Enable TLS communication and proceed with API communication without authentication

Security
,
1

**On behalf of a user of Slack **

hello. I have one question.
I can access my_opensearch_cluster with curl -u admin:admin http://localhost:9200/_cat/health
I want to access my_opensearch_cluster with curl http://localhost:9200/_cat/health.
If so, can’t I set anything other than plugins.security.disabled: true?
What I want is to enable TLS communication and proceed with API communication without authentication.

I can’t enable anonymous auth.
The login page still appears when accessing the OSD/

# config.yml (DataNode, MasterNode)

      data: #{}
        config.yml: |
          config:
            dynamic:
              http:
                anonymous_auth_enabled: true

        roles_mapping.yml: |-
          anonymous:
            backend_roles:
              - "opendistro_security_anonymous_backendrole"

        roles.yml: |-
          anonymous:
            cluster_permissions:
            - "cluster_composite_ops"
            - "cluster:monitor/main"
            index_permissions:
            - index_patterns:
              - "*"
              allowed_actions:
              - "read"

# opensearch_dashboard.yml ( OSD )
  config:
    opensearch_dashboards.yml: |
...

        opensearch_security:
          auth:
            anonymous_auth_enabled: true
2

Hi 싸라엘라 (띠리뷔),

To run https://localhost:9200/_cat/health` as anonymous you will need to add cluster:monitor/health to your roles.yml: anonymous.cluster_permissions :

        roles.yml: |-
          anonymous:
            cluster_permissions:
            - "cluster_composite_ops"
            - "cluster:monitor/main"
            - "cluster:monitor/health"
            index_permissions:
            - index_patterns:
              - "*"
              allowed_actions:
              - "read"

Please make sure to use securityadmin.sh to apply your changes, see more here: Applying changes to configuration files - OpenSearch documentation

(Note: use fresh session on your browser (private/incognito) when testing newly applied changes)

Alternatively, for your use case, you could consider JWT authentication to skip the “The login page”,
please see more here: JSON Web Token - OpenSearch documentation

If any further questions on these topics, just let me know.

Best,
Mantas

1 Like