Skip to main content
Lucidworks Search uses a number of security measures:
  • Authenticating UI users – Lucidworks Search authenticates users when they log in. Logging in creates a new Lucidworks Search session. Lucidworks Search also authenticates users when the Sessions REST API creates a session.
  • Authorizing UI users – Lucidworks Search authorizes users to use specific parts of the Lucidworks Search UI.
    UI users must also be authorized to make API requests, because the UI makes API requests.
  • Authenticating and authorizing users who make API requests
  • Password Encryption- Lucidworks Search uses 128-bit AES keys to encrypt passwords and “AES/CBC/PKCS7Padding” for the cipher. The ciphertext is also signed.
  • Using session cookies
  • Using an external authentication provider (optional) - A security realm can specify use of an external authentication provider, such as LDAP, JWT, or SAML.
  • Constraining the documents that are indexed (optional)
  • Trimming the documents that are returned by queries based on authorization (optional)

​
Lucidworks Search user login

When logging into the Lucidworks Search UI, a user provides a username and password, as well as their assigned security realm. An administrator must specify these in Lucidworks Search (using the native security realm) or configure Lucidworks Search to use an external authentication provider (for example, LDAP or SAML). See Access control. Lucidworks Search uses roles defined by permissions to authorize Lucidworks Search UI access and perform tasks in Lucidworks Search, including searching. The recommended method to delegate permissions is as follows:
  • Assign each user to a role and create custom roles as needed.
  • Assign permissions on a per-app basis.

​
Manage users with security realms

Lucidworks Search uses security realms to authenticate users of the Lucidworks Search UI. Each user has an assigned security realm, which the user must select when logging in. If the user selects a different realm, authentication fails. A security realm also provides a list of roles as follows:
  • The list always includes the role(s) that are specified in the security realm.
  • (Optional) If an external directory service (such as LDAP) is used for authentication, the list can also contain roles that are mapped from the names of the directory-service groups. That is, you can configure a security realm to return group information for users from that same directory service.
  • (Optional) The security realm can reference one or more Lucidworks Search roles or, when using an external directory service provider, use group membership information from the provider to determine roles for users. Lucidworks Search maps the group names to role names and adds these roles to the user’s list of roles.
Lucidworks Search does not use permissions from LDAP to authorize UI access or API requests. It only obtains group names (optionally), which are used as role names or are mapped to role names. If an Active Directory Security Query Trimming Stage is used, then directory-service permissions are used for trimming. If a connector supports security trimming, then connector permissions are used for trimming.

​
Per-Request Authentication

Requests to the Lucidworks Search REST API must specify a security realm for per-request authentication, unless a session cookie is used (which contains information about the security realm). Lucidworks Search authorizes requested operations based on API permissions specified for the user and for the user’s role(s). Lucidworks Search considers the role(s) specified in the user definition and in the security realm. Lucidworks Search creates a list of roles when a session is created, that is, when a user logs in or when the Sessions REST API creates a session. Authorization based on permissions and its layering is at request time. You can define multiple security realms for a Lucidworks Search instance. A Lucidworks Search instance can manage multiple security realms, which allows users from different domains to have (different levels of) access to specific Lucidworks Search collections.

