Hello @cwperks / All,
I am trying to integrate OpenID connect with Opensearch with fresh installation of single node cluster.
I was getting the error message as follows.
.opendistro_security index already exists, so we do not need to create one.
Legacy index '.opendistro_security' (ES 6) detected (or forced). You should migrate the configuration!
As I get to know that there is bug has been reported for the same it has been fixed as well…
This morning I tried to execute the securityadmin.sh script again with latest Opensearch version (2.2.1) and I am still getting that message…
Can you please assist me on this?
bash-4.2# ./securityadmin.sh -cd /usr/share/opensearch/config/opensearch-security -icl -nhnv \
> -key /usr/share/opensearch/config/kirk-key.pem \
> -cert /usr/share/opensearch/config/kirk.pem \
> -cacert /usr/share/opensearch/config/root-ca.pem
**************************************************************************
** This tool will be deprecated in the next major release of OpenSearch **
** https://github.com/opensearch-project/security/issues/1755 **
**************************************************************************
Security Admin v7
Will connect to localhost:9200 ... done
Connected as "CN=kirk,OU=client,O=client,L=test,C=de"
OpenSearch Version: 2.2.0
Contacting opensearch cluster 'opensearch' and wait for YELLOW clusterstate ...
Clustername: opensearch-cluster
Clusterstate: GREEN
Number of nodes: 1
Number of data nodes: 1
.opendistro_security index already exists, so we do not need to create one.
Legacy index '.opendistro_security' (ES 6) detected (or forced). You should migrate the configuration!
Populate config from /usr/share/opensearch/config/opensearch-security/
ERR: Seems /usr/share/opensearch/config/opensearch-security/config.yml is not in legacy format: com.fasterxml.jackson.databind.exc.MismatchedInputException: Cannot construct instance of `org.opensearch.security.securityconf.impl.v7.ConfigV7$AuthcDomain` (although at least one Creator exists): no boolean/Boolean-argument constructor/factory method to deserialize from boolean value (true)
Here is my config.yaml
config:
dynamic:
authc:
openid_auth_domain:
http_enabled: true
transport_enabled: true
order: 0
http_authenticator:
type: openid
challenge: false
config:
subject_key: preferred_username
roles_key: admin_role
openid_connect_idp:
enable_ssl: true
verify_hostnames: false
openid_connect_url: https://idp-xxxxxxxxxx/.well-known/openid-configuration
openid_connect_idp.pemtrustedcas_filepath: "/etc/ssl/certs/admin.pem"
authentication_backend:
type: noop
Here is my docker-compose file.
version: '3'
services:
opensearch-node1:
image: opensearchproject/opensearch:latest
container_name: opensearch-node1
environment:
- cluster.name=opensearch-cluster
- node.name=opensearch-node1
- plugins.security.ssl.transport.pemcert_filepath=/etc/ssl/certs/admin.pem
- plugins.security.ssl.transport.pemkey_filepath=/etc/ssl/certs/admin-key.pem
- plugins.security.ssl.transport.pemtrustedcas_filepath=/etc/ssl/certs/root-ca.pem
- plugins.security.ssl.transport.enforce_hostname_verification=false
- plugins.security.ssl.http.enabled=true
- plugins.security.ssl.http.pemcert_filepath=/etc/ssl/certs/admin.pem
- plugins.security.ssl.http.pemkey_filepath=/etc/ssl/certs/admin-key.pem
- plugins.security.ssl.http.pemtrustedcas_filepath=/etc/ssl/certs/root-ca.pem
- plugins.security.authcz.admin_dn=CN=xyz.com,OU=xxxxxx,O=VW,L=wolfsburg,ST=xxxxxxxx,C=IN
- bootstrap.memory_lock=true # along with the memlock settings below, disables swapping
- "OPENSEARCH_JAVA_OPTS=-Xms512m -Xmx512m" # minimum and maximum Java heap size, recommend setting both to 50% of system RAM
# - "DISABLE_INSTALL_DEMO_CONFIG=true" # disables execution of install_demo_configuration.sh bundled with security plugin, which installs demo certificates and security configurations to OpenSearch
# - "DISABLE_SECURITY_PLUGIN=true" # disables security plugin entirely in OpenSearch by setting plugins.security.disabled: true in opensearch.yml
- "discovery.type=single-node" # disables bootstrap checks that are enabled when network.host is set to a non-loopback address
ulimits:
memlock:
soft: -1
hard: -1
nofile:
soft: 65536 # maximum number of open files for the OpenSearch user, set to at least 65536 on modern systems
hard: 65536
volumes:
- opensearch-data1:/usr/share/opensearch/data
- ./config.yml:/usr/share/opensearch/config/opensearch-security/config.yml
- /tmp/opensearch/:/etc/ssl/certs/
ports:
- 0.0.0.0:9200:9200
- 9600:9600 # required for Performance Analyzer
networks:
- opensearch-net
opensearch-dashboards:
image: opensearchproject/opensearch-dashboards:latest
container_name: opensearch-dashboards
ports:
- 0.0.0.0:5601:5601
expose:
- "5601"
environment:
- 'OPENSEARCH_HOSTS=["https://localhost:9200"]'
- "opensearch_security.auth.type=openid"
- "opensearch_security.openid.connect_url=https://xxxxxx.well-known/openid-configuration"
- "opensearch_security.openid.client_id="XXXXXXXXXXXXXXXXXXX"
- "opensearch_security.openid.client_secret=xxxxxxxxxxxxxxxxxxxxxxxxxxxx"
- "opensearch_security.openid.base_redirect_url=https://localhost:5601"
- "opensearch.requestHeadersWhitelist=[ authorization,securitytenant, security_tenant]"
- "opensearch_security.openid.scope=openid profile email address phone offline_access"
- "opensearch_security.openid.verify_hostnames:false"
- "opensearch_security.openid.refresh_tokens:false"
# - "DISABLE_SECURITY_DASHBOARDS_PLUGIN=true" # disables security dashboards plugin in OpenSearch Dashboards
- "SERVER_BASEPATH=/opensearch"
- "SERVER_REWRITEBASEPATH=true"
volumes:
- /var/lib/docker/volumes/containers:/var/lib/docker/volumes/containers:ro
- /var/run/docker.sock:/var/run/docker.sock:ro
networks:
- opensearch-net
volumes:
opensearch-data1:
networks:
opensearch-net:
Any help/suggestion would be highly appreciated…
Thanks.
Now when I try to execute the securityadmin.sh getting the following error message.
