Editing OpenSearch Cluster Installation (section)

=== Security Plugin Configuration ===
While the security configuration files exist on all the nodes in the cluster, they are only used once and only by the node where the security initialization is performed.  With that in mine, pick one node (the first master node will do nicely) to edit the configuration files as needed.  There are many things that can be done with these files, but two items in particular should be addressed.  The files are located in the <code>plugins/opensearch-security/securityconfig</code> directory in the opensearch distribution.

==== Authentication ====
<code>config.yml</code> is where the authentication options are established.  This will need to be configured to support your authentication options.  The OpenSearch documentation describes the different options [https://opensearch.org/docs/latest/security-plugin/configuration/configuration/ here].

The default configuration supports basic username/password authentication, but if you wish to use certificate authentication for API clients or ingest pipelines using logstash, you need to enable both '''http''' and '''transport''' under <code>clientcert_auth_domain</code>.  Proxy authentication and OpenID Connect authentication is possible as well ... see the documentation.

==== Admin user password ====
The default password for the admin user is well-known, and should be changed for a production environment.  The OpenSearch documentation provides instructions on how to [https://opensearch.org/docs/latest/security-plugin/configuration/yaml/#internal_usersyml generate passwords] for the <code>internal_users.yml</code> file.  Note that '''the admin password cannot be set through the dashboard or the API''' -- it must be set in this file, and then (re)loaded to take effect.