Deprecate setup-passwords tool by jkakavas · Pull Request #76902 · elastic/elasticsearch

jkakavas · 2021-08-24T20:39:58Z

With Security ON by default project where the elastic user
password is auto-generated, we have decided to deprecate the
setup-passwords tool and consider removing it in a future version.
Users will get a password for the elastic built-in user when the
node starts for the first time and they can also use the newly
introduced elastisearch-reset-elastic-password tool to set or
reset that password. With credentials for the elastic user
available, the password for the rest of the built-in users can be
set using the Change Password API, or via Kibana.

With Security ON by default project where the `elastic` user password is auto-generated, we have decided to deprecate the setup-passwords tool and consider removing it in a future version. Users will get a password for the `elastic` built-in user when the node starts for the first time and they can also use the newly introduced elastisearch-reset-elastic-password tool to set or reset that password. With credentials for the elastic user available, the password for the rest of the built-in users can be set using the Change Password API, or via Kibana.

elasticmachine · 2021-08-24T20:40:02Z

Pinging @elastic/es-security (Team:Security)

jkakavas · 2021-08-24T20:41:08Z

I am uncertain of the "in favor of " and "replaced by" wording as the new tool has a subset of the old functionality, happy to get suggestions!

lockewritesdocs

Provided some suggested changes, but looks good overall.

...ty/src/main/java/org/elasticsearch/xpack/security/authc/esnative/tool/SetupPasswordTool.java

Co-authored-by: Adam Locke <adam.locke@elastic.co>

tvernum · 2021-08-30T08:13:21Z

docs/reference/commands/setup-passwords.asciidoc

 [[setup-passwords]]
 == elasticsearch-setup-passwords

+deprecated[7.16,"Replaced by <<reset-elastic-password,`elasticsearch-reset-elastic-password`>>."]


Do we want to deprecate in 7.16 now?
We haven't backported elasticsearch-reset-elastic-password to 7.x yet have we?

It seems premature to indicate that it's deprecated as of 7.16 when we aren't ready to actually deprecate it in 7.x

I don't think this is the ideal terminology (though I don't have a better set of words).

There's 3 points:

In 8.0 it's "replaced" mostly by security on by default so this utility isn't needed anymore.

For some scenarios, elasticsearch-reset-elastic-password is a replacement, but not in most

For non-elastic users, the replacement is either automated setup (kibana and fleet) or manual use of the change password API

I don't know how we capture that, but I worry that simply pointing to elasticsearch-reset-elastic-password will confuse some people.

@tvernum, I appreciate your insights, as always. I'd like to avoid version-specific language in this message if possible to avoid pinning to a particular version if we need to change when we're deprecating the tool. Perhaps we can cover the two main scenarios that this tool was used for (changing passwords for built-in users and created users) and offer users the alternative options.

The elasticsearch-setup-passwords tool is deprecated and will be removed in a future release. To manually reset the password for the elastic user, use the 'elasticsearch-reset-elastic-password' tool. To change passwords for other users, use either Kibana or the Elasticsearch change passwords API.

Thanks for the suggestions both, I'll add Adam's text here and remove the version

tvernum · 2021-08-30T08:20:56Z

...ty/src/main/java/org/elasticsearch/xpack/security/authc/esnative/tool/SetupPasswordTool.java

            if (shouldPrompt) {
+                terminal.println("******************************************************************************");
+                terminal.println("Note: The 'elasticsearch-setup-passwords' tool has been deprecated");
+                terminal.println("      and might be removed in a future release.");


I don't love "might". I think we should say "will be" or "is intended to be"

tvernum · 2021-08-30T08:21:40Z

...ty/src/main/java/org/elasticsearch/xpack/security/authc/esnative/tool/SetupPasswordTool.java

+                terminal.println("******************************************************************************");
+                terminal.println("Note: The 'elasticsearch-setup-passwords' tool has been deprecated");
+                terminal.println("      and might be removed in a future release.");
+                terminal.println("      Use the 'elasticsearch-reset-elastic-password' tool instead. ");


See my comment above - not every use of setup-passwords can switch to "elasticsearch-reset-elastic-password" and I worry about confusion.

…swords-tool

lockewritesdocs · 2021-10-04T16:25:22Z

@elasticmachine run elasticsearch-ci/docs

lockewritesdocs

One minor nit, but LGTM otherwise 👍

lockewritesdocs · 2021-10-04T18:24:33Z

...ty/src/main/java/org/elasticsearch/xpack/security/authc/esnative/tool/SetupPasswordTool.java

                    terminal.errorPrintln("   This tool used the keystore at " + KeyStoreWrapper.keystorePath(env.configFile()));
                    terminal.errorPrintln("");
+                    terminal.errorPrintln(
+                        "You can use `elasticsearch-reset-elastic-password` CLI tool to reset the password of the '" + elasticUser


Suggested change

"You can use `elasticsearch-reset-elastic-password` CLI tool to reset the password of the '" + elasticUser

"You can use the `elasticsearch-reset-elastic-password` CLI tool to reset the password of the '" + elasticUser

lockewritesdocs · 2021-10-04T18:25:58Z

@elasticmachine update branch

jrodewig · 2021-10-04T21:50:20Z

docs/reference/commands/setup-passwords.asciidoc

 [[setup-passwords]]
 == elasticsearch-setup-passwords

+deprecated[8.0, "The `elasticsearch-setup-passwords` tool is deprecated and will be removed in a future release. To manually reset the password for the `elastic` user, use the <<reset-elastic-password,`elasticsearch-reset-elastic-password` tool>>. To change passwords for other users, use either {kib} or the {es} change passwords API."]


