/ 
OpenSearch-Client-Hash-3.007010
/ OpenSearch::Client::Hash

NAME

OpenSearch::Client::Hash - A utility to create password hashes

VERSION

version 3.007010

SYNOPSYS

use OpenSearch::Client::Hash;
my $pwdhasher = OpenSearch::Client::Hash->new;
my $hash1 = $pwdhasher->create_bcrypt_password_hash( password => 'my plaintext password');
my $hash2 = $pwdhasher->create_argon2_password_hash( password => 'my plaintext password');
my $hash3 = $pwdhasher->create_pbkdf2_password_hash( password => 'my plaintext password');

# store $hash1
# $hash1 == something like $2y$12$KCHnaCykMhrXNkfpPlDmRejRYAd2rhixnWgcpICQyTEc8HI.0G8Ca

# later create users using stored hashed passwords

my $cli = OpenSearch::Client->new( .... );
my $result = $cli->security->patch_users(
    body => [
        {
            op    => 'add',
            path  => '/myuserone',
            value => {
                description => 'Read only query user',
                hash        => '$2y$12$KCHnaCykMhrXNkfpPlDmRejRYAd2rhixnWgcpICQyTEc8HI.0G8Ca'
            }
        },
        {
            op    => 'add',
            path  => '/myusertwo',
            value => {
                description => 'Indexing user',
                hash        => '$2y$12$ak6pPjW3aEbVaU7FX03HLuGWO0K5oNa3PRvUE.A6six2vdvq0uTue'
            }
        },
    ]
);

DESCRIPTION

Allows creation of BCrypt, Argon2 and PBKDF2 password hashes that can be stored for later use in user creation.

These are the same types of hash produced by plugins/opensearch-security/tools/hash.sh -p <new-password>.

METHODS

create_bcrypt_password_hash

Create a BCrypt password hash from a plain text password.

You cannot use hashes produced by this method if your plugins.security.password.hashing.algorithm is not the default BCrypt

use OpenSearch::Client::Hash;
my $ph = OpenSearch::Client::Hash->new;

my $hash1 = $ph->create_bcrypt_password_hash( password => 'my plaintext password' );

my $hash2 = $ph->create_bcrypt_password_hash(
    password => 'my other plaintext password',
    type     => '2y',
    rounds   => 12
);
password

Required. The plaintext password to hash.

Note that in BCrypt passwords may only contain 72 characters and may not contain any null-byte.

type

Optional. Default is '2y'. Allowed values are '2y', '2a' and '2b'.

Specifies the minor version of the BCrypt algorithm to use for hashing.

Do not set this option unless your plugins.security.password.hashing.bcrypt.minor setting is not the default Y when you must match it with 2a for A and 2b for B.

rounds

Optional. Default is 12.

Specifies the number of rounds to use for password hashing with BCrypt. Valid values are between 4 and 31, inclusive.

Do not set this option unless your plugins.security.password.hashing.bcrypt.rounds setting is something other than 12 when you must match it here.

create_argon2_password_hash

Create an Argon2 password hash from a plain text password.

You cannot use hashes produced by this method unless :

  • your plugins.security.password.hashing.algorithm is Argon2

  • your plugins.security.password.hashing.argon2.version is the default 19

use OpenSearch::Client::Hash;
my $ph = OpenSearch::Client::Hash->new;

my $hash1 = $ph->create_argon2_password_hash( password => 'my plaintext password' );

my $hash2 = $ph->create_argon2_password_hash(
    password   => 'my other plaintext password',
    type       => 'argon2id',
    length     => 32,
    iterations => 3,
    memory     => 65536,
);
password

Required. The plaintext password to hash.

type

Optional. Default is 'argon2id'. Allowed values are 'argon2id', 'argon2i' and 'argon2d'.

Do not set this option unless your plugins.security.password.hashing.argon2.type setting is not the default Argon2id when you must match it here.

length

Optional. Desired length of the final derived key. Default is 32.

Do not set this option unless your plugins.security.password.hashing.argon2.length setting is not the default 32 when you must match it here.

iterations

Optional. Number of times the pseudo-random function is applied to the password. Default is 3.

Do not set this option unless your plugins.security.password.hashing.argon2.iterations setting is not the default 3 when you must match it here.

memory

Optional. Amount of memory to use for hashing in KiB. Default is 65536.

Do not set this option unless your plugins.security.password.hashing.argon2.memory setting is not the default 65536 when you must match it here.

create_pbkdf2_password_hash

Create a PBKDF2 password hash from a plain text password.

You cannot use hashes produced by this method unless your plugins.security.password.hashing.algorithm is PBKDF2

use OpenSearch::Client::Hash;
my $ph = OpenSearch::Client::Hash->new;

my $hash1 = $ph->create_pbkdf2_password_hash( password => 'my plaintext password' );

my $hash2 = $ph->create_pbkdf2_password_hash(
    password   => 'my other plaintext password',
    function   => 'SHA256',
    length     => 256,
    iterations => 600000,
);
password

Required. The plaintext password to hash.

function

Optional. Default is 'SHA256'. Allowed values are 'SHA1', 'SHA224', 'SHA256', 'SHA384' and 'SHA512'.

Do not set this option unless your plugins.security.password.hashing.pbkdf2.function setting is not the default SHA256 when you must match it here.

length

Optional. Desired length of the final derived key. Default is 256.

Do not set this option unless your plugins.security.password.hashing.pbkdf2.length setting is not the default 256 when you must match it here.

iterations

Optional. Number of times the pseudo-random function is applied to the password. Default is 600000.

Do not set this option unless your plugins.security.password.hashing.pbkdf2.iterations setting is not the default 600000 when you must match it here.

MANUAL

Documentation index OpenSearch::Client::Manual

AUTHOR

Mark Dootson <mdootson@cpan.org> ( current maintainer )

COPYRIGHT AND LICENSE

Copyright (C) 2026 by Mark Dootson

This is free software, licensed under:

The Apache License, Version 2.0, January 2004