Encrypt new search indexes
You can enable encryption for new search cores when you create them.
Using SolrJ Auth to implement encryption
To use the SolrJ-Auth libraries to implement encryption, follow instructions in the solrj-auth-README.md file.
The default location of the solrj-auth-README.md file depends on the type of installation:
-
Package installations:
/usr/share/dse/solr -
Tarball installations:
<installation_location>/resources/solr
These SolrJ-Auth libraries are included in the clients directory in DataStax Enterprise (DSE) distribution.
The default location of the clients directory depends on the type of installation:
-
Package installations:
/usr/share/dse/clients -
Tarball installations:
<installation_location>/clients
The SolrJ-Auth code is public.
Enable encryption for new search cores
Encryption is enabled per core.
To enable encryption for a new core, edit the search index config file to change the class for directoryFactory to solr.EncryptedFSDirectoryFactory.
When using a TDE-secured local file system, encryption keys are stored remotely with KMIP encryption or locally with on-server encryption.
- With automatic resource generation (recommended)
-
Use the
dsetool create_corecommand with automatic resource generation. WhengenerateResources=true, the command generates resources only if resources don’t exist in thesolr_resourcestable.Specify the class for
directoryFactorytosolr.EncryptedFSDirectoryFactorywith thecoreOptionsInlineargument:dsetool create_core <keyspace_name>.<table_name> generateResources=true coreOptionsInline="directory_factory_class:solr.EncryptedFSDirectoryFactory" - Without automatic resource generation
-
Use the
dsetool create_corecommand without automatic resource generation:dsetool create_core <keyspace_name>.<table_name> schema=schema.xml solrconfig=solrconfig.xmlThe
solrconfig.xmlfile must specify the requireddirectoryFactory. For example:<directoryFactory name="DirectoryFactory" class="solr.EncryptedFSDirectoryFactory"/>
When you create an encrypted search core, a node restart isn’t required.
To disable encryption, disable encryption for the backing CQL table. No node restart is required.
