From a2341f880f11a7bd6a85282deec86e15956fdeda Mon Sep 17 00:00:00 2001 From: Abdullah <89297042+AzazelSensei@users.noreply.github.com> Date: Mon, 31 Aug 2026 22:52:53 +0000 Subject: [PATCH] Document demo installer password checks vs REST API settings The demo script runs before opensearch.yml is loaded, so plugins.security.restapi.password_min_length and password_validation_regex do not apply to OPENSEARCH_INITIAL_ADMIN_PASSWORD. Signed-off-by: Abdullah <89297042+AzazelSensei@users.noreply.github.com> --- DEVELOPER_GUIDE.md | 2 ++ .../security/tools/democonfig/SecuritySettingsConfigurer.java | 2 ++ 2 files changed, 4 insertions(+) diff --git a/DEVELOPER_GUIDE.md b/DEVELOPER_GUIDE.md index 938d347d5d..ac221cf255 100644 --- a/DEVELOPER_GUIDE.md +++ b/DEVELOPER_GUIDE.md @@ -174,6 +174,8 @@ export OPENSEARCH_INITIAL_ADMIN_PASSWORD= **_Note:_** If no password is supplied, the installation will fail. The password supplied will also be tested for its strength and will be blocked if it is too simple. There is an option to skip this password validation by passing the `-t` option to the installation script. However, this should only be used for test environments. +The demo installer does not read `plugins.security.restapi.password_min_length` or `plugins.security.restapi.password_validation_regex` from `opensearch.yml`. Those settings apply later, when you create or update users through the REST API or OpenSearch Dashboards. The installer runs before the node loads cluster settings, so it uses its own checks: at least 8 characters, one uppercase letter, one lowercase letter, one digit, one special character, and a strong zxcvbn score. Changing the REST API password settings does not change what the demo script accepts for `OPENSEARCH_INITIAL_ADMIN_PASSWORD`. + ### Executing the demo installation script diff --git a/src/main/java/org/opensearch/security/tools/democonfig/SecuritySettingsConfigurer.java b/src/main/java/org/opensearch/security/tools/democonfig/SecuritySettingsConfigurer.java index 866a30253e..6697695b48 100644 --- a/src/main/java/org/opensearch/security/tools/democonfig/SecuritySettingsConfigurer.java +++ b/src/main/java/org/opensearch/security/tools/democonfig/SecuritySettingsConfigurer.java @@ -191,6 +191,8 @@ void updateAdminPassword() throws IOException { } try { + // Demo-only rules. Not plugins.security.restapi.password_* from opensearch.yml — + // this installer runs before those cluster settings are loaded. final PasswordValidator passwordValidator = PasswordValidator.of( Settings.builder() .put(