Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):
OpenSearch 2.9.0
OpenSearch-Dashboards 2.9.0/Chrome Web Browser
Describe the issue:
Our opensearch cluster(On the physical machine) uses http, but when we change the password of the admin, we should use securityadmin.sh which must be run with https.
So we have to do like this:
1、select a node , set it to https and restart
2、use securityadmin.sh to change the password and set it back to http
3、restart the node
4、use script to synchronize password to the dashboards
After all this，when we reload the opensearch-dashboards page（we logined in before change the passord） in chrome，we assume that it should return http_code 401 or go to the login in page…However，it return 500 “Internal Server Error”. I think it is a very bad user experience and maybe a bug
BTW，when we use low version of Opensearch or Opendistro for Elasticsearch cluster，there is no need to set https when we want to change the password. This problem won’t happen On Elasticsearch（I think OpenSearch should be better compared with elasticsearch 
）
I know two ways to “solve” the problem：
1、refresh the cookie or set cookie invalid when reload the page
2、force the user to go to /app/login page
However，these two ways are quite unacceptable on our production environment…
Is there a better way to solve this promblem without change the source code of security plugin for opensearch 2.9.0，such as，allow http to change password or not return http_code 500 to dashboards…
Thanks
Configuration:
node.name: ${HOSTNAME}
node.roles: [“ingest”,“remote_cluster_client”,“data”,“cluster_manager”]
http.port: 9200
transport.tcp.port: 9300
bootstrap.memory_lock: true
path.data: /data01/opensearch/data
path.logs: /var/log/opensearch
plugins.security.disabled: false
plugins.security.ssl.transport.pemcert_filepath: ${HOSTNAME}.pem
plugins.security.ssl.transport.pemkey_filepath: ${HOSTNAME}-key.pem
plugins.security.ssl.transport.pemtrustedcas_filepath: root-ca.pem
plugins.security.ssl.transport.enforce_hostname_verification: false
plugins.security.ssl.transport.resolve_hostname: false
plugins.security.ssl.http.enabled: false
plugins.security.ssl.http.pemcert_filepath: ${HOSTNAME}.pem
plugins.security.ssl.http.pemkey_filepath: ${HOSTNAME}-key.pem
plugins.security.ssl.http.pemtrustedcas_filepath: root-ca.pem
plugins.security.allow_default_init_securityindex: true
plugins.security.authcz.admin_dn: [“xxxxxxxx(secrecy)”]
plugins.security.nodes_dn: [“xxxxxxxxxxx(secrecy)”]
plugins.security.audit.type: internal_opensearch
plugins.security.enable_snapshot_restore_privilege: true
plugins.security.check_snapshot_restore_write_privileges: true
plugins.security.restapi.roles_enabled: [“all_access”,“security_rest_api_access”]
plugins.security.system_indices.enabled: true
prometheus.cluster.settings: false
prometheus.indices: true
prometheus.nodes.filter: _all
network.bind_host: 0.0.0.0
network.publish_host: ${HOSTNAME}
cluster.name: OpenSearch
discovery.seed_hosts: [“bigdata-vm-xxxx”,“bigdata-vm-yyyy”,“bigdata-vm-zzzz”]
cluster.initial_master_nodes: [“bigdata-vm-xxxx”,“bigdata-vm-yyyy”,“bigdata-vm-zzzz”]
Relevant Logs or Screenshots:
{ “statusCode”: 500, “error”: “Internal Server Error”, “message”: “An internal server error occurred.” }
