Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Additing error details and escape method to nodes_dn #7681 #7703

Merged
merged 3 commits into from
Jul 24, 2024
Merged

Additing error details and escape method to nodes_dn #7681 #7703

Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
f9a5301
Additing error details and escape method to nodes_dn #7681
AntonEliatra Jul 15, 2024
4c5386e
Update security-settings.md
AntonEliatra Jul 15, 2024
390dcbb
Apply suggestions from code review
Naarcha-AWS Jul 24, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion _install-and-configure/configuring-opensearch/security-settings.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ The following sections describe security-related settings in `opensearch.yml`. T

The Security plugin supports the following common settings:

- `plugins.security.nodes_dn` (Static): Specifies a list of distinguished names (DNs) that denote the other nodes in the cluster. This setting supports wildcards and regular expressions. The list of DNs are also read from the security index **in addition** to the YAML configuration when `plugins.security.nodes_dn_dynamic_config_enabled` is `true`.
- `plugins.security.nodes_dn` (Static): Specifies a list of distinguished names (DNs) that denote the other nodes in the cluster. This setting supports wildcards and regular expressions. The list of DNs are also read from the security index **in addition** to the YAML configuration when `plugins.security.nodes_dn_dynamic_config_enabled` is `true`. If this setting is not configured correctly, the cluster will fail to form as the nodes will not be able to trust each other and will result in error: `Transport client authentication no longer supported`.
Naarcha-AWS marked this conversation as resolved.
Show resolved Hide resolved

- `plugins.security.nodes_dn_dynamic_config_enabled` (Static): Relevant for `cross_cluster` use cases where there is a need to manage the allow listed `nodes_dn` without having to restart the nodes every time a new `cross_cluster` remote is configured.
Setting `nodes_dn_dynamic_config_enabled` to `true` enables **super-admin callable** Distinguished Names APIs, which provide means to update or retrieve `nodes_dn` dynamically. This setting only has effect if `plugins.security.cert.intercluster_request_evaluator_class` is not set. Default is `false`.
Expand Down Expand Up @@ -353,6 +353,7 @@ The Security plugin supports the following transport layer security settings:
plugins.security.nodes_dn:
- "CN=*.example.com, OU=SSL, O=Test, L=Test, C=DE"
- "CN=node.other.com, OU=SSL, O=Test, L=Test, C=DE"
- "CN=node.example.com, OU=SSL\, Inc., L=Test, C=DE" # escape additional comma with `\`
plugins.security.authcz.admin_dn:
- CN=kirk,OU=client,O=client,L=test, C=de
plugins.security.roles_mapping_resolution: MAPPING_ONLY
Expand Down
Loading