# Opensearch-security config.yml config ignored

**URL:** <https://forum.opensearch.org/t/opensearch-security-config-yml-config-ignored/19078>\
**Category:** OpenSearch\
**Created:** [April 26, 2024, 7:50pm UTC](https://forum.opensearch.org/t/opensearch-security-config-yml-config-ignored/19078 "2024-04-26T19:50:06Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mercurochrome7](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/mercurochrome7/32/7439_2.png) [@Mercurochrome7](https://forum.opensearch.org/u/Mercurochrome7)\
**Post date:** [April 26, 2024, 7:50pm UTC](https://forum.opensearch.org/t/opensearch-security-config-yml-config-ignored/19078/1 "2024-04-26T19:50:06Z")

</div>

Hello,

I’ve just read a lot of topic with the almost same problem than me but can’t fix it…

I’m using opensearch and opensearch-dashboards v2.11.1 both.

I think I put correct config but ldap still not working when I try to log into opensearch-dashboard or with curl command. I also noticed that in opensearch-dashboard in Security \> Authentication, the authentication type list isn’t the same as in my file. Event the HTTP or Transport settings are differents. Also, if I rename my config.yml in config.old nothing happen, like the file is completely ignored.

Here is my config file :

```auto
_meta:
  type: "config"
  config_version: 2

config:
  dynamic:
    http:
      anonymous_auth_enabled: false
    authc:
      internal_auth:
        order: 0
        description: "HTTP basic authentication using the internal user database"
        http_enabled: true
        transport_enabled: true
        http_authenticator:
          type: basic
          challenge: false
        authentication_backend:
          type: internal
      ldap_auth:
        order: 1
        description: "Authenticate using LDAP"
        http_enabled: true
        transport_enabled: true
        http_authenticator:
          type: basic
          challenge: false
        authentication_backend:
          type: ldap
          config:
            enable_ssl: false
            enable_start_tls: false
            enable_ssl_client_auth: false
            verify_hostnames: true
            hosts:
            - myldapserver.local:389
            bind_dn: cn=user1,ou=users,dc=myldapserver,dc=local
            password: xxxx (password of the user user1)
            userbase: ou=users,dc=myldapserver,dc=local
            usersearch: (cn={0})
            username_attribute: cn

    authz:
      ldap_roles:
        description: "Authorize using LDAP"
        http_enabled: true
        transport_enabled: true
        authorization_backend:
          type: ldap
          config:
            enable_ssl: false
            enable_start_tls: false
            enable_ssl_client_auth: false
            verify_hostnames: true
            hosts:
            - myldapserver.local:389
            bind_dn: cn=user1,ou=users,dc=myldapserver,dc=local
            password: xxxx (password of the user user1)
            userbase: ou=users,dc=myldapserver,dc=local
            usersearch: (cn={0})
            username_attribute: cn
            skip_users:
              - admin
              - kibanaserver
            rolebase: ou=roles,dc=myldapserver,dc=local
            rolesearch: (uniqueMember={0})
            userroleattribute: null
            userrolename: disabled
            rolename: cn
            resolve_nested_roles: false

```

Anyone can help please ?

Thank you !!!

---

<div class="post-metadata">

**Author:** ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)\
**Post date:** [April 29, 2024, 9:51am UTC](https://forum.opensearch.org/t/opensearch-security-config-yml-config-ignored/19078/2 "2024-04-29T09:51:25Z")

</div>

Hi @Mercurochrome7,

Could you please run the below command and share the output:  
(note: blank all sensitive information)

```auto

curl --insecure -u <admin_username>:<admin_password> -XGET https://<OS_node>:9200/_plugins/_security/api/securityconfig?pretty

```

Thnaks,  
mj

---

<div class="post-metadata">

**Author:** ![Mercurochrome7](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/mercurochrome7/32/7439_2.png) [@Mercurochrome7](https://forum.opensearch.org/u/Mercurochrome7)\
**Post date:** [April 29, 2024, 12:06pm UTC](https://forum.opensearch.org/t/opensearch-security-config-yml-config-ignored/19078/3 "2024-04-29T12:06:18Z")

</div>

Hi @Mantas and thank you for your reply !!