​
Read-only root file system

Lucidworks Search 5.9.9 and later supports a read-only root file system to safeguard against unauthorized modifications, protecting your deployment against malicious software and other attacks. Most services operate efficiently in this mode, and for components that need write access, a separate writable mount is available. It should only be enabled for services that do not require CRUD access. The table below lists the services that support a read-only root file system, the ones that have it enabled by default, and the Lucidworks Search release in which support was added. Contact Lucidworks to customize how read-only root file system access is configured for your Lucidworks Search deployment.
Chart NamePod NameContainer NameSupportedDefault enabledSupported version
admin-uiadmin-uiadmin-ui✅✅5.9.9+
api-gatewayapi-gatewayinit/api-gateway✅✅5.9.9+
api-gatewayapi-gatewayapi-gateway✅✅5.9.9+
api-gatewayapi-gatewaygenerate-jks✅✅5.9.9+
apps-managerapps-managerapps-manager✅✅5.9.9+
argoargo-serverargo-server✅❌5.9.10+
argoargo-executorexecutor✅❌5.9.10+
argoargo-mainContainermainContainer✅❌5.9.10+
argoargo-controllercontroller✅✅5.9.10+
argo/miniominiominio✅❌5.9.10+
argo/miniominiominio✅❌5.9.10+
argo/miniomake-bucket-jobminio-mc✅❌5.9.10+
argo-common-workflowsdelete-modelinit/main/wait✅❌5.9.10+
argo-common-workflowsdeploy-modelinit/main/wait✅❌5.9.10+
argo-common-workflowsmilvus-maintenanceinit/main/wait✅❌5.9.10+
argo-common-workflowsupload-model-to-cloudinit/main/wait✅❌5.9.10+
async-parsingasync-parsingtika-server✅✅5.9.9+
async-parsingasync-parsingasync-parsing✅✅5.9.9+
auth-uiauth-uiauth-ui✅✅5.9.9+
classic-rest-serviceclassic-rest-serviceinit/import-certs✅✅5.9.10+
classic-rest-serviceclassic-rest-serviceclassic-rest-service✅✅5.9.9+
classificationargo/classificationinit/wait/main✅❌5.9.10+
connector-pluginconnector-plugininit/import-certs✅❌5.9.10+
connector-pluginconnector-pluginconnector-plugin✅✅5.9.9+
connectorsconnectorsconnectors✅✅5.9.9+
connectors-backendCRD✅✅5.9.9+
connectors-backendconnectors-backendconnectors-backend✅✅5.9.9+
fusion-adminfusion-adminadmin✅✅5.9.9+
fusion-commonscheck-admin✅✅5.9.9+
fusion-commonscheck-api-gateway✅✅5.9.9+
fusion-commonscheck-indexing✅✅5.9.9+
fusion-commonscheck-kafka✅✅5.9.9+
fusion-commonscheck-logstash✅✅5.9.9+
fusion-commonscheck-pulsar✅✅5.9.9+
fusion-commonssetup-keystore-and-properties✅✅5.9.9+
fusion-commonscheck-zk✅✅5.9.9+
fusion-config-syncfusion-config-syncfusion-config-sync✅✅5.9.9+
fusion-data-augmentationargo/data-augmentation/volume-fixinit/main/wait✅❌5.9.10+
fusion-data-augmentationargo/data-augmentation/init-workspaceinit/main/wait✅❌5.9.10+
fusion-data-augmentationargo/data-augmentation/write-job-configsinit/main/wait✅❌5.9.10+
fusion-data-augmentationargo/data-augmentation/write-io-configsinit/main/wait✅❌5.9.10+
fusion-data-augmentationargo/data-augmentation/add-zkhostinit/main/wait✅❌5.9.10+
fusion-data-augmentationargo/data-augmentation/pull-data-training-and-metadatainit/main/wait✅❌5.9.10+
fusion-data-augmentationargo/data-augmentation/pull-data-training-and-metadata-cloudinit/main/wait✅❌5.9.10+
fusion-data-augmentationargo/data-augmentation/volume-fix2init/main/wait✅❌5.9.10+
fusion-data-augmentationargo/data-augmentation/synonym-listinit/main/wait✅❌5.9.10+
fusion-data-augmentationargo/data-augmentation/download-synonym-dictionaryinit/main/wait✅❌5.9.10+
fusion-data-augmentationargo/data-augmentation/keystroke-listinit/main/wait✅❌5.9.10+
fusion-data-augmentationargo/data-augmentation/download-keystroke-blobinit/main/wait✅❌5.9.10+
fusion-data-augmentationargo/data-augmentation/augmentinit/main/wait✅❌5.9.10+
fusion-data-augmentationargo/data-augmentation/push-augmented-datainit/main/wait✅❌5.9.10+
fusion-data-augmentationargo/data-augmentation/push-augmented-data-cloudinit/main/wait✅❌5.9.10+
fusion-indexingfusion-indexingfusion-indexing✅✅5.9.9+
