[BUG] Patch configuration security REST API does not work

[abbashus]

Describe the bug

I want to disable HTTPS for Basic HTTP authentication temporarily for testing.
I am trying to update the security configuration using REST API as mentioned in the documentation
https://opensearch.org/docs/security-plugin/access-control/api/#patch-configuration

curl -XPATCH "https://localhost:9200/_plugins/_security/api/securityconfig" -u 'admin:admin' --insecure -H 'Content-Type: application/json' -d'
> [
>   {
>     "op": "replace", "path": "/config/dynamic/authc/basic_internal_auth_domain/http_enabled", "value": "false"
>   }
> ]
> '

But get this error:

{"error":"Incorrect HTTP method for uri [/_plugins/_security/api/securityconfig] and method [PATCH], allowed: [GET]","status":405}

I am using OpenSearch v1.0.0 as mentioned in documentation

curl "https://localhost:9200" -u 'admin:admin' --insecure
{
  "name" : "client-7c96357b",
  "cluster_name" : "test-two-opensearch-cluster",
  "cluster_uuid" : "vHmGSPShSNGagsvJWHsATw",
  "version" : {
    "distribution" : "opensearch",
    "number" : "1.0.0",
    "build_type" : "tar",
    "build_hash" : "34550c5b17124ddc59458ef774f6b43a086522e3",
    "build_date" : "2021-07-02T23:22:21.383695Z",
    "build_snapshot" : false,
    "lucene_version" : "8.8.2",
    "minimum_wire_compatibility_version" : "6.8.0",
    "minimum_index_compatibility_version" : "6.0.0-beta1"
  },
  "tagline" : "The OpenSearch Project: https://opensearch.org/"
}

To Reproduce
Steps to reproduce the behavior:

1. Create a opensearch cluster using multi-node CDK
   Use following in cdk.context.json

{
  "cluster_stack_name": "test-one-opensearch-cluster",
  "network_stack_name": "test-one-network",
  "cidr": "10.9.0.0/21",
  "distribution": "tar",
  "keypair": "opensearch-cluster",
  "architecture": "x64",
  "url": "https://artifacts.opensearch.org/releases/bundle/opensearch/1.0.0/opensearch-1.0.0-linux-x64.tar.gz",
  "dashboards_url": "https://artifacts.opensearch.org/releases/bundle/opensearch-dashboards/1.0.0/opensearch-dashboards-1.0.0-linux-x64.tar.gz",
  "security": "enable"
}

2. Log into one of the client nodes
3. Try disabling http using above command

Expected behavior
I should be getting the following response as mentioned in doc

{
  "status": "OK",
  "message": "Resource updated."
}

And following config should be changed authc.basic_internal_auth_domain.http_enabled -> false when I do

curl -XGET "https://localhost:9200/_plugins/_security/api/securityconfig" -u 'admin:admin' --insecure

Plugins

#showing only for client node
curl -XGET "https://localhost:9200/cat/plugins" -u 'admin:admin' --insecure

client-21a69dab discovery-ec2                   1.0.0-SNAPSHOT
client-21a69dab opensearch-alerting             1.0.0.0
client-21a69dab opensearch-anomaly-detection    1.0.0.0
client-21a69dab opensearch-asynchronous-search  1.0.0.0
client-21a69dab opensearch-index-management     1.0.0.0
client-21a69dab opensearch-job-scheduler        1.0.0.0
client-21a69dab opensearch-knn                  1.0.0.0
client-21a69dab opensearch-notebooks            1.0.0.0
client-21a69dab opensearch-performance-analyzer 1.0.0.0
client-21a69dab opensearch-reports-scheduler    1.0.0.0
client-21a69dab opensearch-security             1.0.0.0
client-21a69dab opensearch-sql                  1.0.0.0

Screenshots
N/A

Host/Environment (please complete the following information):

• OS: Amazon Linux 2 AMI
• OpenSearch Version: 1.0.0

Additional context
N/A

[cliu123]

@abbashus Please try this one under opensearch-.../config directory and see if it works.

curl -XPATCH -k -i --cert kirk.pem --key kirk-key.pem https://localhost:9200/_plugins/_security/api/securityconfig -H'Content-Type: application/json' -d '
> [
>   {
>     "op": "replace", "path": "/config/dynamic/authc/basic_internal_auth_domain/http_enabled", "value": "false"
>   }
> ]
> '

[abbashus]

@cliu123 Same error

$ pwd
/opensearch-1.0.0/config

$ curl -XPATCH -k -i --cert kirk.pem --key kirk-key.pem https://localhost:9200/_plugins/_security/api/securityconfig -H'Content-Type: application/json' -d '
> [
>   {
>     "op": "replace", "path": "/config/dynamic/authc/basic_internal_auth_domain/http_enabled", "value": "false"
>   }
> ]
> '
HTTP/1.1 405 Method Not Allowed
Allow: GET
content-type: application/json; charset=UTF-8
content-length: 130

{"error":"Incorrect HTTP method for uri [/_plugins/_security/api/securityconfig] and method [PATCH], allowed: [GET]","status":405}

[abbashus]

@cliu123 Also , I am trying to disable HTTPS, is that the right setting /config/dynamic/authc/basic_internal_auth_domain/http_enabled ?

[abbashus]

Found: HTTPS can be disabled here plugins.security.ssl.http.enabled in config/opensearch.yml

[davidlago]

Looks like this was resolved, closing. @abbashus if you still feel like there are still unresolved issues please feel free to reopen. Thanks for the help!