Username input in search-guard-flx-elasticsearch-plugin-2.0.0-rc-es-8.12.2.zip

Search Guard
1

If you think it is a bug report or you have a technical issue, please answer the following questions. For general questions, you can delete these questions.

**Elasticsearch version:8.12.2

**Server OS version:centos 7
Search guard version
search-guard-flx-elasticsearch-plugin-2.0.0-rc-es-8.12.2.zip

Error Message
Successfully connected to cluster elasticsearch (localhost) as user CN=Server,
java.lang.IllegalArgumentException: Illegal character in fragment at index 36: /searchguard/internal_users/…username…encripted
at java.base/java.net.URI.create(URI.java:932)
at org.apache.http.client.methods.HttpGet.(HttpGet.java:66)
at com.floragunn.searchguard.sgctl.client.SearchGuardRestClient.get(SearchGuardRestClient.java:177)
at com.floragunn.searchguard.sgctl.client.SearchGuardRestClient.getUser(SearchGuardRestClient.java:100)
at com.floragunn.searchguard.sgctl.commands.user.UpdateUser.lambda$call$1(UpdateUser.java:78)
at com.floragunn.searchguard.sgctl.commands.BaseCommand.retryOnConcurrencyConflict(BaseCommand.java:125)
at com.floragunn.searchguard.sgctl.commands.user.UpdateUser.call(UpdateUser.java:76)
at com.floragunn.searchguard.sgctl.commands.user.UpdateUser.call(UpdateUser.java:46)
at picocli.CommandLine.executeUserObject(CommandLine.java:2041)
at picocli.CommandLine.access$1500(CommandLine.java:148)
at picocli.CommandLine$RunLast.executeUserObjectOfLastSubcommandWithSameParent(CommandLine.java:2461)
at picocli.CommandLine$RunLast.handle(CommandLine.java:2453)
at picocli.CommandLine$RunLast.handle(CommandLine.java:2415)
at picocli.CommandLine$AbstractParseResultHandler.execute(CommandLine.java:2273)
at picocli.CommandLine$RunLast.execute(CommandLine.java:2417)
at picocli.CommandLine.execute(CommandLine.java:2170)
at com.floragunn.searchguard.sgctl.SgctlTool.exec(SgctlTool.java:63)
at com.floragunn.searchguard.sgctl.SgctlTool.main(SgctlTool.java:58)
Caused by: java.net.URISyntaxException: Illegal character in fragment at index 36: /searchguard/internal_users/…
at java.base/java.net.URI$Parser.fail(URI.java:2995)
at java.base/java.net.URI$Parser.checkChars(URI.java:3166)
at java.base/java.net.URI$Parser.parse(URI.java:3210)
at java.base/java.net.URI.(URI.java:645)
at java.base/java.net.URI.create(URI.java:930)
… 17 more
Failed to update user. The installation was aborted.
Below username is works in elasticseach 6 but throws error in elasticsearch 8.12.2
pongo#~!$*()_-+=.?/pongo#~!$*()-+=.?/pongo#~`!$*()-+=.?/db18

Cause for this error and how to resolve it.
And what is official documentation says about username and password

Below is yml
path.data: /var/lib/elasticsearch
path.logs: /var/log/elasticsearch
xpack.security.enabled: false
xpack.security.enrollment.enabled: true
xpack.security.http.ssl:
enabled: false
keystore.path: certs/http.p12
xpack.security.transport.ssl:
enabled: true
verification_mode: certificate
keystore.path: certs/transport.p12
truststore.path: certs/transport.p12
cluster.initial_master_nodes:

  • 192.168.28.38
    http.host: 0.0.0.0
    cluster.name: elasticsearch
    node.name: localhost.localdomain
    network.host: localhost,ip
    http.port: 9200
    searchguard.enterprise_modules_enabled: false
    thread_pool.write.queue_size: 1000
    discovery.seed_hosts: ip
    http.max_content_length: 500mb
    indices.query.bool.max_clause_count: 200000
    thread_pool.search.size: 50
    searchguard.ssl.transport.pemkey_filepath: key.pem
    searchguard.ssl.transport.pemcert_filepath: cert.pem
    searchguard.ssl.transport.pemtrustedcas_filepath: cacert.pem
    searchguard.ssl.transport.enforce_hostname_verification: false
    searchguard.ssl.transport.enabled_protocols:
  • TLSv1.2
    searchguard.ssl.http.pemkey_filepath: key.pem
    searchguard.ssl.http.pemcert_filepath: cert.pem
    searchguard.ssl.http.pemtrustedcas_filepath: cacert.pem
    searchguard.ssl.http.enabled: true
    searchguard.ssl.http.enabled_protocols:
  • TLSv1.2
    searchguard.authcz.admin_dn:
  • CN=Server,XXXXXX
    searchguard.nodes_dn:
    XXXXXXX
    searchguard.check_snapshot_restore_write_privileges: true
    searchguard.restapi.roles_enabled:
  • SGS_ALL_ACCESS
2

Hi @Varinder1,

I have noticed that you are using the RC version, the GA is now available and I would strongly suggest using GA, please see more here:

How did you deploy your internal user, and how did you hash passwords?

Thanks,
Mantas

3

image
image1398×253 22 KB

I am using elasticsearch 8. I am using latest version of searchguard.2.0.0

4

@mantas Am I missing something, please suggest . Can i use **pongo#~!$*()_-+=.?/pongo#~!$()-+=.?/pongo#~`!$()-+=.?/db18 as a username without any issue.

5

@Varinder1, yes that is the correct way to get the plugin.

Should look something like:

search-guard-flx-elasticsearch-plugin-2.0.0-es-8.12.2.zip (with out rc)

6

how do you create your internal users?

Could you please elaborate on the below:

Thanks,
Mantas

7

I have tried the GA version it also fails
“${INSTALL_PATH}”/bin/elasticsearch-plugin install -b file:“${SCRIPT_PATH}/sources/search-guard-flx-elasticsearch-plugin-2.0.0-es-8.12.2.zip” >>“${INSTALL_LOG}”

I did not do anything special to create internal user

8

I also want to edit this post , can any body help me with this .

9

Can anybody brief the discussion?
It’s getting tough to understand cause the coding is just too much and messy.

10

I was using pongo#~!$*()_-+=.?/pongo#~ !$() -+=.?/pongo#~`!$() -+=.?/db18 as user name it is working fine in ES6 but throwing error in ES8.
Thats it.