Not able to add the repo

[RyanWorks365]

Hello. I'm trying to setup DIH on Solr 9.4 so that it can import data from our remote SQL server 2016. I'm running on RHEL 8.8 (Ootpa) with FIPS enabled. I'm also using OpenJDK 17.0.9. I've gone through the basic installation of Solr using their guide (https://solr.apache.org/guide/solr/latest/deployment-guide/taking-solr-to-production.html) and the service installation script. I then followed the Solr guide to enable SSL (https://solr.apache.org/guide/solr/latest/deployment-guide/enabling-ssl.html). I already have my server certificate, so I opted out of the self-signed certificate that the guide used. Solr starts up fine and I can get to the Solr Admin GUI. I then tried to follow the readme from the repo to get the package installed, but that's where I'm getting stuck. I get stuck on step 2 which tries to add the repo:
bin/solr package add-repo data-import-handler "https://raw.githubusercontent.com/searchscale/dataimporthandler/master/repo/"

I get the following error:
./solr package add-repo data-import-handler "https://raw.githubusercontent.com/searchscale/dataimporthandler/master/repo/"
INFO - 2023-11-02 13:38:35.569; org.apache.solr.util.configuration.SSLConfigurations; Setting javax.net.ssl.keyStorePassword
INFO - 2023-11-02 13:38:35.574; org.apache.solr.util.configuration.SSLConfigurations; Setting javax.net.ssl.trustStorePassword
com.fasterxml.jackson.databind.JsonMappingException: org.apache.solr.client.solrj.SolrServerException: IOException occurred when talking to server at: https://raw.githubusercontent.com/searchscale/dataimporthandler/master/repo/repository.json (through reference chain: java.util.ArrayList[0]->org.apache.solr.packagemanager.DefaultPackageRepository["packages"])
at com.fasterxml.jackson.databind.JsonMappingException.wrapWithPath(JsonMappingException.java:402)
at com.fasterxml.jackson.databind.JsonMappingException.wrapWithPath(JsonMappingException.java:361)
at com.fasterxml.jackson.databind.ser.std.StdSerializer.wrapAndThrow(StdSerializer.java:323)
at com.fasterxml.jackson.databind.ser.std.BeanSerializerBase.serializeFields(BeanSerializerBase.java:780)
at com.fasterxml.jackson.databind.ser.BeanSerializer.serialize(BeanSerializer.java:178)
at com.fasterxml.jackson.databind.ser.impl.IndexedListSerializer.serializeContents(IndexedListSerializer.java:119)
at com.fasterxml.jackson.databind.ser.impl.IndexedListSerializer.serialize(IndexedListSerializer.java:79)
at com.fasterxml.jackson.databind.ser.impl.IndexedListSerializer.serialize(IndexedListSerializer.java:18)
at com.fasterxml.jackson.databind.ser.DefaultSerializerProvider._serialize(DefaultSerializerProvider.java:479)
at com.fasterxml.jackson.databind.ser.DefaultSerializerProvider.serializeValue(DefaultSerializerProvider.java:318)
at com.fasterxml.jackson.databind.ObjectMapper._writeValueAndClose(ObjectMapper.java:4719)
at com.fasterxml.jackson.databind.ObjectMapper.writeValueAsString(ObjectMapper.java:3964)
at org.apache.solr.packagemanager.RepositoryManager.addRepository(RepositoryManager.java:125)
at org.apache.solr.cli.PackageTool.runImpl(PackageTool.java:106)
at org.apache.solr.cli.ToolBase.runTool(ToolBase.java:52)
at org.apache.solr.cli.SolrCLI.main(SolrCLI.java:153)
Caused by: org.apache.solr.common.SolrException: org.apache.solr.client.solrj.SolrServerException: IOException occurred when talking to server at: https://raw.githubusercontent.com/searchscale/dataimporthandler/master/repo/repository.json
at org.apache.solr.packagemanager.DefaultPackageRepository.initPackages(DefaultPackageRepository.java:129)
at org.apache.solr.packagemanager.DefaultPackageRepository.getPackages(DefaultPackageRepository.java:68)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:568)
at com.fasterxml.jackson.databind.ser.BeanPropertyWriter.serializeAsField(BeanPropertyWriter.java:688)
at com.fasterxml.jackson.databind.ser.std.BeanSerializerBase.serializeFields(BeanSerializerBase.java:772)
... 12 more
Caused by: org.apache.solr.client.solrj.SolrServerException: IOException occurred when talking to server at: https://raw.githubusercontent.com/searchscale/dataimporthandler/master/repo/repository.json
at org.apache.solr.client.solrj.impl.Http2SolrClient.request(Http2SolrClient.java:550)
at org.apache.solr.client.solrj.SolrClient.request(SolrClient.java:1192)
at org.apache.solr.packagemanager.DefaultPackageRepository.initPackages(DefaultPackageRepository.java:120)
... 19 more
Caused by: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131)
at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:378)
at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:321)
at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:316)
at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(CertificateMessage.java:1357)
at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.onConsumeCertificate(CertificateMessage.java:1232)
at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.consume(CertificateMessage.java:1175)
at java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:396)
at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:480)
at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1277)
at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1264)
at java.base/java.security.AccessController.doPrivileged(AccessController.java:712)
at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask.run(SSLEngineImpl.java:1209)
at org.eclipse.jetty.io.ssl.SslConnection$DecryptedEndPoint.fill(SslConnection.java:657)
at org.eclipse.jetty.io.ssl.SslConnection$DecryptedEndPoint.flush(SslConnection.java:1064)
at org.eclipse.jetty.io.WriteFlusher.flush(WriteFlusher.java:422)
at org.eclipse.jetty.io.WriteFlusher.completeWrite(WriteFlusher.java:377)
at org.eclipse.jetty.io.ssl.SslConnection$DecryptedEndPoint.lambda$fill$1(SslConnection.java:838)
at org.apache.solr.common.util.ExecutorUtil$MDCAwareThreadPoolExecutor.lambda$execute$0(ExecutorUtil.java:294)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
at java.base/java.lang.Thread.run(Thread.java:840)
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:439)
at java.base/sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:306)
at java.base/sun.security.validator.Validator.validate(Validator.java:264)
at java.base/sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:285)
at java.base/sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:144)
at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(CertificateMessage.java:1335)
... 17 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at java.base/sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:148)
at java.base/sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:129)
at java.base/java.security.cert.CertPathBuilder.build(CertPathBuilder.java:297)
at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:434)
... 22 more

