Encrypting New Search Indexes

You can enable encryption for new search cores when you create them.

Using SolrJ Auth to implement encryption

To use the SolrJ-Auth libraries to implement encryption, follow instructions in the solrj-auth-README.md file. The default location of the solrj-auth-README.md file depends on the type of installation:

  • Package installations: /usr/share/dse/solr

  • Tarball installations: <installation_location>/resources/solr

These SolrJ-Auth libraries are included in the clients directory in DataStax Enterprise distribution. The default location of the clients directory depends on the type of installation:

  • Package installations: /usr/share/dse/clients

  • Tarball installations: <installation_location>/clients

The SolrJ-Auth code is public.


When using TDE secure local file system. Encryption keys are stored remotely with KMIP encryption or locally with on-server encryption.


Encryption is enabled per core.

To enable encryption for a new core, edit the search index config file to change the class for directoryFactory to solr.EncryptedFSDirectoryFactory.

  • Recommended: Use the dsetool create_core command with automatic resource generation. Specify the class for directoryFactory to solr.EncryptedFSDirectoryFactory with the handy coreOptionsInline argument:

    dsetool create_core <keyspace_name>.<table_name> generateResources=true coreOptionsInline="directory_factory_class:solr.EncryptedFSDirectoryFactory"
  • Alternate: Use the dsetool create_core command in this way:

    dsetool create_core <keyspace_name>.<table_name> schema=schema.xml solrconfig=solrconfig.xml

    where the solrconfig.xml file specifies the required directoryFactory:

    <directoryFactory name="DirectoryFactory" class="solr.EncryptedFSDirectoryFactory"/>

    The generateResources=true option generates resources only if resources do not exist in the solr_resources table.

    After you create an encrypted search core, a node restart is not required.

What is next

To disable encryption, disable encryption for the backing CQL table. No node restart is required.

Was this helpful?

Give Feedback

How can we improve the documentation?

© 2024 DataStax | Privacy policy | Terms of use

Apache, Apache Cassandra, Cassandra, Apache Tomcat, Tomcat, Apache Lucene, Apache Solr, Apache Hadoop, Hadoop, Apache Pulsar, Pulsar, Apache Spark, Spark, Apache TinkerPop, TinkerPop, Apache Kafka and Kafka are either registered trademarks or trademarks of the Apache Software Foundation or its subsidiaries in Canada, the United States and/or other countries. Kubernetes is the registered trademark of the Linux Foundation.

General Inquiries: +1 (650) 389-6000, info@datastax.com