I tried this command and it’s send me the default config (not the one I configure in /etc/opensearch/opensearch-security/config.yml)

```auto
{
  "config" : {
    "dynamic" : {
      "filtered_alias_mode" : "warn",
      "disable_rest_auth" : false,
      "disable_intertransport_auth" : false,
      "respect_request_indices_options" : false,
      "kibana" : {
        "multitenancy_enabled" : true,
        "private_tenant_enabled" : true,
        "default_tenant" : "",
        "server_username" : "kibanaserver",
        "index" : ".kibana"
      },
      "http" : {
        "anonymous_auth_enabled" : false,
        "xff" : {
          "enabled" : false,
          "internalProxies" : "192\\.168\\.0\\.10|192\\.168\\.0\\.11",
          "remoteIpHeader" : "X-Forwarded-For"
        }
      },
      "authc" : {
        "jwt_auth_domain" : {
          "http_enabled" : false,
          "transport_enabled" : false,
          "order" : 0,
          "http_authenticator" : {
            "challenge" : false,
            "type" : "jwt",
            "config" : {
              "signing_key" : "base64 encoded HMAC key or public RSA/ECDSA pem key",
              "jwt_header" : "Authorization",
              "jwt_clock_skew_tolerance_seconds" : 30
            }
          },
          "authentication_backend" : {
            "type" : "noop",
            "config" : { }
          },
          "description" : "Authenticate via Json Web Token"
        },
        "ldap" : {
          "http_enabled" : false,
          "transport_enabled" : false,
          "order" : 5,
          "http_authenticator" : {
            "challenge" : false,
            "type" : "basic",
            "config" : { }
          },
          "authentication_backend" : {
            "type" : "ldap",
            "config" : {
              "enable_ssl" : false,
              "enable_start_tls" : false,
              "enable_ssl_client_auth" : false,
              "verify_hostnames" : true,
              "hosts" : [
                "localhost:8389"
              ],
              "userbase" : "ou=people,dc=example,dc=com",
              "usersearch" : "(sAMAccountName={0})"
            }
          },
          "description" : "Authenticate via LDAP or Active Directory"
        },
        "basic_internal_auth_domain" : {
          "http_enabled" : true,
          "transport_enabled" : true,
          "order" : 4,
          "http_authenticator" : {
            "challenge" : true,
            "type" : "basic",
            "config" : { }
          },
          "authentication_backend" : {
            "type" : "intern",
            "config" : { }
          },
          "description" : "Authenticate via HTTP Basic against internal users database"
        },
        "proxy_auth_domain" : {
          "http_enabled" : false,
          "transport_enabled" : false,
          "order" : 3,
          "http_authenticator" : {
            "challenge" : false,
            "type" : "proxy",
            "config" : {
              "user_header" : "x-proxy-user",
              "roles_header" : "x-proxy-roles"
            }
          },
          "authentication_backend" : {
            "type" : "noop",
            "config" : { }
          },
          "description" : "Authenticate via proxy"
        },
        "clientcert_auth_domain" : {
          "http_enabled" : false,
          "transport_enabled" : false,
          "order" : 2,
          "http_authenticator" : {
            "challenge" : false,
            "type" : "clientcert",
            "config" : {
              "username_attribute" : "cn"
            }
          },
          "authentication_backend" : {
            "type" : "noop",
            "config" : { }
          },
          "description" : "Authenticate via SSL client certificates"
        },
        "kerberos_auth_domain" : {
          "http_enabled" : false,
          "transport_enabled" : false,
          "order" : 6,
          "http_authenticator" : {
            "challenge" : true,
            "type" : "kerberos",
            "config" : {
              "krb_debug" : false,
              "strip_realm_from_principal" : true
            }
          },
          "authentication_backend" : {
            "type" : "noop",
            "config" : { }
          }
        }
      },
      "authz" : {
        "roles_from_another_ldap" : {
          "http_enabled" : false,
          "transport_enabled" : false,
          "authorization_backend" : {
            "type" : "ldap",
            "config" : { }
          },
          "description" : "Authorize via another Active Directory"
        },
        "roles_from_myldap" : {
          "http_enabled" : false,
          "transport_enabled" : false,
          "authorization_backend" : {
            "type" : "ldap",
            "config" : {
              "enable_ssl" : false,
              "enable_start_tls" : false,
              "enable_ssl_client_auth" : false,
              "verify_hostnames" : true,
              "hosts" : [
                "localhost:8389"
              ],
              "rolebase" : "ou=groups,dc=example,dc=com",
              "rolesearch" : "(member={0})",
              "userrolename" : "disabled",
              "rolename" : "cn",
              "resolve_nested_roles" : true,
              "userbase" : "ou=people,dc=example,dc=com",
              "usersearch" : "(uid={0})"
            }
          },
          "description" : "Authorize via LDAP or Active Directory"
        }
      },
      "auth_failure_listeners" : { },
      "do_not_fail_on_forbidden" : false,
      "multi_rolespan_enabled" : true,
      "hosts_resolver_mode" : "ip-only",
      "do_not_fail_on_forbidden_empty" : false
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)\
**Post date:** [April 29, 2024, 12:54pm UTC](https://forum.opensearch.org/t/opensearch-security-config-yml-config-ignored/19078/4 "2024-04-29T12:54:39Z")

</div>

@Mercurochrome7 you are welcome!

To apply changes you will need to follow the instructions here:

[Applying changes to configuration files - OpenSearch Documentation](https://opensearch.org/docs/latest/security/configuration/security-admin/)

the command sample:

`./securityadmin.sh -f /usr/share/opensearch/config/opensearch-security/config.yml -icl -nhnv -cert ../../../config/kirk.pem -cacert ../../../config/root-ca.pem -key ../../../config/kirk.key -t config`

Let me know if you have any questions or if something is unclear.

Best,  
mj

---

<div class="post-metadata">

**Author:** ![Mercurochrome7](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/mercurochrome7/32/7439_2.png) [@Mercurochrome7](https://forum.opensearch.org/u/Mercurochrome7)\
**Post date:** [April 29, 2024, 1:08pm UTC](https://forum.opensearch.org/t/opensearch-security-config-yml-config-ignored/19078/5 "2024-04-29T13:08:17Z")

</div>

Yes I tried too, but I’m not sure I understand well this step. Do I have to use those files anyway or do I need to use different cert if I want to use certificate from my ldap server ?

I get this message :

