Hello,
I tried to register a new client (who connects to ES with a jks).
The CNAME included in the jks is CN=portail-flotte,OU=Technical team,O=Norauto,L=Lille,C=FR
I succeeded in registering this CNAME on our Qualification Cluster but didn’t suceedded in on the PRODUCTION cluster
The error encountered when running sg_admin is : “FAIL: Configuration for ‘internalusers’ failed because of MapperParsingException[failed to parse [CN=portail-flotte,OU=Technical team,O=Norauto,L=Lille,C=FR]]; nested: IllegalArgumentException[unknown property [hash]];”
Here is the execution trace:
Will connect to pp3sbodbrco01:9300 … done
Contacting elasticsearch cluster ‘elasticsearch’ and wait for YELLOW clusterstate …
Clustername: elasticsearch_cluster_rco_prod
Clusterstate: GREEN
Number of nodes: 3
Number of data nodes: 3
searchguard index already exists, so we do not need to create one.
Populate config from /usr/share/elasticsearch/plugins/search-guard-2/sgconfig/
Will update ‘config’ with /usr/share/elasticsearch/plugins/search-guard-2/sgconfig/sg_config.yml
SUCC: Configuration for ‘config’ created or updated
Will update ‘roles’ with /usr/share/elasticsearch/plugins/search-guard-2/sgconfig/sg_roles.yml
SUCC: Configuration for ‘roles’ created or updated
Will update ‘rolesmapping’ with /usr/share/elasticsearch/plugins/search-guard-2/sgconfig/sg_roles_mapping.yml
SUCC: Configuration for ‘rolesmapping’ created or updated
Will update ‘internalusers’ with /usr/share/elasticsearch/plugins/search-guard-2/sgconfig/sg_internal_users.yml
FAIL: Configuration for ‘internalusers’ failed because of MapperParsingException[failed to parse [CN=portail-flotte,OU=Technical team,O=Norauto,L=Lille,C=FR]]; nested: IllegalArgumentException[unknown property [hash]];
Will update ‘actiongroups’ with /usr/share/elasticsearch/plugins/search-guard-2/sgconfig/sg_action_groups.yml
SUCC: Configuration for ‘actiongroups’ created or updated
Done with failures
The sg_internalusers.yml file contains :
CN=portail-flotte,OU=Technical team,O=Norauto,L=Lille,C=FR:
hash: “_transport_only”
When protecting with “”, errors disapears but when connecting, user CNAME is unknown.
After looking at the searchguard index mapping, I found that there were several definitions for this CNAME.
I think this could be the root cause of the mapperparsing exception:
"internalusers": {
"properties": {
"CN="portail-flotte",OU="Technical team",O=Norauto,L=Lille,C=FR": {
"properties": {
"hash": {
"type": "string"
}
}
},
"CN="portail-flotte",OU=Technical team,O=Norauto,L=Lille,C=FR": {
"properties": {
"hash": {
"type": "string"
}
}
},
"CN=admin,OU=Technical team,O=Norauto,L=Lille,C=FR": {
"properties": {
"hash": {
"type": "string"
}
}
},
"CN=portail-flotte,OU=Client App,O=Norauto,L=Lille,C=FR": {
"properties": {
"hash": {
"type": "string"
}
}
},
"CN=portail-flotte,OU=Technical team,O=Norauto,L=Lille,C=FR": {
"type": "string"
},
"CN=portailflotte,OU=Technical team,O=Norauto,L=Lille,C=FR": {
"properties": {
"hash": {
"type": "string"
}
}
},
"CN=rcoapp,OU=CLient App,O=Norauto,L=Lille,C=FR": {
"properties": {
"hash": {
"type": "string"
}
}
},
"CN=rcoetl,OU=Client ETL,O=Norauto,L=Lille,C=FR": {
"properties": {
"hash": {
"type": "string"
}
}
},
"CN=rcoreadonly,OU=Client RO,O=Norauto,L=Lille,C=FR": {
"properties": {
"hash": {
"type": "string"
}
}
},
"CN=rcosupport,OU=Client Support,O=Norauto,L=Lille,C=FR": {
"properties": {
"hash": {
"type": "string"
}
}
},
"admin": {
"properties": {
"hash": {
"type": "string"
}
}
},
"hash": {
"type": "string"
},
"portail-flotte": {
"properties": {
"hash": {
"type": "string"
}
}
},
"rcoapp": {
"properties": {
"hash": {
"type": "string"
}
}
},
"rcoetl": {
"properties": {
"hash": {
"type": "string"
}
}
},
"rcoreadonly": {
"properties": {
"hash": {
"type": "string"
}
}
},
"rcosupport": {
"properties": {
"hash": {
"type": "string"
}
}
}
}
},
In quality cluster the CNAME is defined as :
CN=portail-flotte,OU=Client App,O=Norauto,L=Lille,C=FR:
hash: “_transport_only”
AND IT WORKS;
Does anyone already encountered the same issue as mine ?
Is there anybody who could help me to diagnose this issue, please ?
PS: the production cluster contains already several users in effective use.
Thanks a lot for your help