opensearch-project/security

View on GitHub

🔐 Secure your cluster with TLS, numerous authentication backends, data masking, audit logging as well as role-based access control on indices, documents, and fields

Stars: 252
Forks: 395
Open beginner issues: 2
Indexed issues: 328
Avg merge: 1d 11h
Merged PRs (30d): 76

Dominant language: Java
License: Apache-2.0
Last GitHub push: Sep 17, 2026
Latest indexed: Sep 19, 2026
Contributing guide: Contributing guide
Code of conduct: Code of conduct
Beginner labels: help wanted good first issue

Beginner friendly Everything

Open All

328 open issues indexed

typeField extraction returns the document's value as the resource type, so a provider whose discriminator differs from its type name is unresolvable Open

bug untriaged

Difficulty 4/5 3-5 days Newbie friendliness 68/100

opensearch-project/security#6532 · Opened Sep 17, 2026
Shrink and ultimately remove ResourceSharingClient Open

enhancement untriaged

Difficulty 5/5 Over a week Newbie friendliness 30/100

opensearch-project/security#6531 · Opened Sep 17, 2026
Deprecate filter_by_backend_roles across resource-sharing plugins, target removal in 4.0 Open

enhancement untriaged

Difficulty 5/5 Over a week Newbie friendliness 28/100

opensearch-project/security#6530 · 2 comments · Opened Sep 17, 2026
Resolve the gating resource id through a provider hook Open

enhancement untriaged

Difficulty 5/5 Over a week Newbie friendliness 45/100

opensearch-project/security#6529 · Opened Sep 17, 2026
Evaluate requests that carry multiple resource ids Open

enhancement untriaged

Difficulty 4/5 3-5 days Newbie friendliness 68/100

opensearch-project/security#6528 · Opened Sep 17, 2026
Allow a provider to declare that a document in a protected index is not a resource Open

enhancement untriaged

Difficulty 4/5 3-5 days Newbie friendliness 55/100

opensearch-project/security#6527 · 1 comment · Opened Sep 17, 2026
Migrate API: allow a document filter so a subset of an index can be migrated Open

enhancement untriaged

Difficulty 4/5 3-5 days Newbie friendliness 55/100

opensearch-project/security#6526 · 1 comment · Opened Sep 17, 2026
Migrate API: inherit created_by and share_with from the parent sharing record Open

enhancement untriaged

Difficulty 4/5 3-5 days Newbie friendliness 65/100

opensearch-project/security#6525 · 1 comment · Opened Sep 17, 2026
workspacesField() defaults to a field no resource index maps Open

bug untriaged

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

opensearch-project/security#6524 · Opened Sep 17, 2026
Parent-container access is not applied on the resource listing and search read paths Open

bug untriaged

Difficulty 4/5 3-5 days Newbie friendliness 48/100

opensearch-project/security#6523 · 1 comment · Opened Sep 17, 2026
Remove the deprecated plugins.security.experimental.resource_sharing.* settings in 4.0 Open

breaking maintenance untriaged

Difficulty 4/5 3-5 days Newbie friendliness 68/100

opensearch-project/security#6514 · Opened Sep 16, 2026
[BUG] Uncaught FipsUnapprovedOperationError in PBKDF2PasswordHasher causes JVM crash on short Basic Auth passwords Open

bug good first issue triaged

Difficulty 4/5 3-5 days Newbie friendliness 55/100

opensearch-project/security#6504 · 2 comments · Opened Sep 14, 2026
[FEATURE] Record attempted principal separately in failed-login audit events Open

enhancement triaged

Difficulty 5/5 Over a week Newbie friendliness 38/100

opensearch-project/security#6495 · Opened Sep 11, 2026
Deprecate FQCN-based inter-cluster request evaluator setting Open

triaged

Difficulty 5/5 Over a week Newbie friendliness 35/100

opensearch-project/security#6479 · Opened Sep 7, 2026
[BUG] DLS accepts `now` / date math in role definition but rejects at query time Open

bug triaged

Difficulty 4/5 3-5 days Newbie friendliness 42/100

opensearch-project/security#6470 · 2 comments · Opened Sep 4, 2026
Add security permissions for DSL query-executor actions (dsl/execute, dsl/validate) Open

