Since 2.9 we have Adds a check to skip serialization-deserialization if request is for same node by DarshitChanpura · Pull Request #2765 · opensearch-project/security · GitHub.
Solution is:
- Add to config
plugins.security.unsupported.passive_intertransport_auth_initially: true
-
Create user with role opendistro_security_default_transport_backendrole and indices:data/read/search
-
Optionally add
logger.custom_security_filter.name = org.opensearch.security.filter
logger.custom_security_filter.level = error
to log4j config (or in log will be many warnings like ‘Transport auth in passive mode and no user found. Injecting default user’)
UPD One more solution:
add dynamic.disable_intertransport_auth: true to security config.yml