Deprecate setup-passwords tool #76902

jkakavas · 2021-08-24T20:39:58Z

With Security ON by default project where the elastic user
password is auto-generated, we have decided to deprecate the
setup-passwords tool and consider removing it in a future version.
Users will get a password for the elastic built-in user when the
node starts for the first time and they can also use the newly
introduced elastisearch-reset-elastic-password tool to set or
reset that password. With credentials for the elastic user
available, the password for the rest of the built-in users can be
set using the Change Password API, or via Kibana.

With Security ON by default project where the `elastic` user password is auto-generated, we have decided to deprecate the setup-passwords tool and consider removing it in a future version. Users will get a password for the `elastic` built-in user when the node starts for the first time and they can also use the newly introduced elastisearch-reset-elastic-password tool to set or reset that password. With credentials for the elastic user available, the password for the rest of the built-in users can be set using the Change Password API, or via Kibana.

elasticmachine · 2021-08-24T20:40:02Z

Pinging @elastic/es-security (Team:Security)

jkakavas · 2021-08-24T20:41:08Z

I am uncertain of the "in favor of " and "replaced by" wording as the new tool has a subset of the old functionality, happy to get suggestions!

lockewritesdocs

Provided some suggested changes, but looks good overall.

...ty/src/main/java/org/elasticsearch/xpack/security/authc/esnative/tool/SetupPasswordTool.java

Co-authored-by: Adam Locke <adam.locke@elastic.co>

tvernum · 2021-08-30T08:13:21Z

docs/reference/commands/setup-passwords.asciidoc

@@ -3,6 +3,8 @@
 [[setup-passwords]]
 == elasticsearch-setup-passwords

+deprecated[7.16,"Replaced by <<reset-elastic-password,`elasticsearch-reset-elastic-password`>>."]


Do we want to deprecate in 7.16 now?
We haven't backported elasticsearch-reset-elastic-password to 7.x yet have we?

It seems premature to indicate that it's deprecated as of 7.16 when we aren't ready to actually deprecate it in 7.x

I don't think this is the ideal terminology (though I don't have a better set of words).

There's 3 points:

In 8.0 it's "replaced" mostly by security on by default so this utility isn't needed anymore.

For some scenarios, elasticsearch-reset-elastic-password is a replacement, but not in most

For non-elastic users, the replacement is either automated setup (kibana and fleet) or manual use of the change password API

I don't know how we capture that, but I worry that simply pointing to elasticsearch-reset-elastic-password will confuse some people.

@tvernum, I appreciate your insights, as always. I'd like to avoid version-specific language in this message if possible to avoid pinning to a particular version if we need to change when we're deprecating the tool. Perhaps we can cover the two main scenarios that this tool was used for (changing passwords for built-in users and created users) and offer users the alternative options.

The elasticsearch-setup-passwords tool is deprecated and will be removed in a future release. To manually reset the password for the elastic user, use the 'elasticsearch-reset-elastic-password' tool. To change passwords for other users, use either Kibana or the Elasticsearch change passwords API.

Thanks for the suggestions both, I'll add Adam's text here and remove the version

tvernum · 2021-08-30T08:20:56Z

...ty/src/main/java/org/elasticsearch/xpack/security/authc/esnative/tool/SetupPasswordTool.java

@@ -134,6 +138,12 @@ protected void execute(Terminal terminal, OptionSet options, Environment env) th
            checkClusterHealth(terminal);

            if (shouldPrompt) {
+                terminal.println("******************************************************************************");
+                terminal.println("Note: The 'elasticsearch-setup-passwords' tool has been deprecated");
+                terminal.println("      and might be removed in a future release.");


I don't love "might". I think we should say "will be" or "is intended to be"

tvernum · 2021-08-30T08:21:40Z

...ty/src/main/java/org/elasticsearch/xpack/security/authc/esnative/tool/SetupPasswordTool.java

+                terminal.println("******************************************************************************");
+                terminal.println("Note: The 'elasticsearch-setup-passwords' tool has been deprecated");
+                terminal.println("      and might be removed in a future release.");
+                terminal.println("      Use the 'elasticsearch-reset-elastic-password' tool instead. ");


See my comment above - not every use of setup-passwords can switch to "elasticsearch-reset-elastic-password" and I worry about confusion.

…swords-tool

lockewritesdocs · 2021-10-04T16:25:22Z

@elasticmachine run elasticsearch-ci/docs

lockewritesdocs

One minor nit, but LGTM otherwise 👍

lockewritesdocs · 2021-10-04T18:24:33Z

...ty/src/main/java/org/elasticsearch/xpack/security/authc/esnative/tool/SetupPasswordTool.java

@@ -314,6 +328,11 @@ void checkElasticKeystorePasswordValid(Terminal terminal, Environment env) throw
                    terminal.errorPrintln(" * Your elasticsearch node is running against a different keystore");
                    terminal.errorPrintln("   This tool used the keystore at " + KeyStoreWrapper.keystorePath(env.configFile()));
                    terminal.errorPrintln("");
+                    terminal.errorPrintln(
+                        "You can use `elasticsearch-reset-elastic-password` CLI tool to reset the password of the '" + elasticUser


Suggested change

"You can use `elasticsearch-reset-elastic-password` CLI tool to reset the password of the '" + elasticUser

"You can use the `elasticsearch-reset-elastic-password` CLI tool to reset the password of the '" + elasticUser

lockewritesdocs · 2021-10-04T18:25:58Z

@elasticmachine update branch

jrodewig · 2021-10-04T21:50:20Z

docs/reference/commands/setup-passwords.asciidoc

@@ -3,6 +3,8 @@
 [[setup-passwords]]
 == elasticsearch-setup-passwords

+deprecated[8.0, "The `elasticsearch-setup-passwords` tool is deprecated and will be removed in a future release. To manually reset the password for the `elastic` user, use the <<reset-elastic-password,`elasticsearch-reset-elastic-password` tool>>. To change passwords for other users, use either {kib} or the {es} change passwords API."]


