In the administration of Easysearch clusters, there are scenarios where resetting user passwords becomes necessary—whether due to forgotten credentials or security compliance requirements.

Using Security API for Password Resets

According to the Easysearch security documentation, user creation is handled through the following API endpoint:

PUT _security/user/<username>
{
  "password": "new_password",
  "roles": ["role1", "role2"],
  "external_roles": ["external_role1", "external_role2"],
  "attributes": {
    "attr1": "value1",
    "attr2": "value2"
  }
}

The same API endpoint can be utilized to reset existing user passwords by providing the updated password while maintaining other user properties:

PUT _security/user/<username>
{
  "password": "updated_password",
  "roles": ["role1", "role2"],
  "external_roles": ["external_role1", "external_role2"],
  "attributes": {
    "attr1": "value1",
    "attr2": "value2"
  }
}

Resetting Passwords for API-Created Users

Let's create a sample user named 'demo_user' and verify access:

PUT _security/user/demo_user
{
  "password": "initial_password",
  "roles": ["viewer", "analyst"],
  "external_roles": ["report_group"],
  "attributes": {
    "department": "engineering",
    "location": "data_center_1"
  }
}

Now, reset the pasword for this user:

PUT _security/user/demo_user
{
  "password": "secure_new_password",
  "roles": ["viewer", "analyst"],
  "external_roles": ["report_group"],
  "attributes": {
    "department": "engineering",
    "location": "data_center_1"
  }
}

Verify the updated credentials by attempting to access the cluster with the new password.

Handling Configuration File-Based Users

When users are defined in the configuration file (users.yml), resetting their passwords requires additional considerations. Consider the following configuration:

## System-defined users
operator:
  hash: "$2y$12$ZNfKKCeeRQXOWX27W50tbu0Tq4NT4ADdCQOBoZzokI1zR8ZEUWm4W"
  reserved: true
  roles:
    - "readall_and_monitor"

analyst:
  hash: "$2y$12$m4/eSiDlzRII87vNeKwzteEHGpgpbdMr5tRvOfve/xIbEYdC4bU7a"
  reserved: false
  roles:
    - "readall_and_monitor"

The hash values are generated using the password hashing utility:

bin/hash_password.sh -p "<plaintext_password>"

After defining these users, test their access to verify proper configuration.

Special Considerations for Reserved Users

When attempting to reset passwords for users defined in the configuration file, you may encounter different results:

• For non-reserved users (like 'analyst'), the passwrod reset via API will succeed
• For reserved users (like 'operator'), the password reset will fail when using standard admin credentials

The failure occurs because reserved users have elevated privileges that cannot be modified by standard administrators. To reset passwords for reserved users, you need to use management certificates with higher privileges.

When initializing an Easysearch cluster using the initialization script, management certificates are generated in the config directory:

• admin.crt - The management certificate
• admin.key - The private key for the management certificate

Using these certificates, you can successfully reset the password for the reserved 'operator' user:

curl -X PUT "https://localhost:9200/_security/user/operator" \
  -H "Content-Type: application/json" \
  --cacert config/certs/ca/ca.crt \
  --cert config/certs/admin.crt \
  --key config/certs/admin.key \
  -d'
{
  "password": "new_secure_password",
  "roles": ["readall_and_monitor"],
  "reserved": true
}
'

After successful password reset, verify access with the new credentials.