OpenSearch自定义配置未生效：新用户无法登录且配置未同步至控制台

我是OpenSearch新手，正尝试对其进行自定义配置，首先希望使用OpenID Connect（OIDC）替代内部用户数据库来设置不同的认证方式。作为第一步，我复制了config.yml、internal_users.yml等安全配置文件进行自定义修改：在config.yml中注释了所有其他authc选项，仅保留basic_internal_auth_domain；同时在internal_users.yml中添加了一个带密码的新用户customadmin。随后我通过docker-compose.yml将自定义配置文件挂载到OpenSearch节点，执行docker-compose up启动集群后，OpenSearch Dashboard正常运行，但无法使用新增的用户凭据登录；且使用管理员凭据登录后，在安全设置中仍能看到已在挂载的config.yml中移除的认证方式。我已通过容器内的bash shell确认配置文件已正确挂载，想请教我的自定义操作是否存在错误？

以下是修改的文件片段：

config.yml #

config:
  dynamic:
    http:
      anonymous_auth_enabled: false
     authc:
      basic_internal_auth_domain:
        description: "Authenticate via HTTP Basic against internal users database"
        http_enabled: true
        transport_enabled: true
        order: 0
        http_authenticator:
          type: basic
          challenge: true
        authentication_backend:
          type: intern

internal_users.yml #

# Define your internal users here

## Demo users

customadmin:
  hash: "$2a$12$wzKZMYOQZ0KE8WsgfXqQxuvflKlzmSTprlPZrAaJDcXnhjgmrVZNm"
  reserved: false
  backend_roles:
  - "admin"
  description: `"Demo admin user for customization purpose"

...

docker-compose.yaml #

services:
  opensearch-node1: # This is also the hostname of the container within the Docker network (i.e. https://opensearch-node1/)
    image: opensearchproject/opensearch:2.11.1 # Use the 2.11.1 version of OpenSearch for all nodes
    container_name: opensearch-node1
    environment:
      - cluster.name=opensearch-cluster # Name the cluster
      - node.name=opensearch-node1 # Name the node that will run in this container
      - discovery.seed_hosts=opensearch-node1,opensearch-node2 # Nodes to look for when discovering the cluster
      - cluster.initial_cluster_manager_nodes=opensearch-node1,opensearch-node2 # Nodes eligibile to serve as cluster manager
      - bootstrap.memory_lock=true # Disable JVM heap memory swapping
      - "OPENSEARCH_JAVA_OPTS=-Xms512m -Xmx512m" # Set min and max JVM heap sizes to at least 50% of system RAM
    ulimits:
      memlock:
        soft: -1 # Set memlock to unlimited (no soft or hard limit)
        hard: -1
      nofile:
        soft: 65536 # Maximum number of open files for the opensearch user - set to at least 65536
        hard: 65536
    volumes:
      - opensearch-data1:/usr/share/opensearch/data # Creates volume called opensearch-data1 and mounts it to the container
      - ./node-configs/opensearch-security/config.yml:/usr/share/opensearch/config/opensearch-security/config.yml # Mount the custom OpenSearch Security configuration file for AuthN and AuthZ
      - ./node-configs/opensearch-security/internal_users.yml:/usr/share/opensearch/config/opensearch-security/internal_users.yml # Mount the custom OpenSearch Security internal users configuration file
    ports:
      - 9200:9200 # REST API
      - 9600:9600 # Performance Analyzer
    networks:
      - opensearch-net # All of the containers will join the same Docker bridge network


# same with node 2 

你的操作存在几处关键错误，逐一修正即可解决问题：

1. config.yml语法错误 #

• 缩进问题：authc的缩进比同级的http少了一个空格，YAML对缩进敏感，这会导致配置无法被正确解析。修正后authc应与http对齐：

  config:
    dynamic:
      http:
        anonymous_auth_enabled: false
      authc:
        basic_internal_auth_domain:
          # ... 其余配置
  

• 认证后端类型错误：authentication_backend的type应为internal，而非intern，拼写错误会导致无法关联内部用户数据库。

2. internal_users.yml语法错误 #

customadmin的description字段存在引号错误：description: "Demo admin user for customization purpose"` 多了一个反引号，正确写法应为：

description: "Demo admin user for customization purpose"

语法错误会导致用户配置无法被加载。

3. 未应用安全配置到集群 #

OpenSearch Security的配置默认存储在集群状态中，而非直接读取本地文件。即使你挂载了自定义配置文件，也需要执行securityadmin.sh脚本将本地配置推送至集群，否则集群仍会使用旧的配置。

执行步骤：

1. 进入opensearch-node1容器：

   docker exec -it opensearch-node1 bash
   

2. 运行securityadmin脚本（默认使用admin证书，若未修改证书路径可直接执行）：

   ./plugins/opensearch-security/tools/securityadmin.sh -cd /usr/share/opensearch/config/opensearch-security/ -icl -nhnv -cacert /usr/share/opensearch/config/root-ca.pem -cert /usr/share/opensearch/config/admin.pem -key /usr/share/opensearch/config/admin-key.pem
   

4. 确保所有节点挂载相同配置 #

你的docker-compose.yaml仅为node1挂载了自定义配置，node2也需要挂载相同的config.yml和internal_users.yml，否则集群节点间配置不一致会导致认证逻辑异常。

修正后node2的volumes部分应与node1一致：

volumes:
  - opensearch-data2:/usr/share/opensearch/data
  - ./node-configs/opensearch-security/config.yml:/usr/share/opensearch/config/opensearch-security/config.yml
  - ./node-configs/opensearch-security/internal_users.yml:/usr/share/opensearch/config/opensearch-security/internal_users.yml

完成以上修正后，重启集群，即可正常使用customadmin用户登录，且安全设置中会显示你配置的唯一认证方式。

内容的提问来源于stack exchange，提问作者Akila Induranga