triaged

Difficulty 3/5 1-2 days Newbie friendliness 62/100

opensearch-project/security#6468 · 1 comment · Opened Sep 4, 2026
[BUG] CI: `automatic-merges` fails on every PR Open

bug triaged

Difficulty 2/5 1-3 hours Newbie friendliness 70/100

opensearch-project/security#6455 · 2 comments · Opened Sep 2, 2026
[BUG] multi-node gRPC tests are flaky Open

bug triaged

Difficulty 4/5 3-5 days Newbie friendliness 52/100

opensearch-project/security#6431 · 1 comment · Opened Aug 25, 2026
improve test coverage for TLQ-in-DLS Open

triaged

Difficulty 3/5 1-2 days Newbie friendliness 52/100

opensearch-project/security#6413 · Opened Aug 20, 2026
[BUG] Potential regression in cross cluster searches from 3.7 -> 2.19 Open

bug triaged

Difficulty 4/5 3-5 days Newbie friendliness 45/100

opensearch-project/security#6399 · 3 comments · Opened Aug 13, 2026
[RELEASE] Release version 3.9.0 Open

triaged

Difficulty 5/5 Over a week Newbie friendliness 20/100

opensearch-project/security#6377 · Opened Aug 8, 2026
[BUG] Security config updates cause valid credentials to be rejected, tripping ip_rate_limiting and locking out all clients on a shared source IP Open

bug untriaged

Difficulty 4/5 3-5 days Newbie friendliness 48/100

opensearch-project/security#6371 · 7 comments · 3 reactions · Opened Aug 5, 2026
[FEATURE] Please provide a way to add "Strict-Transport-Security" header nativly. Open

enhancement triaged

Difficulty 4/5 3-5 days Newbie friendliness 45/100

opensearch-project/security#6345 · 1 comment · Opened Jul 29, 2026
Add pagination support to Security configuration collection APIs Open

triaged

Difficulty 5/5 Over a week Newbie friendliness 35/100

opensearch-project/security#6339 · 3 comments · Opened Jul 28, 2026
Support asynchronous Security configuration APIs with wait_for_completion Open

triaged

opensearch-project/security#6337 · 1 comment · 1 assignee · Opened Jul 28, 2026
[BUG] Monitor actions (indices:monitor/stats, cluster:monitor/health) denied under securitytenant scope when * resolves to tenant .kibana_* indices — regression from #6202 Open

triaged

Difficulty 4/5 3-5 days Newbie friendliness 52/100

opensearch-project/security#6327 · 2 comments · Opened Jul 27, 2026
DLS now keyword issue Open

bug duplicate triaged

Difficulty 4/5 3-5 days Newbie friendliness 48/100

opensearch-project/security#6505 · 2 comments · Opened Jul 21, 2026
[FEATURE] migrate DLS variable substitution away from text-based substitution Open

enhancement triaged

Difficulty 5/5 Over a week Newbie friendliness 35/100

opensearch-project/security#6311 · 2 comments · Opened Jul 17, 2026
add more javadoc coverage Open

triaged

Difficulty 5/5 Over a week Newbie friendliness 35/100

opensearch-project/security#6309 · Opened Jul 15, 2026
[AUTOCUT] Integration Test Failed for security-2.19.6 Open

autocut triaged v2.19.6

Difficulty 4/5 3-5 days Newbie friendliness 35/100

opensearch-project/security#6270 · 3 comments · Opened Jun 30, 2026
[RELEASE] Release version 3.8.0 Open

triaged v3.8.0

Difficulty 5/5 Over a week Newbie friendliness 20/100

opensearch-project/security#6269 · Opened Jun 30, 2026
[FEATURE] preserving original client identity in certificate based authentication where a load balancer does initial SSL handshake Open

enhancement triaged

Difficulty 5/5 Over a week Newbie friendliness 35/100

opensearch-project/security#6268 · 5 comments · Opened Jun 29, 2026
Security REST API error responses are inconsistent: `{status: <name>, message}` vs `{status: <int>, error}` Open

triaged

Difficulty 5/5 Over a week Newbie friendliness 35/100

opensearch-project/security#6251 · 2 comments · Opened Jun 25, 2026
[BUG] missing test coverage for new evaluator V4 Open

