

Steps to Reproduce:

  • Enable Basic Authentication in Solr by configuring security.json.
  • Configure FileCloud to use the same Solr credentials.
  • Attempt to perform a search operation in FileCloud.
  • If the credentials do not match, search requests may fail. The Solr Admin UI may still be accessible with the configured credentials.

Error or Log Message:

 Search functionality may return no results when FileCloud cannot authenticate with Solr. 

Defect or Enhancement Number:

Cause:

 The Solr authentication credentials configured in FileCloud did not match the credentials configured in Solr. This can occur after enabling Basic Authentication or changing the Solr password without updating the corresponding FileCloud configuration. 

Resolution or Workaround:

1. Generate a unique Solr password and hash

Generate a unique password and keep it secure. You will use the same password in Solr and FileCloud configuration files.

Linux

  1. Generate a random password and save it for later use: 
    SOLR_PW=$(openssl rand -hex 20) echo "$SOLR_PW"
  2. Generate the hash for security.json: 
    openssl rand 32 > /tmp/solr_salt echo "$({ cat /tmp/solr_salt; printf '%s' "$SOLR_PW"; } | openssl dgst -sha256 -binary | openssl dgst -sha256 -binary | openssl base64 -A) $(openssl base64 -A -in /tmp/solr_salt)" rm /tmp/solr_salt

Windows (PowerShell)

  1. Generate a random password and save it for later use: 
    $rng = [Security.Cryptography.RandomNumberGenerator]::Create() $b = New-Object byte[] 20 $rng.GetBytes($b) $pw = -join ($b | ForEach-Object { $_.ToString('x2') }) $pw
  2. Generate the hash for security.json: 
    $salt = New-Object byte[] 32 $rng.GetBytes($salt) $sha = [Security.Cryptography.SHA256]::Create() $hash = $sha.ComputeHash($sha.ComputeHash([byte[]]($salt + [Text.Encoding]::UTF8.GetBytes($pw)))) [Convert]::ToBase64String($hash) + ' ' + [Convert]::ToBase64String($salt)

The second step prints one line containing two strings separated by a space. Use the entire line as the value for the solr user in the credentials section of security.json.

2. Configure security.json

Create or update security.json with the generated hash and salt. Do not use a shared or default password.

Use the same password generated in Step 1 wherever the configuration requires the Solr password.

3. Update FileCloud and Solr configuration

Update the Solr credentials in FileCloud configuration files, including cloudconfig.php, and configure the required Solr authentication parameters.

Linux — solr.in.sh:

SOLR_AUTH_TYPE="basic" SOLR_AUTHENTICATION_OPTS="-Dbasicauth=solr:<password-you-generated>"

Windows — solr.in.cmd:

set SOLR_AUTH_TYPE=basic set SOLR_AUTHENTICATION_OPTS=-Dbasicauth=solr:<password-you-generated>

Replace <password-you-generated> with the password generated in Step 1. Use that same password in cloudconfig.php.

Restart the applicable Solr and FileCloud services after updating the configuration. Apply the configuration consistently across all FileCloud web nodes and environments, including UAT and Production.

4. Configure SOLR_JETTY_HOST only for a separate Solr server

By default, Solr listens on 127.0.0.1, which allows connections only from the machine running Solr. This is appropriate for a single-server installation; administrators in that setup do not need to change this setting.

Change SOLR_JETTY_HOST only when Solr runs on a separate server and FileCloud web servers must connect to it over the network. Only perform this configuration together with the firewall and authentication steps in this article.

The IP address below is an example. Replace 10.0.0.5 with the Solr server’s private IP address.

Linux:

  1. Edit /etc/default/solr.in.sh and add or uncomment: 
    SOLR_JETTY_HOST="10.0.0.5"
  2. Restart Solr: 
    sudo systemctl restart solr

Windows:

  1. Edit C:\xampp\solr\bin\solr.in.cmd and add: 
    set SOLR_JETTY_HOST=10.0.0.5
  2. Restart Solr from the FileCloud Control Panel or Windows Services.
  3. In the FileCloud Admin Portal, configure the Solr URL on the web servers as: 
    http://10.0.0.5:8983/solr

5. Restrict access to port 8983

Allow TCP port 8983 only from the FileCloud web servers. Block access from all other sources.

The following examples use web server IP addresses 10.0.0.11 and 10.0.0.12. Replace them with the actual private IP addresses of your FileCloud web servers.

Ubuntu (ufw):

sudo ufw allow from 10.0.0.11 to any port 8983 proto tcp sudo ufw allow from 10.0.0.12 to any port 8983 proto tcp sudo ufw deny 8983/tcp

If UFW is not enabled, allow SSH before enabling it to avoid locking yourself out:

sudo ufw allow OpenSSH sudo ufw enable

RHEL / Rocky / Alma (firewalld):

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.11" port port="8983" protocol="tcp" accept' sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.12" port port="8983" protocol="tcp" accept' sudo firewall-cmd --reload

Windows (PowerShell as Administrator):

New-NetFirewallRule -DisplayName "Solr - FileCloud web nodes only" -Direction Inbound -Protocol TCP -LocalPort 8983 -RemoteAddress 10.0.0.11,10.0.0.12 -Action Allow

Windows blocks inbound connections by default. Confirm that no other broader firewall rule allows access to port 8983.

For cloud-hosted environments, such as AWS or Azure, apply the same restriction using the applicable security group or network security group.

6. Rotate previously configured default credentials

Anyone who previously configured Solr authentication using SolrRocks should rotate the password now. Generate a new password and hash using Step 1, then update security.json and the corresponding FileCloud and Solr configuration files.

7. Validate the configuration

    1. Confirm that FileCloud can authenticate with Solr.
    2. Test search functionality and confirm that search results are returned.
    3. Apply and validate the same configuration in all applicable environments, including UAT and Production.

Notes:

  • Use only the password generated in Step 1; do not use a default or shared password.
  • Keep the generated password secure.
  • Do not expose Solr port 8983 to the network without the authentication and firewall restrictions described above.