How can I use Kerberos to secure the Solr Admin panel on a standalone (non- Solr-Cloud) configuration? I've tried using https://cwiki.apache.org/confluence/display/solr/Kerberos+Authentication+Plugin but I don't understand how to set up authentication without Zookeeper/security.json.
As specified in the same wiki page you link to, you can specify you want to use the Kerberos Plugin as a Java System Property on node start up.
For example, in your solr.in.sh, you can add SOLR_AUTHENTICATION_OPTS="-DauthenticationPlugin=org.apache.solr.security.KerberosPlugin". You'll need a JAAS config file as well as some additional properties as well, you can see these specified in the "Define a JAAS Configuration File" and "Solr Startup Parameters" sections on the same page.
Note: The solr.kerberos.principal you specify must be the SPNEGO SPN (i.e. HTTP/solr.example.com#EXAMPLE.COM) for the full qualified domain name of the host the Solr node is located on.
This is likely different to the service principal you use for the internode communication that you register in your JAAS config file (something like solr/solr.example.com#EXAMPLE.COM).
I want to use SSL on the non-default version of my GAE app. For the normal https://my-app.appspot.com I know I don't have to do a thing. However I have another version, which would be under https://v2.my-app.appspot.com and there SSL doesn't work. It gives following error in the browser:
Your connection is not private
Attackers might be trying to steal your
information from dev.replimeapp.appspot.com (for example, passwords,
messages, or credit cards). NET::ERR_CERT_COMMON_NAME_INVALID
Use following address instead: https://v2-dot-my-app.appspot.com/
Google does not issue SSL certificates for double-wildcard domains hosted at appspot.com. Therefore with HTTPS you must use the string "-dot-" instead of "." to separate subdomains, as shown in the examples below. You can use a simple "." with your own custom domain or with HTTP addresses.
From there: https://cloud.google.com/appengine/docs/java/config/webxml#Secure_URLs
I want to use SSL on the non-default version of my GAE app. For the normal https://my-app.appspot.com I know I don't have to do a thing. However I have another version, which would be under https://v2.my-app.appspot.com and there SSL doesn't work. It gives following error in the browser:
Your connection is not private
Attackers might be trying to steal your
information from dev.replimeapp.appspot.com (for example, passwords,
messages, or credit cards). NET::ERR_CERT_COMMON_NAME_INVALID
Use following address instead: https://v2-dot-my-app.appspot.com/
Google does not issue SSL certificates for double-wildcard domains hosted at appspot.com. Therefore with HTTPS you must use the string "-dot-" instead of "." to separate subdomains, as shown in the examples below. You can use a simple "." with your own custom domain or with HTTP addresses.
From there: https://cloud.google.com/appengine/docs/java/config/webxml#Secure_URLs
We've got a website:
www.feeltracker.com
This is running on Google App Engine
On Google App Engine, we have Naked Domain forwarding setup, so that:
http://feeltracker.com
redirects to
http://www.feeltracker.com
However, when we try to open the following address in Chrome:
https://feeltracker.com (notice the HTTPS)
We get a Google error page with the following message:
Google
404. That’s an error.
The requested URL / was not found on this server. That’s all we know.
Does anyone know how we can ensure https://feeltracker.com redirects to www.feeltracker.com?
Note that in Firefox we get the following additional information when trying to open https://feeltracker.com:
feeltracker.com uses an invalid security certificate.
The certificate is only valid for the following names:
*.google.com , *.android.com , *.appengine.google.com , *.cloud.google.com , *.google-analytics.com , *.google.ca , *.google.cl , *.google.co.in , *.google.co.jp , *.google.co.uk , *.google.com.ar , *.google.com.au , *.google.com.br , *.google.com.co , *.google.com.mx , *.google.com.tr , *.google.com.vn , *.google.de , *.google.es , *.google.fr , *.google.hu , *.google.it , *.google.nl , *.google.pl , *.google.pt , *.googleapis.cn , *.googlecommerce.com , *.gstatic.com , *.urchin.com , *.url.google.com , *.youtube-nocookie.com , *.youtube.com , *.youtubeeducation.com , *.ytimg.com , android.com , g.co , goo.gl , google-analytics.com , google.com , googlecommerce.com , urchin.com , youtu.be , youtube.com , youtubeeducation.com
(Error code: ssl_error_bad_cert_domain)
Note that we are using the SNI SSL certificate capability on Google App Engine with our uploaded certificate.
When we run SSL diagnostics via http://www.digicert.com/help/ we get the following:
Certificate does not match name feeltracker.com
Subject *.google.com
Valid from 02/Jul/2013 to 31/Oct/2013
Issuer Google Internet Authority
Subject Google Internet Authority
Valid from 12/Dec/2012 to 31/Dec/2013
Issuer Equifax
Any ideas why https://feeltracker.com fails to use the correct certificate, whereas www.feeltracker.com and http://www.feeltracker.com work as expected with our SSL certificate?
Update 16 Sept 2015
It appears this may now work as per Forum post and Issue 10802
Previously applicable info below...
Currently it's not supported. The naked domain redirect is a workaround only for http and you'll probably notice that specific IP addresses you need to be put in your DNS for that differ from the approach and IP addresses for ghs.googlehosted.com.
This seems to indicate that it's different parts of Google's infrastructure and they haven't yet managed to make them consistent or work together. I haven't seen any details on when they will resolve this so it might be a long wait. e.g. Related post from 2009
There is an "acknowledged" issue for Naked domain support so when that's fixed then likely this issue also resolved.
As Google is not going to correctly serve your certificate on their naked domain redirector then for now there are these options that I see:
Make/provide your own reverse proxy (Apache httpd, varnish etc) or use a reverse proxy service (eg. CloudFlare) and point your naked domain there. You'd install your SSL on the reverse proxy, clients would connect there for your naked domain (no certificate errors) and you'd proxy all traffic to your real site. It might create a single point of failure and costs depending what you use.