ERROR: org.apache.solr.client.solrj.SolrServerException: IOException occurred when talking to server at: https://raw.githubusercontent.com/searchscale/dataimporthandler/master/repo/repository.json (through reference chain: java.util.ArrayList[0]->org.apache.solr.packagemanager.DefaultPackageRepository["packages"])

The error seems to be certificate related, but I'm not sure how to handle it. Any ideas on how to get this resolved? Also, does this package even support SQL Server 2016? Thank you in advance!

[epugh]

what version of Solr?

[epugh]

argh, you said 9.4. Okay, there WAS a bug in 9.3....

[epugh]

Just for fun, would you mind trying out these directions?

https://github.com/o19s/splainer/tree/main/solr-splainer-package#installing-into-solr

This is to install splainer..

[RyanWorks365]

I installed Solr 9.3 and tried to add the repo for Splainer, but got the same error as I did when I tried to add the DIH repo

[epugh]

yeah, do it on 9.4. 9.3 did have a bug in parsing the repository.json file mimetype.

[RyanWorks365]

I tried it on Solr 9.4, but got the same error when trying to install Splainer.
./solr package add-repo splainer "https://raw.githubusercontent.com/o19s/splainer/main/solr-splainer-package/repo/"
INFO - 2023-11-02 16:53:18.148; org.apache.solr.util.configuration.SSLConfigurations; Setting javax.net.ssl.keyStorePassword
INFO - 2023-11-02 16:53:18.153; org.apache.solr.util.configuration.SSLConfigurations; Setting javax.net.ssl.trustStorePassword
com.fasterxml.jackson.databind.JsonMappingException: org.apache.solr.client.solrj.SolrServerException: IOException occurred when talking to server at: https://raw.githubusercontent.com/o19s/splainer/main/solr-splainer-package/repo/repository.json (through reference chain: java.util.ArrayList[0]->org.apache.solr.packagemanager.DefaultPackageRepository["packages"])

[epugh]

Humm... Okay, I think it's somethign about the SSL stuff.. I'm guessing from context that FIPS is a security layer? I suspect we need to dig into figuring out why you are getting these errors...

[RyanWorks365]

Yes FIPS is a required security layer we have in place. Also, before I spend anymore time on this, do you know if this DIH package will work with SQL Server 2016. If not, then I’ll look into finding another package or solution. Thanks again for all your help!

[chatman]

Yes, it should work with the right JDBC drivers added to the classpath.

