This task is to outline and coordinate enabling the OpenSearch Security Plugin on beta-logs.
Phase 1:
Keep the user-facing workflow the same and enable the backend baseline security requirements.
- Provision intra-node PKI
- Provision super admin certificate on singleton host or provision utility to request one
- Configure security plugin anonymous login user/role/policy
- Keep "preview" user login working via http-basic-auth
- Enable the security plugin
- Provision securityadmin.sh singleton apply utility and on-change automation
Phase 2:
Change the user-facing workflow to use security plugin internal authentication/authorization and remove http-basic-auth.
- Provision "preview" user in security plugin
- Configure policy for "preview" user - likely allow all
- Disable http-basic-auth on apache proxy
Phase 3:
Change the user-facing workflow to use the security plugin authenticating using LDAP.
- Retain "preview" user for legacy purposes
- Configure roles/policies for LDAP users
- Configure security plugin to do authentication requests against LDAP
Phase 4:
Gain experience reducing user permissions to an appropriate set.
- Disable access to admin functionality for regular and "preview" users:
- Stack Management
- Sensitive verbs and endpoints
- ILM (may need to reinstall the plugin)
- Provision roles/policies for operators and assign permissions