mirror of
https://github.com/honeymoose/OpenSearch.git
synced 2025-02-07 05:28:34 +00:00
f2cbe20ea0
This is related to elastic/x-pack-elasticsearch#1217. This PR removes the default password of "changeme" from the reserved users. This PR adds special behavior for authenticating the reserved users. No ReservedRealm user can be authenticated until its password is set. The one exception to this is the elastic user. The elastic user can be authenticated with an empty password if the action is a rest request originating from localhost. In this scenario where an elastic user is authenticated with a default password, it will have metadata indicating that it is in setup mode. An elastic user in setup mode is only authorized to execute a change password request. Original commit: elastic/x-pack-elasticsearch@e1e101a237
74 lines
3.0 KiB
Plaintext
74 lines
3.0 KiB
Plaintext
[[migrate-tool]]
|
|
==== Migrating File-based Users and Roles to the Native Realm
|
|
|
|
From 5.0 onward, you should use the `native` realm to manage roles and local
|
|
users. To migrate existing file-based users and roles to the native realm, use
|
|
the `migrate` tool that's included with the X-Pack plugin.
|
|
|
|
NOTE: When migrating from Shield 2.x, the `migrate` tool should be run prior
|
|
to upgrading to ensure all roles can be migrated as some may be in a deprecated
|
|
format that {xpack} cannot read. The `migrate` tool is available in Shield
|
|
2.4.0 and higher.
|
|
|
|
The `migrate` tool loads the existing file-based users and roles and calls the
|
|
user and roles APIs to add them to the native realm. You can migrate all users
|
|
and roles, or specify the ones you want to migrate. Users and roles that
|
|
already exist in the `native` realm are not replaced or overridden. If
|
|
the names you specify with the `--users` and `--roles` options don't
|
|
exist in the `file` realm, they are skipped.
|
|
|
|
Run the migrate tool after you install the X-Pack plugin. For example:
|
|
|
|
[source, sh]
|
|
----------------------------------------------------------------------
|
|
$ bin/x-pack/migrate native -U http://localhost:9200 -u elastic -p x-pack-test-password
|
|
-n lee,foo -r role1,role2,role3,role4,foo
|
|
starting migration of users and roles...
|
|
importing users from [/home/es/config/shield/users]...
|
|
found existing users: [test_user, joe3, joe2]
|
|
migrating user [lee]
|
|
{"user":{"created":true}}
|
|
no user [foo] found, skipping
|
|
importing roles from [/home/es/config/shield/roles.yml]...
|
|
found existing roles: [marvel_user, role_query_fields, admin_role, role3, admin,
|
|
remote_marvel_agent, power_user, role_new_format_name_array, role_run_as,
|
|
logstash, role_fields, role_run_as1, role_new_format, kibana4_server, user,
|
|
transport_client, role1.ab, role_query]
|
|
migrating role [role1]
|
|
{"role":{"created":true}}
|
|
migrating role [role2]
|
|
{"role":{"created":true}}
|
|
role [role3] already exists, skipping
|
|
no role [foo] found, skipping
|
|
users and roles imported.
|
|
----------------------------------------------------------------------
|
|
|
|
[[migrate-tool-options]]
|
|
The `native` subcommand supports the following options:
|
|
|
|
`-U`, `--url`::
|
|
Endpoint URL of the Elasticsearch cluster to which you want to migrate the
|
|
file-based users and roles. Required.
|
|
|
|
`-u`, `--username`::
|
|
Username to use for authentication.
|
|
|
|
`-p`, `--password`::
|
|
Password to use for authentication.
|
|
|
|
`-n`, `--users`::
|
|
Comma-separated list of the users you want to migrate. If not specified, all
|
|
users are migrated.
|
|
|
|
`-r`, `--roles`::
|
|
Comma-separated list of the roles you want to migrate. If not specified, all
|
|
roles are migrated.
|
|
|
|
Additionally, the `-E` flag can be used to specify additional settings. For example
|
|
to specify a different configuration directory, the command would look like:
|
|
|
|
[source, sh]
|
|
----------------------------------------------------------------------
|
|
$ bin/x-pack/migrate native -U http://localhost:9200 -u elastic -p x-pack-test-password --path.conf /etc/elasticsearch
|
|
----------------------------------------------------------------------
|