Stream: community

Topic: CMMC L2-3.13.8: Data in transit: solr (use HTTPS)

view this post on Zulip Steve Baroti (Feb 21 2025 at 19:51):

Hello! We received the mandate to enable only FIP-compliant encrypted network communication, and we want to use HTTPS to query the solr server. Do you have any recommendations? I went through the relevant dataverse JAVA search code, checked files like "SolrClientService.java", "AbstractSolrClientService.java", the Http2SolrClient.Builder (getSolrUrl), JvmSettings.SOLR_PROT.lookup() and it looks like the environment variable "DATAVERSE_SOLR_PROTOCOL" may help (we are not running containers, though). I am wondering how can I still squeeze in the HTTPS bit into ":SolrHostColonPort". Can you please point me to some documentation page (even experimental) on how to enable solr queries using HTTPS for dataverse? Thank you, Steve.
PS. the PostgreSQL JDBC driver talks seamless encryption over the network: TLSv1.3, cipher=TLS_AES_256_GCM_SHA384
RE: CMMC L2-3.13.8 - Data in Transit: Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission.

view this post on Zulip Oliver Bertuch (Feb 21 2025 at 20:09):

Please don't use the database SolrColonHostPort setting anymore. It's deprecated and may go away soon.

The JVM options dataverse.solr.* are your friends in any environment, whether you're using containers or not. So using dataverse.solr.protocol=https is what you're looking for.

You can set these using any MPC source, there should be a doc hint about that, too.

Regarding Postgres look put for these options, especially the .parameters one.

view this post on Zulip Steve Baroti (Feb 21 2025 at 23:58):

Wonderful! Thank you, Oliver. Yes indeed, we found the HTTPS setting as you indicated:
dataverse.solr.protocol: The Solr server URL protocol for the connection. Remember to restart / redeploy Dataverse after changing the setting (as with :SolrHostColonPort). Defaults to http, but might be set to https for extra secure Solr installations.

view this post on Zulip Don Sizemore (Feb 22 2025 at 13:57):

@Steve Baroti The JDBC Postgres driver prefers SSL when available IIRC, but can be enforced to "always". I understand your compliant security mandate, but out of curiosity, will you have any sensitive information indexed in Solr unless you turn on full-text indexing?

Last updated: Nov 01 2025 at 14:11 UTC