SearchGuard 53.8 + Java 8

Search Guard
1

Elasticsearch version:
7.17.15 + SearchGuard 53.8.0
Server OS version:
Windows Server 2019 Standard 10.0.17763

Describe the issue:
SearchGuard fails on Elasticsearch startup when using Oracle Java 8 update 391 (in fact, also earlier minor releases). This should be supported according to Elasticsearch Java support matrix and SearchGuard documentation.

Steps to reproduce:
The steps are complex, I can provide an exact guide if needed. In short summary, I did this:

  1. Downloaded elasticsearch 7.17.15 + Search Guard 53.8
  2. Installed Search Guard 53.8 to elasticsearch 7.17.15
  3. Prepared config/elasticsearch.yml and plugins\search-guard-53.8.0\sgconfig configurations
  4. Generated certificates using Search Guard Offlien TLS Tool 1.9.1
  5. Started elasticsearch by running bin/elasticsearch.bat

Problem:
Elasticsearch failed to start with the following error:

java.lang.UnsupportedClassVersionError: org/apache/cxf/rs/security/jose/jwt/JwtException has been compiled by a more recent version of the Java Runtime (class file version 55.0), this version of the Java Runtime only recognizes class file versions up to 52.0
at java.lang.ClassLoader.defineClass1(Native Method)
at java.lang.ClassLoader.defineClass(Unknown Source)
at java.security.SecureClassLoader.defineClass(Unknown Source)
at java.net.URLClassLoader.defineClass(Unknown Source)
at java.net.URLClassLoader.access$100(Unknown Source)
at java.net.URLClassLoader$1.run(Unknown Source)
at java.net.URLClassLoader$1.run(Unknown Source)
at java.security.AccessController.doPrivileged(Native Method)
at java.net.URLClassLoader.findClass(Unknown Source)
at java.lang.ClassLoader.loadClass(Unknown Source)
at java.net.FactoryURLClassLoader.loadClass(Unknown Source)
at java.lang.ClassLoader.loadClass(Unknown Source)
at com.floragunn.searchguard.SearchGuardPlugin.createComponents(SearchGuardPlugin.java:840)
at org.elasticsearch.node.Node.lambda$new$17(Node.java:731)
at java.util.stream.ReferencePipeline$7$1.accept(Unknown Source)
at java.util.ArrayList$ArrayListSpliterator.forEachRemaining(Unknown Source)
at java.util.stream.AbstractPipeline.copyInto(Unknown Source)
at java.util.stream.AbstractPipeline.wrapAndCopyInto(Unknown Source)
at java.util.stream.ReduceOps$ReduceOp.evaluateSequential(Unknown Source)
at java.util.stream.AbstractPipeline.evaluate(Unknown Source)
at java.util.stream.ReferencePipeline.collect(Unknown Source)
at org.elasticsearch.node.Node.(Node.java:745)
at org.elasticsearch.node.Node.(Node.java:309)
at org.elasticsearch.bootstrap.Bootstrap$5.(Bootstrap.java:234)
at org.elasticsearch.bootstrap.Bootstrap.setup(Bootstrap.java:234)
at org.elasticsearch.bootstrap.Bootstrap.init(Bootstrap.java:434)
at org.elasticsearch.bootstrap.Elasticsearch.init(Elasticsearch.java:169)
at org.elasticsearch.bootstrap.Elasticsearch.execute(Elasticsearch.java:160)
at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:77)
at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:112)
at org.elasticsearch.cli.Command.main(Command.java:77)
at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:125)
at org.elasticsearch.bootstrap.Elasticsearch.main(Elasticsearch.java:80)

Expected behavior:
Successful start of elasticsearch

Additional data:

java -version
java version “1.8.0_391”
Java™ SE Runtime Environment (build 1.8.0_391-b13)
Java HotSpot™ 64-Bit Server VM (build 25.391-b13, mixed mode)

2

Hi @ondrokrc,

What is set as a JAVA_HOME path on your host server?
Please run echo $env:JAVA_HOME (cmd/powershell), and share the output.

Thanks,
Mantas

3

org/apache/cxf/rs/security/jose/jwt/JwtException was compiled for Java 11 (bytecode version 55), and indeed you started it with java 8 (bytecode version 52).

The failling class is from /usr/share/elasticsearch/plugins/search-guard-7/cxf-rt-rs-security-jose-4.0.2.jar.

And indeed cxf 4 is supposed to run in Java 11: Apache CXF -- CXF 4.0.0 Release Notes

But I wonder what’s the purpose of running on such an old version of Java.

4

Hello,
JAVA_HOME is C:\Program Files\Java\jre-1.8.
Full Java version info is written in Additional data section in my original post.

5

Hi @ondrokrc,

Could you test running it with the JDK that comes with elasticsearch, meaning removing the Java home path (or replacing it with full/path/to/elasticsearch-7.17.15/jdk).

thanks,
mj

6

It works all right with newer Java, my question is in particular about Java 8. We are stuck with it for unrelated reasons.
As @fbacchella explained, it seems that SearchGuard is not compatible with this version, so maybe it should be mentioned in the documentation? Currently it says:

  • We support the same JVM versions and vendors listed here: Support Matrix

And the support matrix says Java 8 is supported for this version of elastic.

7

Hi @ondrokrc,

I did some testing in my lab and found that you can use System variables - ES_JAVA_HOME : ...full\path\elasticsearch-7.17.15\jdk as a workaround.

Moreover, the ES issues a Warning when using ES with JDK 8:" with JDK 8 on Windows, Elasticsearch may be unable to derive correct".

Version tested:
ava version “1.8.0_391”
Java™ SE Runtime Environment (build 1.8.0_391-b13)

image

best,
mj

8

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.