```auto
**************************************************************************
 **This tool will be deprecated in the next major release of OpenSearch**
 **https://github.com/opensearch-project/security/issues/1755**
 **************************************************************************
Security Admin v7
Will connect to xxxxxx:9200 ... done
Connected as "CN=kirk,OU=client,O=client,L=test,C=de"
ERR: "CN=kirk,OU=client,O=client,L=test,C=de" is not an admin user
Seems you use a client certificate but this one is not registered as admin_dn
Make sure opensearch.yml on all nodes contains:
plugins.security.authcz.admin_dn:
  - ""CN=kirk,OU=client,O=client,L=test,C=de""

```

And in my opensearch.yml I have the default security config but just changed “plugins.security.authcz.admin\_dn” with my information but don’t seems to be applied

---

<div class="post-metadata">

**Author:** ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)\
**Post date:** [April 29, 2024, 1:11pm UTC](https://forum.opensearch.org/t/opensearch-security-config-yml-config-ignored/19078/6 "2024-04-29T13:11:17Z")

</div>

Can you share your `opensearch.yml` file?

> [@Mercurochrome7](#):
>
> but just changed “plugins.security.authcz.admin\_dn” with my information but don’t seems to be applied

have you rebooted your nodes after updating your nodes’ config files??

Best,  
mj

---

<div class="post-metadata">

**Author:** ![Mercurochrome7](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/mercurochrome7/32/7439_2.png) [@Mercurochrome7](https://forum.opensearch.org/u/Mercurochrome7)\
**Post date:** [April 29, 2024, 1:20pm UTC](https://forum.opensearch.org/t/opensearch-security-config-yml-config-ignored/19078/7 "2024-04-29T13:20:04Z")

</div>

Here it is :

```auto
node.name: mynode
path.data: /share/data
path.repo: ["/share/repo"]
network.host: x.x.x.x
http.port: 9200
cluster.initial_cluster_manager_nodes: ["mycluster"]

plugins.security.ssl.transport.pemcert_filepath: esnode.pem
plugins.security.ssl.transport.pemkey_filepath: esnode-key.pem
plugins.security.ssl.transport.pemtrustedcas_filepath: root-ca.pem
plugins.security.ssl.transport.enforce_hostname_verification: true
plugins.security.ssl.http.enabled: true
plugins.security.ssl.http.pemcert_filepath: esnode.pem
plugins.security.ssl.http.pemkey_filepath: esnode-key.pem
plugins.security.ssl.http.pemtrustedcas_filepath: root-ca.pem
plugins.security.allow_unsafe_democertificates: true
plugins.security.allow_default_init_securityindex: true
plugins.security.authcz.admin_dn: 
  - "CN=admin,DC=mydomain,DC=com"