fusion-resourcesfusion-resources-secret-hooksetup-keystore-and-properties✅✅5.9.10+
insightsinsightsinsights✅✅5.9.9+
job-launcherjob-launcherjob-launcher✅✅5.9.9+
job-launcherjob-launcherkubectl-runner✅✅5.9.9+
job-launcherjob-launcher-spark-cleanupkubectl-runner✅✅5.9.9+
job-launcherspark-kubernetes-driverspark-kubernetes-driver✅❌5.9.10+
job-launcherspark-kubernetes-executorspark-kubernetes-executor✅❌5.9.10+
job-rest-serverjob-rest-serverjob-rest-server✅✅5.9.9+
kafkakafka-metricskafka-exporter✅❌5.9.10+
kafkakafka-provisioninginit/wait-for-available-kafka✅❌5.9.10+
kafkakafka-provisioningkafka-provisioning✅❌5.9.10+
kafkakafkakafka✅❌5.9.10+
kafkakafkajmx-exporter✅❌5.9.10+
kafkakafkainit/check-zk✅✅5.9.9+
kafkakafkainit/auto-discovery✅❌5.9.10+
kafkakafkainit/volume-permissions✅❌5.9.10+
lwai-gatewaylwai-gatewaylwai-gateway✅✅5.9.9+
ml-model-serviceml-model-servicejava-service✅✅5.9.9+
ml-model-serviceml-model-service-namespace-hookkubectl-runner✅✅5.9.9+
ml-model-service/ambassadorambassadorambassador✅❌5.9.10+
ml-model-service/ambassadorambassadorprometheus-exporter✅❌5.9.10+
ml-model-service/milvusmilvus-writablemilvus✅❌5.9.10+
ml-model-service/milvusmilvus-writableinit/wait-for-mysql✅✅5.9.10+
ml-model-service/milvusmilvus-writableinit/create-for-share-storage✅❌5.9.10+
ml-model-service/milvusmilvus-adminadmin✅❌5.9.10+
ml-model-service/milvusmilvus-admininit/wait-for-milvus✅✅5.9.10+
ml-model-service/milvusmilvus-mishardsinit/wait-for-mysql✅✅5.9.10+
ml-model-service/milvusmilvus-mishardsinit/wait-for-mysql✅✅5.9.10+
ml-model-service/milvusmilvus-mishardsmishards✅❌5.9.10+
ml-model-service/milvus/mysqlmysqlinit/remove-lost-found✅✅5.9.10+
ml-model-service/milvus/mysqlmysqlmysql✅❌5.9.10+
pm-uipm-uipm-ui✅✅5.9.9+
query-pipelinequery-pipelinequery-pipeline✅✅5.9.9+
question-answeringargo/qna-coldstart/init-workspaceinit/wait/main✅❌5.9.10+
question-answeringargo/qna-coldstart/write-job-configsinit/wait/main✅❌5.9.10+
question-answeringargo/qna-coldstart/write-io-configsinit/wait/main✅❌5.9.10+
question-answeringargo/qna-coldstart/write-io-configsinit/wait/main✅❌5.9.10+
question-answeringargo/qna-coldstart/add-zkHostinit/wait/main✅❌5.9.10+
question-answeringargo/qna-coldstart/pull-datainit/wait/main✅❌5.9.10+
question-answeringargo/qna-coldstart/pull-data-cloudinit/wait/main✅❌5.9.10+
question-answeringargo/qna-coldstart/traininit/wait/main✅❌5.9.10+
question-answeringargo/qna-coldstart/list-workspaceinit/wait/main✅❌5.9.10+
question-answeringargo/qna-coldstart/post-modelinit/wait/main✅❌5.9.10+
question-answeringargo/qna-coldstart/apply-seldon-deploymentinit/wait/main✅❌5.9.10+
question-answeringargo/qna-supervised/init-workspaceinit/wait/main✅❌5.9.10+
question-answeringargo/qna-supervised/write-job-configsinit/wait/main✅❌5.9.10+
question-answeringargo/qna-supervised/write-io-configsinit/wait/main✅❌5.9.10+
question-answeringargo/qna-supervised/add-zkhostinit/wait/main✅❌5.9.10+
question-answeringargo/qna-supervised/pull-qa-data-cloudinit/wait/main✅❌5.9.10+
question-answeringargo/qna-supervised/pull-qa-datainit/wait/main✅❌5.9.10+
question-answeringargo/qna-supervised/traininit/wait/main✅❌5.9.10+
question-answeringargo/qna-supervised/train-with-textsinit/wait/main✅❌5.9.10+
question-answeringargo/qna-supervised/list-workspaceinit/wait/main✅❌5.9.10+
question-answeringargo/qna-supervised/post-modelinit/wait/main✅❌5.9.10+
question-answeringargo/qna-supervised/apply-seldon-deploymentinit/wait/main✅❌5.9.10+
question-answeringargo/qna-evaluation/init-workspaceinit/wait/main✅❌5.9.10+
question-answeringargo/qna-evaluation/write-job-configsinit/wait/main✅❌5.9.10+
question-answeringargo/qna-evaluation/write-io-configsinit/wait/main✅❌5.9.10+
question-answeringargo/qna-evaluation/add-zkhostinit/wait/main✅❌5.9.10+
question-answeringargo/qna-evaluation/list-workspaceinit/wait/main✅❌5.9.10+
question-answeringargo/qna-evaluation/pull-eval-datainit/wait/main✅❌5.9.10+
question-answeringargo/qna-evaluation/pull-eval-data-cloudinit/wait/main✅❌5.9.10+