Drive-by comment: We should also add a deprecation notice to the 8.0 breaking changes.

There isn't a deprecations section yet, but we can use the 7.15 one as a template.

@lockewritesdocs Do you mind assisting and ensuring this gets added?

We'll also want to remove the 7.16 label if the elasticsearch-reset-elastic-password tool won't be in 7.x.

Thanks @jrodewig! I created #78793 to add the deprecation notice to the 8.0 migration guide.

jrodewig

Left a comment. We still need a deprecation notice in the 8.0 breaking changes.

tvernum

LGTM (with @lockewritesdocs's suggested change)

lockewritesdocs · 2021-10-07T11:22:26Z

@jkakavas, should we remove the 7.16 label from this PR if we're not deprecating in that release?

jkakavas · 2021-10-21T10:20:21Z

@elasticmachine update branch

Adam addressed the comments

With Security ON by default project where the `elastic` user password is auto-generated, we have decided to deprecate the setup-passwords tool and consider removing it in a future version. Users will get a password for the `elastic` built-in user when the node starts for the first time and they can also use the newly introduced elastisearch-reset-elastic-password tool to set or reset that password. With credentials for the elastic user available, the password for the rest of the built-in users can be set using the Change Password API, or via Kibana.

jkakavas added >deprecation :Security/Authentication Logging in, Usernames/passwords, Realms (Native/LDAP/AD/SAML/PKI/etc) v8.0.0 v7.16.0 labels Aug 24, 2021

jkakavas requested review from lockewritesdocs and tvernum August 24, 2021 20:39

elasticmachine added the Team:Security Meta label for security team label Aug 24, 2021

lockewritesdocs reviewed Aug 26, 2021

View reviewed changes

Apply suggestions from code review

6c05202

Co-authored-by: Adam Locke <adam.locke@elastic.co>

tvernum reviewed Aug 30, 2021

View reviewed changes

jkakavas added 2 commits September 1, 2021 22:13

feedback

d72c5f6

Merge remote-tracking branch 'origin/master' into deprecate-setup-pas…

0ab6b41

…swords-tool

jkakavas requested review from lockewritesdocs and tvernum September 27, 2021 06:46

jkakavas mentioned this pull request Sep 28, 2021

[Error]: 'failed to authenticate user [elastic]' showed up while setting up 8.0 self-managed environment. #78359

Closed

Fix formatting for deprecation notice

3e950b9

lockewritesdocs approved these changes Oct 4, 2021

View reviewed changes

Merge branch 'master' into deprecate-setup-passwords-tool

b038bce

jrodewig reviewed Oct 4, 2021

View reviewed changes

jrodewig previously requested changes Oct 4, 2021

View reviewed changes

lockewritesdocs mentioned this pull request Oct 6, 2021

[DOCS] Add deprecation notice for reset password tool #78793

Merged

tvernum approved these changes Oct 7, 2021

View reviewed changes

lockewritesdocs removed the v7.16.0 label Oct 13, 2021

Merge branch 'master' into deprecate-setup-passwords-tool

176c86a

jkakavas added 3 commits October 21, 2021 13:34

fix compilation

5e688c8

rename reference

8e7fd2f

fix wording

0d6fe9d

jkakavas merged commit e288a1a into elastic:master Oct 21, 2021

jakelandis added v8.0.0-beta1 and removed v8.0.0 labels Oct 27, 2021

	"You can use `elasticsearch-reset-elastic-password` CLI tool to reset the password of the '" + elasticUser
	"You can use the `elasticsearch-reset-elastic-password` CLI tool to reset the password of the '" + elasticUser

Conversation

jkakavas commented Aug 24, 2021

Uh oh!

elasticmachine commented Aug 24, 2021

Uh oh!

jkakavas commented Aug 24, 2021

Uh oh!

lockewritesdocs left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lockewritesdocs commented Oct 4, 2021

Uh oh!

lockewritesdocs left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

lockewritesdocs commented Oct 4, 2021

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jrodewig left a comment

Choose a reason for hiding this comment

Uh oh!

tvernum left a comment

Choose a reason for hiding this comment

Uh oh!

lockewritesdocs commented Oct 7, 2021

Uh oh!

jkakavas commented Oct 21, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants