Environment: RHEL 5.11, JDK 1.8.0_65
I setup new ES-7.8 cluster with 2 hosts, 2 master and 2 data nodes on each host
I also installed ROR 1.20.0 (readonlyrest-1.20.0_es7.8.0.jar) on one master node
My readonlyrest.yaml is as follows:
readonlyrest:
enable: true
response_if_req_forbidden: Access denied by ROR
access_control_rules:
- name: "Allow read/write all indexes for the vadim user only"
type: allow
groups: ["team1"]
actions: ["cluster:monitor/*","indices:data/read*","indices:data/write*","indices:admin/create"]
indices: ["*"]
users:
- username: vadim
auth_key_sha256: ab...yz
groups: ["team1"]
For the pair vadim:secpwd I generated the values like abc…xyz for auth_key_sha256 and MN…RS for Base64
Restarted the the master node with ROR successfully.
Checked cluster health with request to not ROR protected node - showed 4 nodes joined and health=GREEN
Requested ROR protected node on Linux command line
curl -XGET http://host:port/_cat/indices?v -H ‘Authorization: Basic MN…RS’
Output
{“error”:{“root cause” … “reason”:“Access denied by ROR” , node…, cluster… “due_to” [“OPERATION_NOT_ALLOWED”]… “status”:401}
ES log file:
…
…xyz_node started
…Loading ReadonlyREST settings from index failed: cannot find index
…Loading ReadonlyREST from file: /path_to_file/readonlyrest.yml
…xyz_node ADDING BLOCK: {name: ‘Allow read/write all indexes for the vadim user only’, policy: ALLOW, rules: [groups,actions,indices]
…xyz_node Readonly REST plugin core was loaded …
…xyz_node FPORBIDDEN by default req={ ID:…, TYP:GetSettingsRequest, CGR:N/A, USR:vadim (attempted), BRS:true, KDX:null, ACT:indices:monitor/settings/get, OA:…, XFF:null, DA:…, IDX:, MET:GET, PTH: /_cut/indices, CNT:<N/A>, HDR:Accept=/, Authorization=, Host=some_host/some_port, User-Agent=curl…OpenSSL/…, content-length=0, HIS:[Allow read/write all indexes for the vadim user only-> RULES:[groups->false], RESOLVED:[indices=]]}
The same readonlyrest.yml configuration worked successfully without issues on the older ES-5.6.3 with ROR 1.16.15 (readonlyrest-1.16.15_es5.6.30.jar)
Any help on this issue would be appreciated
Thanks