bug triaged

Difficulty 4/5 3-5 days Newbie friendliness 45/100

opensearch-project/security#6247 · Opened Jun 24, 2026
[BUG] Setting incorrect dynamic nodes_dn can break inter-node trust, making the cluster completely unavailable Open

bug triaged

Difficulty 4/5 3-5 days Newbie friendliness 48/100

opensearch-project/security#6245 · 3 comments · 1 reaction · Opened Jun 23, 2026
[BUG] FAILED_LOGIN audit event missing for failed Basic Auth in multi-auth setup (SAML + Basic) Open

bug triaged

Difficulty 4/5 3-5 days Newbie friendliness 52/100

opensearch-project/security#6221 · 1 comment · Opened Jun 17, 2026
[BUG] kibana_user role is too permissive Open

bug triaged

Difficulty 4/5 3-5 days Newbie friendliness 48/100

opensearch-project/security#6206 · 2 comments · Opened Jun 5, 2026
[BUG] Can't create roles with "restapi:admin/*" permissions via the REST API Open

bug triaged

Difficulty 4/5 3-5 days Newbie friendliness 42/100

opensearch-project/security#6178 · 2 comments · 1 reaction · Opened Jun 2, 2026
[FEATURE] Add OctetSequenceKey support in JWT test setup Open

enhancement triaged

Difficulty 3/5 1-2 days Newbie friendliness 52/100

opensearch-project/security#6155 · 2 comments · Opened May 21, 2026
Enforce custom compliance salt in OpenSearch 4.0 Open

4.0 enhancement triaged

Difficulty 4/5 3-5 days Newbie friendliness 55/100

opensearch-project/security#6124 · Opened Apr 29, 2026
Backend workspace collaborator management via security plugin resource sharing Open

enhancement triaged

Difficulty 5/5 Over a week Newbie friendliness 35/100

opensearch-project/security#6119 · 14 comments · 2 reactions · Opened Apr 27, 2026
[BUG] Running securityadmin.sh removes all configured users Open

bug triaged

Difficulty 4/5 3-5 days Newbie friendliness 45/100

opensearch-project/security#6109 · 1 comment · Opened Apr 23, 2026
[BUG] warning about default FLS salt on startup Open

bug triaged

Difficulty 2/5 1-3 hours Newbie friendliness 76/100

opensearch-project/security#6105 · 3 comments · Opened Apr 22, 2026
[BUG] Missing indices:admin/get permission in kibana_server static role Open

bug triaged

Difficulty 1/5 Under an hour Newbie friendliness 72/100

opensearch-project/security#6103 · 4 comments · Opened Apr 21, 2026
[BUG] Nested role resolution crashes on malformed DN instead of gracefully skipping Open

bug

Difficulty 3/5 1-2 days Newbie friendliness 52/100

opensearch-project/security#6060 · 2 comments · Opened Apr 1, 2026
[RELEASE] Release version 3.7.0 Open

v3.7.0

Difficulty 5/5 Over a week Newbie friendliness 25/100

opensearch-project/security#6055 · 2 comments · Opened Mar 31, 2026
[FEATURE] Introduce `plugins.security.superadmin.secret` for superadmin access when https is disabled Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 28/100

opensearch-project/security#6051 · 1 comment · Opened Mar 30, 2026
[FEATURE] Add `plugins.security.dashboards.dashboards_url` as dynamic cluster setting Open

enhancement triaged

Difficulty 4/5 3-5 days Newbie friendliness 45/100

opensearch-project/security#6015 · 3 comments · Opened Mar 16, 2026
[FEATURE] Make cluster settings equivalents of `config.dynamic.http.*` and `config.dynamic.kibana.*` Open

enhancement triaged

Difficulty 5/5 Over a week Newbie friendliness 35/100

opensearch-project/security#6014 · Opened Mar 16, 2026
[BUG] OpenSearchSecurityException[_opendistro_security_dls_query does not match (SG 900D)] occurs intermittently across nodes when using DLS with role variable substitution `(${user.roles})`. Open

bug triaged

Difficulty 4/5 3-5 days Newbie friendliness 45/100

opensearch-project/security#5997 · 4 comments · Opened Mar 9, 2026

opensearch-project/security

Get new issues in your inbox