Connect OpenSearch with Basic Authentication – StackOne Hub

Use the pattern that matches your deployment.

• Self-hosted / on-premise — an HTTPS URL to your cluster’s REST port (default 9200).
• AWS OpenSearch Service (Managed) — the domain endpoint shown on the Amazon OpenSearch Service console; host ends in .es.amazonaws.com.
• Aiven for OpenSearch — the service URI shown on the service Overview page in the Aiven Console; host ends in .aivencloud.com on a service-specific port.
• Bonsai — copy the connection URL from the cluster’s Credentials tab in the Bonsai app. Paste only the host+port portion here (host ends in .bonsaisearch.net, on port 443); put the username and password in the credential fields below.
• The URL must use HTTPS — the Security Plugin requires TLS.
• No trailing slash.

Sign in to OpenSearch Dashboards as an admin, then:

• Choose Security, Internal Users, and Create internal user.
• Provide a Username (e.g. stackone-integration) and Password. The Security plugin automatically hashes the password and stores it in the .opendistro_security index.
• Optionally set Backend roles and Attributes.
• Choose Submit.
• See Defining users and roles in the OpenSearch documentation.

On AWS OpenSearch Service, HTTP basic authentication requires fine-grained access control (FGAC) with the internal user database enabled. If FGAC is already enabled with the internal user database, sign in to the domain’s Dashboards URL (typically the domain endpoint suffixed with /_dashboards) as the master user and follow the self-hosted path above. If FGAC is not yet enabled:

• Open the Amazon OpenSearch Service console, select your domain, and choose Actions > Edit security configuration.
• Select Enable fine-grained access control.
• Choose Create master user and specify a username and password.
• Choose Save changes. The change triggers a blue/green deployment.
• Once the domain returns to Active, sign in to the Dashboards URL with the master credentials and use the standard Security > Internal Users flow above to create the scoped integration user.
• Reference: Fine-grained access control in Amazon OpenSearch Service.

Aiven services start without OpenSearch Security enabled. To use basic auth against the Security plugin’s internal user database, first enable it on the service:

• In the Aiven Console, open your OpenSearch service and click Users in the sidebar.
• Click Enable OpenSearch Security.
• Review the confirmation window, select the acknowledgement checkbox, and click Continue.
• Enter a password for the default admin user, then click Enable OpenSearch Security to activate.
• Once enabled, further user management moves into the OpenSearch Dashboards UI — sign in as admin and use Security > Internal Users > Create internal user to add the scoped integration user.
• Note: enabling OpenSearch Security cannot be reversed without Aiven support. Reference: OpenSearch Security in Aiven for OpenSearch.

Bonsai does not expose the Security plugin UI; each cluster comes with its own credentials pair.

• In the Bonsai app, open your cluster and go to the Credentials tab.
• Copy the User and Password values.
• Bonsai clusters ship with cluster-scoped credentials — rotate them via the same page if compromised.

In OpenSearch Dashboards:

• Choose Security, Roles, and select the role you want to assign.
• Choose the Mapped users tab and Manage mapping.
• Specify the integration username (or a backend role it holds) and choose Map.
• Predefined role reference: readall_and_monitor grants search on all indexes plus monitoring — a reasonable minimum for read-heavy connector actions. all_access grants full cluster access but is not least-privilege.
• Reference: Predefined roles.

Run the same call StackOne runs, then interpret the response.

• 401 Unauthorized — username or password wrong. Verify with a call to /_plugins/_security/authinfo on the same endpoint using the credentials.
• 403 Forbidden — user authenticates but the mapped role is missing a permission. The response body names the missing permission — grant it via a role and re-map.
• Certificate error / unable to verify — cluster is serving a certificate the caller can’t validate. Use a properly-signed certificate or publish the internal CA root to the calling environment.
• Connection refused / timeout — the cluster URL or port is unreachable. Check firewall rules, security groups, and VPC/VPN reachability from StackOne’s egress.

Copy each value from the platform you configured above.

• OpenSearch Endpoint URL — the HTTPS endpoint from step 1.
• Username — the internal / master / cluster user you created.
• Password — the password you set for that user.
• OpenSearch Dashboards URL — optional. Only required if you plan to sync dashboards, visualisations, or index patterns via the dashboards_* actions. Self-hosted Dashboards runs on port 5601 by default; AWS OpenSearch Service exposes it as the domain endpoint suffixed with /_dashboards. Leave blank for core datasync workflows.