Database connection: proxy in front of solr

[xueyun0512]

Bug description

Hello,
I want to connect to Apache Solr. However, since I have configured Solr to use Kerberos, I can't connect to the Solr server directly (as solr-sqlalchemy does not support Kerberos authentication protocol).
Therefore, I have set an proxy in front of Solr. I'm using Knox Gateway.

When I tried the following URi
solr://username:password@my.knox.vip.com:443/europe-italy/team-tiramisu/solr/cheese_collection

Where:
443: port
europe-italy/team-tiramisu: knox gateway topology
cheese_collection: my Solr collection name

I got the error:
ERROR: Expecting value: line 1 column 1 (char 0)

Can you help me please?

In this case, what is the easiest solution?

1. Change the source code solr-sqlalchemy to support Kerberos?
2. Change the source code solr-sqlalchemy to use Knox Gateway ?

Screenshots/recordings

No response

Superset version

master / latest-dev

Python version

3.11

Node version

I don't know

Browser

Chrome

Additional context

No response

Checklist

• I have searched Superset docs and Slack and didn't find a solution to my problem.
• I have searched the GitHub issue tracker and didn't find a similar bug report.
• I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.

[FrancescoCastaldi]

The error ERROR: Expecting value: line 1 column 1 (char 0) is a Python json.decoder.JSONDecodeError. It occurs when solr-sqlalchemy sends an HTTP request expecting a JSON response from Solr, but the server (in this case, Knox Gateway) returns an HTML document or an empty response (such as an HTTP 401/403 authentication challenge or an HTML login redirect).

Between modifying solr-sqlalchemy for Kerberos vs Knox Gateway, using Knox Gateway is by far the cleaner and standard approach because Knox is explicitly designed to handle the Kerberos/SPNEGO authentication on the Hadoop/Solr side while offering simple HTTP Basic Auth to external clients like Superset.

Here is how to resolve the connection through Knox:

1. Fix the Knox Gateway URL Path Structure

Apache Knox topologies expose services under /gateway/<topology_name>/<service_name>.
Your connection URI should include the /gateway/ path prefix:

solr://username:password@my.knox.vip.com:443/gateway/europe-italy/team-tiramisu/solr/cheese_collection

If your Knox topology is mapped with SSL on port 443, ensure use_ssl=true is passed so requests use https:// instead of http://.

2. Configure Engine Parameters and SSL Verification in Superset

In Superset, go to Settings -> Database Connections -> Edit -> Advanced -> Other, and configure the Engine Parameters with proper HTTP headers and SSL certificates:

{
  "connect_args": {
    "scheme": "https",
    "verify_ssl": true
  }
}

3. Verify the Knox Endpoint Directly via cURL

Before testing in Superset, verify from the Superset server shell that Knox is accepting your Basic Auth credentials and returning valid Solr JSON:

curl -k -u "username:password" \
  "https://my.knox.vip.com:443/gateway/europe-italy/team-tiramisu/solr/cheese_collection/select?q=*:*&wt=json"

If this returns an HTML page containing "Knox Authentication Failed" or a 302 redirect, check your Knox service role permissions for the solr service in that topology. Once cURL returns a raw JSON object starting with { "responseHeader": ... }, the SQLAlchemy Solr driver will connect successfully.