question-answeringargo/qna-evaluation/evaluateinit/wait/main✅❌5.9.10+
question-answeringargo/qna-evaluation/push-eval-results-cloudinit/wait/main✅❌5.9.10+
question-answeringargo/qna-evaluation/push-eval-resultsinit/wait/main✅❌5.9.10+
recommenderargo/item-recommender-userinit/wait/main✅❌5.9.10+
recommenderargo/item-recommender-user/init-workspaceinit/wait/main✅❌5.9.10+
recommenderargo/item-recommender-user/write-job-configsinit/wait/main✅❌5.9.10+
recommenderargo/item-recommender-user/write-io-configsinit/wait/main✅❌5.9.10+
recommenderargo/item-recommender-user/add-zkhostinit/wait/main✅❌5.9.10+
recommenderargo/item-recommender-user/pull-data-training-and-metadatainit/wait/main✅❌5.9.10+
recommenderargo/item-recommender-user/pull-data-training-and-metadata-cloudinit/wait/main✅❌5.9.10+
recommenderargo/item-recommender-user/train-with-metadatainit/wait/main✅❌5.9.10+
recommenderargo/item-recommender-user/train-without-metadatainit/wait/main✅❌5.9.10+
recommenderargo/item-recommender-user/push-recommendationsinit/wait/main✅❌5.9.10+
recommenderargo/item-recommender-user/push-recommendations-cloudinit/wait/main✅❌5.9.10+
recommenderargo/item-recommender-user/add-default-exclude-queryinit/wait/main✅❌5.9.10+
recommenderargo/item-recommender-user/init-workspaceinit/wait/main✅❌5.9.10+
recommenderargo/item-recommender-content/copy-modelinit/wait/main✅❌5.9.10+
recommenderargo/item-recommender-content/write-job-configsinit/wait/main✅❌5.9.10+
recommenderargo/item-recommender-content/write-io-configsinit/wait/main✅❌5.9.10+
recommenderargo/item-recommender-content/add-zkhostinit/wait/main✅❌5.9.10+
recommenderargo/item-recommender-content/pull-datainit/wait/main✅❌5.9.10+
recommenderargo/item-recommender-content/pull-data-cloudinit/wait/main✅❌5.9.10+
recommenderargo/item-recommender-content/traininit/wait/main✅❌5.9.10+
recommenderargo/item-recommender-content/push-contentinit/wait/main✅❌5.9.10+
recommenderargo/item-recommender-content/push-content-cloudinit/wait/main✅❌5.9.10+
recommenderargo/item-recommender-content/add-default-exclude-queryinit/wait/main✅❌5.9.10+
recommenderargo/item-recommender-content/delete-old-content-recommendationsinit/wait/main✅❌5.9.10+
reverse-searchreverse-searchinit/set-reverse-search-zone✅✅5.9.10+
reverse-searchreverse-searchinit/check-zk✅✅5.9.9+
reverse-searchreverse-searchinit/enable-tls-in-reverse-search✅✅5.9.10+
reverse-searchreverse-searchreverse-search✅❌5.9.10+
rules-uirules-uirules-ui✅✅5.9.9+
seldon-core-operatorseldon-controller-managermanager✅❌5.9.10+
seldon-core-operatorseldon-spartakus-volunteerseldon-spartakus-volunteer✅❌5.9.9+
seldon-core-operatorcrd/SeldonDeployment✅/❌❌5.9.9+
solrsolrinit/set-solr-zone✅✅5.9.10+
solrsolrinit/enable-tls-in-solr✅✅5.9.10+
solrconfigset-bootstrapconfigset-bootstrap✅✅5.9.10+
solrsolrsolr✅❌5.9.10+
solrsolr-exporterexporter✅❌5.9.10+
solrsolr-exporterinit/solr-init✅✅5.9.10+
solr-managedconfigset-bootstrapconfigset-bootstrap✅✅5.9.10+
solr-managedexporterexporter✅❌5.9.10+
solr-managedexporterinit/solr-init✅✅5.9.10+
solr-managedsolrinit/set-solr-zone✅✅5.9.10+
solr-managedsolrinit/enable-tls-in-solr✅✅5.9.10+
solr-managedsolrsolr✅❌5.9.10+
solr-managedsolrprocess-raw✅❌5.9.10+
solr-backup-runnersolr-backup-runner-backupsolr-backups✅❌5.9.10+
solr-backup-runnersolr-backup-runner-prunesolr-prune✅❌5.9.10+
templatingtemplatingtemplating✅✅5.9.9+
webappswebappswebapps✅✅5.9.9+
zookeeperzookeeperzookeeper✅❌5.9.10+
zookeeperzookeeperjmx-exporter✅❌5.9.10+
zookeeperzookeeperzookeeper-exporter✅❌5.9.10+
zookeeperzookeeper-chrootsmain✅❌5.9.10+

​
Restrictive mode for query pipelines

In Lucidworks Search 5.9.15 and later, you can choose restrictive mode for any query pipeline. Restrictive mode safeguards the pipeline against unintended or unsafe changes. The default mode is permissive mode. See Restrictive Mode for complete details about how restrictive mode works and how to enable it.