What is the bug?
User object deserialization prevents Rolling upgrade from version 1.x to 2.2.1

How can one reproduce the bug?
Steps to reproduce the behavior:

1. Setup a fresh 1.2.4 cluster with security enabled. Users, Roles, Role mapping, etc. are all maintained in the internal security index, i.e. no integration with external LDAP for authn and authz.
2. Upgrade one of the master nodes to version 2.2.1 using the tarball based installation.

The upgraded node starts up and no specific error is seen in the logs. But any API call to the upgraded cluster fails with a permission denied issue even though the user has appropriate permission to the requested resource/API.

What is the expected behavior?
The upgraded 2.2.1 node should be able to accept API requests for the existing users without any permission errors.

What is your host/environment?

• OS: OEL 7

Do you have any screenshots?
NA

Do you have any additional context?

1. rolling upgrade from latest version of OpenSearch 1.x (i.e. 1.3.5) fails as well.
2. discussed in more detail here: https://forum.opensearch.org/t/rolling-upgrade-from-version-1-x-to-2-2-1-does-not-work/11042
3. fix this by reverting back Replace opensearch class names with opendistro class names during serialization and restore them back during deserialization #1278 partially, i.e. at least the deserialization part in Base64Helper.java to get this rolling upgrade to work.