Drive-by comment: We should also add a deprecation notice to the 8.0 breaking changes.

There isn't a deprecations section yet, but we can use the 7.15 one as a template.

@lockewritesdocs Do you mind assisting and ensuring this gets added?

We'll also want to remove the 7.16 label if the elasticsearch-reset-elastic-password tool won't be in 7.x.

Thanks @jrodewig! I created #78793 to add the deprecation notice to the 8.0 migration guide.

jrodewig

Left a comment. We still need a deprecation notice in the 8.0 breaking changes.

tvernum

LGTM (with @lockewritesdocs's suggested change)

lockewritesdocs · 2021-10-07T11:22:26Z

@jkakavas, should we remove the 7.16 label from this PR if we're not deprecating in that release?

jkakavas · 2021-10-21T10:20:21Z

@elasticmachine update branch

Adam addressed the comments

With Security ON by default project where the `elastic` user password is auto-generated, we have decided to deprecate the setup-passwords tool and consider removing it in a future version. Users will get a password for the `elastic` built-in user when the node starts for the first time and they can also use the newly introduced elastisearch-reset-elastic-password tool to set or reset that password. With credentials for the elastic user available, the password for the rest of the built-in users can be set using the Change Password API, or via Kibana.

jkakavas added >deprecation :Security/Authentication Logging in, Usernames/passwords, Realms (Native/LDAP/AD/SAML/PKI/etc) v8.0.0 v7.16.0 labels Aug 24, 2021

jkakavas requested review from tvernum and lockewritesdocs August 24, 2021 20:39

elasticmachine added the Team:Security Meta label for security team label Aug 24, 2021

lockewritesdocs reviewed Aug 26, 2021

View reviewed changes

Apply suggestions from code review

6c05202

Co-authored-by: Adam Locke <adam.locke@elastic.co>

tvernum reviewed Aug 30, 2021

View reviewed changes

jkakavas added 2 commits September 1, 2021 22:13

feedback

d72c5f6

Merge remote-tracking branch 'origin/master' into deprecate-setup-pas…

0ab6b41

…swords-tool

jkakavas requested review from tvernum and lockewritesdocs September 27, 2021 06:46

jkakavas mentioned this pull request Sep 28, 2021

[Error]: 'failed to authenticate user [elastic]' showed up while setting up 8.0 self-managed environment. #78359

Closed

Fix formatting for deprecation notice

3e950b9

lockewritesdocs approved these changes Oct 4, 2021

View reviewed changes

Merge branch 'master' into deprecate-setup-passwords-tool

b038bce

jrodewig reviewed Oct 4, 2021

View reviewed changes

jrodewig previously requested changes Oct 4, 2021

View reviewed changes

lockewritesdocs mentioned this pull request Oct 6, 2021

[DOCS] Add deprecation notice for reset password tool #78793

Merged

tvernum approved these changes Oct 7, 2021

View reviewed changes

lockewritesdocs removed the v7.16.0 label Oct 13, 2021

Merge branch 'master' into deprecate-setup-passwords-tool

176c86a

jkakavas added 3 commits October 21, 2021 13:34

fix compilation

5e688c8

rename reference

8e7fd2f

fix wording

0d6fe9d

jkakavas merged commit e288a1a into elastic:master Oct 21, 2021

jakelandis added v8.0.0-beta1 and removed v8.0.0 labels Oct 27, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Deprecate setup-passwords tool #76902

Deprecate setup-passwords tool #76902

jkakavas commented Aug 24, 2021

elasticmachine commented Aug 24, 2021

jkakavas commented Aug 24, 2021

lockewritesdocs left a comment

tvernum Aug 30, 2021

tvernum Aug 30, 2021

lockewritesdocs Aug 30, 2021

jkakavas Sep 1, 2021

tvernum Aug 30, 2021

tvernum Aug 30, 2021

lockewritesdocs commented Oct 4, 2021

lockewritesdocs left a comment

lockewritesdocs Oct 4, 2021

lockewritesdocs commented Oct 4, 2021

jrodewig Oct 4, 2021

lockewritesdocs Oct 6, 2021

jrodewig left a comment

tvernum left a comment

lockewritesdocs commented Oct 7, 2021

jkakavas commented Oct 21, 2021

	"You can use `elasticsearch-reset-elastic-password` CLI tool to reset the password of the '" + elasticUser
	"You can use the `elasticsearch-reset-elastic-password` CLI tool to reset the password of the '" + elasticUser

Deprecate setup-passwords tool #76902

Deprecate setup-passwords tool #76902

Conversation

jkakavas commented Aug 24, 2021

elasticmachine commented Aug 24, 2021

jkakavas commented Aug 24, 2021

lockewritesdocs left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

lockewritesdocs commented Oct 4, 2021

lockewritesdocs left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

lockewritesdocs commented Oct 4, 2021

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jrodewig left a comment

Choose a reason for hiding this comment

tvernum left a comment

Choose a reason for hiding this comment

lockewritesdocs commented Oct 7, 2021

jkakavas commented Oct 21, 2021