Can't get _plugins/_security/api/nodesdn

Security
1

When I try to call GET _plugins/_security/api/nodesdn, I get an error:
{ "status" : "FORBIDDEN", "message" : "API allowed only for admin." }
My opensearch.yml:

plugins.security.ssl.transport.pemcert_filepath: /usr/share/opensearch/config/node.pem
plugins.security.ssl.transport.pemkey_filepath: /usr/share/opensearch/config/node-key.pem
plugins.security.ssl.transport.pemtrustedcas_filepath: /usr/share/opensearch/config/root-ca-new.pem
plugins.security.ssl.transport.enforce_hostname_verification: false
plugins.security.ssl.http.enabled: true
plugins.security.ssl.http.pemcert_filepath: /usr/share/opensearch/config/node.pem
plugins.security.ssl.http.pemkey_filepath: /usr/share/opensearch/config/node-key.pem
plugins.security.ssl.http.pemtrustedcas_filepath: /usr/share/opensearch/config/root-ca-new.pem
#plugins.security.allow_default_init_securityindex: true
plugins.security.authcz.admin_dn:
  - 'CN=admin,OU=UNIT,O=ORG,L=TORONTO,ST=ONTARIO,C=CA'
plugins.security.nodes_dn:
  - 'CN=node*,OU=UNIT,O=ORG,L=TORONTO,ST=ONTARIO,C=CA'
plugins.security.audit.type: internal_opensearch
plugins.security.enable_snapshot_restore_privilege: true
plugins.security.check_snapshot_restore_write_privileges: true
plugins.security.restapi.roles_enabled: ["all_access", "security_rest_api_access"]
cluster.routing.allocation.disk.threshold_enabled: false
opendistro_security.audit.config.disabled_rest_categories: NONE
plugins.security.nodes_dn_dynamic_config_enabled: true
opendistro_security.audit.config.disabled_transport_categories: NONE
2

@Melok

What version of opensearch are you running? The message would indicate that you need to use admin certificate to call this API.

3

Latest version. Login with admin:admin. How to loging with admin certificate?

4

@Melok
The admin certificate is the one configured in opensearch.yaml

plugins.security.authcz.admin_dn:
  - 'CN=admin,OU=UNIT,O=ORG,L=TORONTO,ST=ONTARIO,C=CA'

You should be able to run curl like below:

curl --insecure -XGET “https://localhost:9200/_plugins/_security/api/nodesdn” --cert /usr/share/opensearch/config/kirk.pem --key /usr/share/opensearch/config/kirk-key.pem
(kirk.pem and kirk-key.pem being the admin certificates in this case)

5

But how can i do this with REST API?

6

@Melok I don’t follow your question. This is indeed a REST API call using curl command I provided.
If you are asking how can you run it from Opensearch Dashboards dev tools, I don’t think you can, because you need to provide the admin certificate.

1 Like
7

Yes, I wanted to run from DevTools. Thanks for your answer.