Can I get what
_system internal user can do when
xpack-security is enabled? Also, can I modify what it can do or give it extra permissions?
_system is an internal user that cannot be modified, and cannot be used to authenticate to the cluster.
It sounds like you are asking the wrong question here. Whatever issue you are running into, trying to change
_system isn't the answer. Perhaps if you explain the problem you're facing we can help solve that.
Thank you for your answer;
Actually, I was trying to install opendistro alerting plugin on my cluster.
I works out of the box if xpack security is disabled, but once I enable it, I get this error:
[security_exception] action [indices:data/read/search] is unauthorized for user [_system]
Is there any work around?
I don't think so. OpenDistro plugins aren't designed to work with the Elasticsearch default distribution, and it looks like their alerting plugin cannot be used when our security is enabled.