No authorisation header is asked while consuming appsearch APIs

[Nishad_Angre]

Hi all,

I have configured the appsearch and Elasticsearch using dockers on a Linux box.
While I have have added data into the index using the latest webcrawler method, I could see that the APIs which require authorization as per the documentation from Elastic; in reality they work without that as well.

I tried to consume search API and click API.
Both require Authorization header with basic auth key.
But they return data without auth also.

Please help me understand whether I am doing anything wrong here??

PS: I am using version 7.11.0 for Elasticsearch and Appsearch with Nginx webserver and docker 19.03.13

[Lyudmila_Fokina]

Starting with basics... Do you have Security enabled: xpack.security.enabled (Security settings in Elasticsearch | Elasticsearch Reference [7.11] | Elastic)?

[Nishad_Angre]

Hi @Lyudmila_Fokina,

This helped me. but now I am stuck with another issue.
After I enabled the xpack.security.enabled: true in elasticsearch.yml, I had to enable and add below as well.

    xpack.security.transport.ssl.enabled: true
    xpack.security.transport.ssl.verification_mode: certificate
    xpack.security.transport.ssl.keystore.path: certs/elastic-certificates.p12
    xpack.security.transport.ssl.truststore.path: certs/elastic-certificates.p12

But now i facing issues with elastic APIs.
API consumed: /_cat/nodes?v=true&pretty
Response returned

    {

        "error": {

            "root_cause": [

                {

                    "type": "security_exception",

                    "reason": "missing authentication credentials for REST request [/_cat/nodes?v=true&pretty]",

                    "header": {

                        "WWW-Authenticate": "Basic realm=\"security\" charset=\"UTF-8\""

                    }

                }

            ],

            "type": "security_exception",

            "reason": "missing authentication credentials for REST request [/_cat/nodes?v=true&pretty]",

            "header": {

                "WWW-Authenticate": "Basic realm=\"security\" charset=\"UTF-8\""

            }

        },

        "status": 401

    }

Kindly help me understand and resolve this hurdle.

[orhantoy]

@Nishad_Angre In a local setup it should be enough with

xpack.security.enabled: true
xpack.security.authc.api_key.enabled: true

And then when you request something like /_cat/nodes?v=true&pretty you would need to provide the credentials to Elasticsearch.
Perhaps this guide can be of help: link.