During packaged installations we will be generating and storing a new setting, named autoconfiguration.password_hash in the elasticsearch.keystore. This will be the -to be- password of the elastic user and its value in the keystore will be salted and hashed using the default hashing algorithm of elasticsearch.

We should

• Detect that there is an autoconfiguration.password_hash setting in the keystore
• Create the document for the elastic built-in user in the security index and set its password to the value it read from autoconfiguration.password_hash
• Allow the users to authenticate locally to the node with the actual password that is hashed and stored in autoconfiguration.password_hash even before the password is "promoted" to the security index.
• Strive to have a deterministic behavior that is as simple as possible and easy to describe/argue about. i.e. we should
  • try to prevent race conditions from different nodes attempting to set the password in the security index
  • ensure that once a successful authentication happens with a given password, this password will not change without explicit user interaction.
• not override a user added password ( i.e. on restarts )

Out of scope / handled in other work items

• We can assume the password is already generated and hashed/stored in the keystore