Add logout functionality to brokered Solr instances

[FuhuXia]

Please keep any sensitive details in Google Drive.

Date of report: 2021-05-26
Severity: Moderate
Due date: 2021-08-26

Due date is based on severity and described in RA-5. 15-days for Critical, 30-days for High, and 90-days for Moderate and lower.

• Analysis has been performed and an issue has been linked to address other occurrences for this class of vulnerability* (link)

* When a finding is identified, we create two issues. One to address the specific instance identified in the report. The other is to identify and address all other occurrences of this vulnerability within the application.

Brief description

[mogul]

Looks like the best way to handle this is to just enable the solr-operator's support for managing authentication.

[nickumia-reisys]

We shifted from Basic Authentication in NGINX to Basic Authentication in Solr because the Solr UI natively supports login/logout. I think for this issue, keeping Authentication in Solr is the best option.

[nickumia-reisys]

Key Updates for Review:

• Switched from NGINX BasicAuth to Solr native BasicAuth
• As of 8.6, Solr native BasicAuth implements custom login/logout UI through an AngularJS library.
• Prior to 8.6, Solr native BasicAuth is implemented through browser-enabled HTTPBasicAuth (in the same way as NGINX).
• Tests were written to verify that the brokerpak created/destroyed/sandboxed credentials appropriately.
• The login/logout UI test is not automated, but it does pass manual testing.