OpenSearch Security Plugin
A robust security plugin for OpenSearch clusters that provides encryption, authentication, and access control features.
| Category | Identity & Access Management |
|---|---|
| Last Commit | 1 year ago |
| This page updated | a month ago |
| Pricing Details | Free and open-source. |
| Target Audience | Developers and administrators managing OpenSearch clusters. |
The OpenSearch Security plugin manages securing data and access in OpenSearch clusters through a robust set of features and configurations.
At its core, the Security plugin provides node-to-node encryption, HTTP basic authentication, and support for industry-standard authentication mechanisms such as Active Directory, LDAP, Kerberos, SAML, and OpenID Connect. This ensures that all traffic within the cluster is encrypted and that users can be authenticated using existing infrastructure or the internal user database.
The plugin implements role-based access control, allowing administrators to define roles that specify the actions users can perform, including data access, cluster settings modifications, and index write permissions. Additionally, it offers fine-grained security controls at the index, document, and field levels, enabling precise access restrictions.
Operational considerations include the need to configure the opensearch.yml and opensearch_dashboards.yml files to set up TLS encryption, authentication backends, and other security settings. The plugin also requires a full cluster restart when enabling or disabling it, as this affects node communication.
Key technical details include the use of demo certificates for initial setup, which must be replaced with custom certificates for production environments. The securityadmin script is crucial for applying changes to the security configuration after the initial setup. Authentication caching is also configurable, with a default timeout of 60 minutes, which can be adjusted or disabled as needed.
Limitations include the potential performance impact of enabling detailed audit logging and the necessity to protect sensitive information in the configuration index if the Security plugin is disabled or removed. Moreover, OpenSearch Dashboards can only run against a secure cluster, so disabling the Security plugin requires uninstalling the OpenSearch Dashboards plugin as well.