plugins.security.audit.type: debug
plugins.security.enable_snapshot_restore_privilege: true
plugins.security.check_snapshot_restore_write_privileges: true
plugins.security.restapi.roles_enabled: ["all_access", "security_rest_api_access"]
plugins.security.system_indices.enabled: true
plugins.security.system_indices.indices: [".plugins-ml-config", ".plugins-ml-connector", ".plugins-ml-model-group", ".plugins-ml-model", ".plugins-ml-task", ".plugins-ml-conversation-meta", ".plugins-ml-conversation-interactions", ".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opensearch-notifications-*", ".opensearch-notebooks", ".opensearch-observability", ".ql-datasources", ".opendistro-asynchronous-search-response*", ".replication-metadata-store", ".opensearch-knn-models", ".geospatial-ip2geo-data*"]
node.max_local_storage_nodes: 3

```

I I just tried to reboot but still the same.

---

<div class="post-metadata">

**Author:** ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)\
**Post date:** [April 29, 2024, 1:22pm UTC](https://forum.opensearch.org/t/opensearch-security-config-yml-config-ignored/19078/8 "2024-04-29T13:22:25Z")

</div>

> [@Mercurochrome7](#):
>
> ```auto
> plugins.security.authcz.admin_dn: 
> - "CN=admin,DC=mydomain,DC=com"
> 
> ```

> [@Mercurochrome7](#):
>
> ```auto
> Make sure opensearch.yml on all nodes contains:
> plugins.security.authcz.admin_dn:
> - ""CN=kirk,OU=client,O=client,L=test,C=de""
> 
> ```

You will need to add `- ""CN=kirk,OU=client,O=client,L=test,C=de""` to `plugins.security.authcz.admin_dn:` or user cert with `"CN=admin,DC=mydomain,DC=com"` with DN.

Best,  
mj

---

<div class="post-metadata">

**Author:** ![Mercurochrome7](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/mercurochrome7/32/7439_2.png) [@Mercurochrome7](https://forum.opensearch.org/u/Mercurochrome7)\
**Post date:** [April 29, 2024, 1:44pm UTC](https://forum.opensearch.org/t/opensearch-security-config-yml-config-ignored/19078/9 "2024-04-29T13:44:08Z")

</div>

Ooooh okay it’s simple as that… I think I’m confused between ldap certificates and default opensearch certicate so I tried to put my domain information instead of the kirk information.

Now I can see in logs that my ldap request is received. I still have an error but it looks fine : Empty file path for plugins.security.ssl.transport.truststore\_filepath. I will give it a try and be back if still need help or if it’s fine 🙂

Thanks a lot !!! 😃

---

<div class="post-metadata">

**Author:** ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)\
**Post date:** [April 29, 2024, 1:50pm UTC](https://forum.opensearch.org/t/opensearch-security-config-yml-config-ignored/19078/10 "2024-04-29T13:50:48Z")

</div>

It’s not a problem at all, glad to help and good luck with further set-up. If you get stuck, just share your config files, “the expected behaviour” and “the actual behaviour”.

best,  
mj

---

<div class="post-metadata">

**Author:** ![Mercurochrome7](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/mercurochrome7/32/7439_2.png) [@Mercurochrome7](https://forum.opensearch.org/u/Mercurochrome7)\
**Post date:** [April 29, 2024, 3:10pm UTC](https://forum.opensearch.org/t/opensearch-security-config-yml-config-ignored/19078/11 "2024-04-29T15:10:11Z")

</div>

Hello again !

I tried a few configuration with certificate.

First I got the “Empty file path for plugins.security.ssl.transport.truststore\_filepath” error. When I put this in the config file :

```auto
Empty file path for plugins.security.ssl.transport.truststore_filepath: mycert.jks
Empty file path for plugins.security.ssl.transport.truststore_password: mypassword

```

The error isn’t here anymore even if I’m not sure of the truststore password… I will need to check this point.

```auto
Now I have the error : "Cannot authenticate rest user xxx (or add roles) with authdomain internal/0 of [AuthDomain........., try next"
[...]
Check authdomain for rest ldap/1 or 2 in total
Unable to connect to ldapserver xxxx due to java.io.EOFException. Try next.
Unable to connect to any of those ldap servers [xxxx] due to java.io.EOFException

```

I have to go but will try again tomorrow 🙂

---

<div class="post-metadata">

**Author:** ![Mercurochrome7](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/mercurochrome7/32/7439_2.png) [@Mercurochrome7](https://forum.opensearch.org/u/Mercurochrome7)\
**Post date:** [April 30, 2024, 7:35am UTC](https://forum.opensearch.org/t/opensearch-security-config-yml-config-ignored/19078/12 "2024-04-30T07:35:48Z")

</div>

Hello,

It’s working !

My problem was that I tried to put my ldap certificate into the _/etc/opensearch/opensearch.yml_ config file instead of _opensearch-security/config.yml_ with :

```auto
...
authentication_backend:
  type: ldap
  config:
    pemtrustedcas_filepath: <location_of_my_ldap_certificate>
...

```

Thanks for helping me !!! 😃

Have a nice day !

---

<div class="post-metadata">

**Author:** ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)\
**Post date:** [April 30, 2024, 9:42am UTC](https://forum.opensearch.org/t/opensearch-security-config-yml-config-ignored/19078/13 "2024-04-30T09:42:56Z")

</div>

I am glad to hear that, Thanks for sharing your solution!

Best,  
mj