opensearch-project / opensearch-project/security
[FEATURE] Support HTTPS for Identity provider out of the box
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 252
- Forks
- 395
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 76
Description
Is your feature request related to a problem?
Currently HTTPS is not supported out of the box. Specifically https validation is disabled by default (which honesty is not acceptable in 2025) until end users supply their own trusted CAs file.
What solution would you like?
You should use the standard Java cacerts store like everyone else.
What alternatives have you considered?
Supplying the CA file manually
Do you have any additional context?
This would also be nice if the OpenID connect TLS validation wasn't completely broken, but I believe that is a separate issue.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names no files or tests; start by locating the identity-provider HTTPS configuration and its OpenID Connect TLS handling. Compare the current certificate-validation path with Java's standard cacerts trust store, keeping the separate OpenID Connect TLS concern scoped independently. Done means HTTPS validation works out of the box using the standard trust store.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100