title: How can I secure Solr 5.3.1 only admin pages
body: <p>I am fairly new to Solr and I have been researching this for the past day and half and finally turning here. </p>
  
  <p>I have a Solr server up and running and I had my network admin configure a rule in the firewall so that we can access it for queries from my JavaScript application. This works. The issue that I have is that the Solr admin pages is completely open to the world and I have tried everything as described in various posts with the exception of the ZooKeeper method which I don't really want to try coz I am not interested in setting up ZooKeeper and SolrCloud. </p>
  
  <p>Reference post:  <a href="http://muddyazian.blogspot.com/2013/11/how-to-require-password-authentication.html" rel="nofollow noreferrer">http://muddyazian.blogspot.com/2013/11/how-to-require-password-authentication.html</a> and some others</p>
  
  <p>What I did was modify <strong>jetty.xml</strong> in <strong>/opt/solr/server/etc</strong> and added this</p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;Call name="addBean"&gt;
    &lt;Arg&gt;
      &lt;New class="org.eclipse.jetty.security.HashLoginService"&gt;
        &lt;Set name="name"&gt;Solr Admin Access&lt;/Set&gt;
        &lt;Set name="config"&gt;&lt;SystemProperty name="jetty.home" default="."/&gt;/etc/realm.properties&lt;/Set&gt;
        &lt;Set name="refreshInterval"&gt;0&lt;/Set&gt;
      &lt;/New&gt;
    &lt;/Arg&gt;
  &lt;/Call&gt;
  </code></pre>
  
  <p>Then I added to <strong>web.xml</strong> in <strong>/opt/solr/server/solr-webapp/webapp/WEB-INF</strong> the config below</p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;security-constraint&gt;
      &lt;web-resource-collection&gt;
        &lt;web-resource-name&gt;Solr authenticated application&lt;/web-resource-name&gt;
        &lt;url-pattern&gt;/*&lt;/url-pattern&gt;
      &lt;/web-resource-collection&gt;
      &lt;auth-constraint&gt;
        &lt;role-name&gt;admin&lt;/role-name&gt;
      &lt;/auth-constraint&gt;
    &lt;/security-constraint&gt;
  
    &lt;login-config&gt;
      &lt;auth-method&gt;BASIC&lt;/auth-method&gt;
      &lt;realm-name&gt;Solr Admin Access&lt;/realm-name&gt;
  
    &lt;/login-config&gt;
  </code></pre>
  
  <p>then I created a realm.properties file hashed the password according to this post  <a href="https://stackoverflow.com/questions/28314875/jetty-solr-admin-panel-password">Jetty/SOLR Admin Panel Password</a></p>
  
  <p>Solr is now secure but everything is password protected, I want my queries to be open and the rest protected. I tried adding different url patterns such as  /admin/* , /mycollection/dataimport/* etc but none of those seem to affect the fact that the query is also secure. Reference <a href="https://gist.github.com/jstrassburg/9777027" rel="nofollow noreferrer">https://gist.github.com/jstrassburg/9777027</a></p>