Rent a cheap VPS where you install a web server, your cert and a redirect script to https://www.feeltracker.com. In DNS map your naked domain to that server. It can be a really cheap linux server as requirements just to redirect are very low.
Find a domain redirect service that supports https and allows you to upload your certificate. Sadly I'm not aware of any.
Use VIP (Virtual IP) SSL and configure it in DNS for your naked domain. I haven't tested myself but it seems it should work, although I did find a old comment here that it may not. Has someone tested? NOTE however as far as I could see the DNS entry has a TTL of just 300 (5mins) and Google doesn't advise it, so even if it did work you might need some scripts to update your DNS entries as there's a strong chance it changes from time to time. If it does work then DNS providers like DNSSimple have an API so it would be possible.
Probably the second option is most applicable in your case as you don't seem to mind about the naked domain (which for many is an issue).
I recently found a good example: https://khanacademy.org/ They appear to use an Amazon EC2 host as per the second option above.
https://khanacademy.org/ Resolving khanacademy.org... 107.20.223.238
Connecting to khanacademy.org|107.20.223.238|:443... connected.
WARNING: cannot verify khanacademy.org’s certificate, issued by “/C=US/ST=Arizona/L=Scottsdale/O=GoDaddy.com, Inc./OU=http://certificates.godaddy.com/repository/CN=Go Daddy Secure Certification Authority/serialNumber=07969287”: Unable to locally verify the issuer’s authority. WARNING: certificate common name “*.khanacademy.org” doesn’t match requested host name “khanacademy.org”.
HTTP request sent, awaiting response... 301 Moved
Permanently Location: https://www.khanacademy.org/ [following]
https://www.khanacademy.org/ Resolving www.khanacademy.org...
72.14.249.132 Connecting to www.khanacademy.org|72.14.249.132|:443... connected.
whois 107.20.223.238
OrgName: Amazon.com, Inc.
OrgId: AMAZO-4
Address: Amazon Web Services, Elastic Compute Cloud, EC2
As of 12 April 2014 it looks like Google makes some progress and now allows mapping of non Google Apps domains (seeissue 8517), although SSL appears not to work for that method yet (see issue 10794 for tracking that).
Best free SSL redirect service I found was CloudFlare. To get it working:
Add your domain and switch your name servers to CloudFlare (signup process walks you through it)
Once added goto CloudFlare Settings and down to SSL. Change the setting to 'Full SSL (Strict)' this requires you to have a valid cert on the subdomain your redirecting to (SNI works fine).
Go back to your websites list, select the domain again and on the options goto page rules. Add a 'Forwarding' rule that redirects https://yourdomain.com/* to https://www.yourdomain.com/$1 (replace www with any subdomain), make sure the redirect is set to 301.
Save your settings and sit back and wait for everything to propagate.
Done. Free and secure SSL redirection for your naked domain.
I had to switch my domain management and nameservers from GoDaddy(G-Suite) to Cloudflare to solve this naked domain redirect issue. I followed Parkers instructions and used the free Cloudflare account and it worked after I turned the redirect rule off and then back on. I switch back from Full(strict) to Full because you now need to pay to upload your own SSL certificate. I am ok with the shared universal SSL certificate from Cloudflare for the time being.
GAE doesn't officially support naked domains. What you're seeing is a limitation of GAE, you're not doing anything wrong. https://developers.google.com/appengine/kb/general#naked_domain
Apparently naked domain redirect on HTTPS is not supported. There is no mentioning of this in official docs. If you look at support docs you see in screenshots that naked redirect specifically states http://.
Judging from Google Groups threads, SSL naked domain redirect is not possible: here, here.
I'm trying to use the "Copy to another app" feature of AppEngine and keep getting an error:
Fetch to http://datastore-admin.moo.appspot.com/_ah/remote_api failed with status 302
This is for a Java app but I followed the instructions on setting up a default Python runtime.
I'm 95% sure it's an authentication issue and the call to remote_api is redirecting to the Google login page. Both apps use Google Apps as the authentication mechanism. I've also tried copying to and from a third app we have which uses Google Accounts for authentication.
Notes:
The user account I log in with is an Owner on all three apps. It's a Google Apps account (if that wasn't obvious).
I have a gmail account this is an Owner on all three apps as well. When I log in to the admin console with it, I don't see the datastore admin console at all when I click it.
I'm able to use the remote_api just fine from the command-line after I enter my details
Tried with both the Python remote_api built-in and the Java one.
I've found similar questions/blog posts about this, one of which required logging in from a browser, then manually submitting the ACSID cookie you get after that's done. Can't do that here, obviously.
OK, I think I got this working.
I'll refer to the two appIDs as "source" and "dest".
To enable datastore admin (as you know) you need to upload a Python project with the app.yaml and appengine_config.py files as described in the docs.
Either I misread the docs or there is an error. The "appID" inthe .yaml should be the app ID you are uploading to to enable DS admin.
The other appID in the appengine_config file, specifically this line:
remoteapi_CUSTOM_ENVIRONMENT_AUTHENTICATION = (
'HTTP_X_APPENGINE_INBOUND_APPID', ['appID'])
Should be the appID of the "source", ID the app id of where the data is coming from in the DS copy operation.
I think this line is what allows the source appID to be authenticated as having permissions to write to the "dest" app ID.
So, I changed that .py, uploaded again to my "dest" app ID. To be sure I made this dummy python app as default and left it as that.
Then on the source app ID I tried the DS copy again, and all the copy jobs were kicked off OK - so it seems to have fixed it.