-
Notifications
You must be signed in to change notification settings - Fork 25.6k
Closed
Closed
Copy link
Labels
:Distributed Indexing/DistributedA catch all label for anything in the Distributed Indexing Area. Please avoid if you can.A catch all label for anything in the Distributed Indexing Area. Please avoid if you can.:Security/AuthenticationLogging in, Usernames/passwords, Realms (Native/LDAP/AD/SAML/PKI/etc)Logging in, Usernames/passwords, Realms (Native/LDAP/AD/SAML/PKI/etc)>bugv6.3.0
Description
This seems to be caused by the change to made security disabled by default on trial licenses.
If a node does not set xpack.security.enabled in the config, and tries to join a cluster, it doesn't know what type of license its supposed to be using, and seems to be acting as if its on a trial license with security disabled.
This means that SecurityServerTransportInterceptor.interceptSender().AsyncSender.sendRequest() does not intercept the request, and does not set the system-user context for outgoing requests.
Since the requests do not have an authentication header attached to their context, the remote node rejects the initial handshake, and the new node cannot join.
Metadata
Metadata
Labels
:Distributed Indexing/DistributedA catch all label for anything in the Distributed Indexing Area. Please avoid if you can.A catch all label for anything in the Distributed Indexing Area. Please avoid if you can.:Security/AuthenticationLogging in, Usernames/passwords, Realms (Native/LDAP/AD/SAML/PKI/etc)Logging in, Usernames/passwords, Realms (Native/LDAP/AD/SAML/PKI/etc)>bugv6.3.0