…

On Sat, 4 Nov, 2023, 11:26 pm RyanWorks365, ***@***.***> wrote: Yes FIPS is a required security layer we have in place. Also, before I spend anymore time on this, do you know if this DIH package will work with SQL Server 2016. If not, then I’ll look into finding another package or solution. Thanks again for all your help! — Reply to this email directly, view it on GitHub <#55 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABDCR5EN3KDUYS4HRE3ZWNDYCZ6WTAVCNFSM6AAAAAA63MCGLWVHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM3TINZVGYZDQ> . You are receiving this because you are subscribed to this thread.Message ID: <SearchScale/dataimporthandler/repo-discussions/55/comments/7475628@ github.com>

[RyanWorks365]

I've spent some time trying to get past the SSL error, but have had no luck. I've tried messing with the keystores/truststores and the NSS DB, but still get the same outcome. So even though I can't run the Solr command to add the DIH repo, would it still be possible to get around it by manually downloading and then adding the jars from the repo to my $SOLR_HOME/filestore directory? I was thinking that I would just need to add the 5 jars and the publickey.der files from the repo to my $SOLR_HOME/filestore directory. Then once those files are there would I just need to create the collection and add the data-config.xml file for it? My only doubt is if this step "bin/solr package install data-import-handler" does anything else behind the scenes besides putting the jar files in the correct location. Has anyone tried this approach of manually installing the package?

[RyanWorks365]

I was finally able to get the keystore and truststore right. Once I got that working, I was able to follow the readme guide and get the DIH package added and installed. I also got the package deployed to a new test collection that I created. Now the issue I'm facing is that I don't know what my data-config file should look like for it to connect to my SQL Server.

<dataConfig>
	<dataSource type="JdbcDataSource" driver="com.microsoft.sqlserver.jdbc.SQLServerDriver" url="jdbc:sqlserver://myserver.com\\my_instance:1445" user="my_user" password="my_password">
	</dataSource>
	<document name="assets">
		<entity name="item" query="SELECT ID FROM MY_ID_TABLE">
			<field column="ID" name="id"></field>
		</entity>
	</document>
</dataConfig>

With the above data-config, it throws an error saying that it can't find the driver which I get since I'm not sure what the driver name should be. Besides the driver name, I'm not sure if the rest of the config format is correct or not.

[epugh]

Be awesome if you can sahre some more details on what you did...

[RyanWorks365]

To get the keystore to work, I used the following command:
openssl pkcs12 -export -aes256 -out Solr.p12 -inkey MY_SERVER.key -in My_SERVER.cer -CAfile MY_SERVER_CA_CHAIN.pem -chain -certpbe AES-256-CBC -keypbe AES-256-CBC -macalg SHA256
I believe the key that got it to work was the last 3 arguments "-certpbe AES-256-CBC -keypbe AES-256-CBC -macalg SHA256"

For the truststore I had to add the github cert and chain. I just pulled the certs and chain from their site using FireFox. Just view their cert in FireFox and it has the links to download both the cert and chain. Then I ran the following commands:

keytool -import -alias github-com -file github-com-chain.pem -keystore /etc/pki/java/cacerts
keytool -import -alias github2 -file github-com.pem -keystore /etc/pki/java/cacerts

I also made sure to add my server's cert and chain to the truststore using the same commands above, but provided their respective files. I also did this for my SQL Server's cert and chain.

I then updated the /etc/default/solr.in.sh file to use the keystore and truststore as such.

SOLR_SSL_ENABLED=true
SOLR_SSL_KEY_STORE=/PATH_TO/Solr.p12
SOLR_SSL_KEY_STORE_PASSWORD=MY_SUPER_SECRET_PASSWORD
SOLR_SSL_TRUST_STORE=/etc/pki/java/cacerts
SOLR_SSL_TRUST_STORE_PASSWORD=MY_SUPER_SECRET_PASSWORD
SOLR_SSL_NEED_CLIENT_AUTH=false
SOLR_SSL_WANT_CLIENT_AUTH=false
SOLR_SSL_CHECK_PEER_NAME=true

From here, I was able to follow the readme to get and install the DIH package. Now I'm just stuck on creating the data-config.xml file. I don't know what value the "driver" should be. I've tried "com.microsoft.sqlserver.jdbc.SQLServerDriver", "com.microsoft.sqlserver", and "DataImportHandler", but neither seem to be correct. I feel like when I use "DataImportHandler" as the value that it gets me the closest as I get the following error when using it:
Caused by: java.lang.ClassCastException: class org.apache.solr.handler.dataimport.DataImportHandler cannot be cast to class java.sql.Driver (org.apache.solr.handler.dataimport.DataImportHandler is in unnamed module of loader java.net.Fac
toryURLClassLoader @5fb3111a; java.sql.Driver is in module java.sql of loader 'platform').

I'm so close!

[RyanWorks365]

Any idea on how to resolve the ClassCastException I mentioned above?