Can't get authorization plugin to work with Solr JWTAuthPlugin - solr

Question

I have secured Solr (8.7.0) using JWTAuthTPlugin so I can use AAD from auth. I want to whitelist healthcheck metrics. I get 401 on all whitelisted request. I can login on Solr Admin using AAD
here's my security.json
{
"authentication": {
"class": "solr.JWTAuthPlugin",
"blockUnknown": false,
"wellKnownUrl": "https://login.microsoftonline.com/myTenant/v2.0/.well-known/openid-configuration",
"clientId": "myClientId",
"adminUiScope": "openid api://myAPIid/solr"
},
"authorization":{
"class":"solr.RuleBasedAuthorizationPlugin",
"permissions":[ {
"collection": null,
"name": "healthcheckv2",
"path": "/api/node/health",
"role": null
}, {
"collection": null,
"name": "healthcheckv1",
"path": "/solr/admin/info/health",
"role": null
}, {
"collection": null,
"name": "infosystem",
"path": "/solr/admin/info/system",
"role": null
}, {
"collection": null,
"name": "metrics",
"path": "/admin/metrics",
"role": null
}, {
"name": "security-edit",
"role": "admin"
}, {
"name": "collection-admin-edit",
"role": "admin"
}, {
"name": "core-admin-edit",
"role": "admin"
}, {
"name": "all",
"role": "*"
}],
"user-role": {
"solr": "admin"
}
}
}
What I'm missing?
Thanks!

Answer 1

After debugging Solr, seems that a RuleContainer rewrote the path to health check :
2021-06-14 18:19:52.941 DEBUG (qtp1581267786-21) [ ] o.e.j.r.h.RuleContainer rewrote /api/node/health to /solr/____v2/node/health
so we need to adjust the permission accordingly:
{
"collection": null,
"name": "healthcheckv2Rewrite",
"path": "/____v2/node/health",
"role": null
}