NAME

OpenSearch::Client::Hash - A utility to create password hashes

VERSION

version 3.008

SYNOPSYS

use OpenSearch::Client::Hash;
my $pwdhasher = OpenSearch::Client::Hash->new;
my $hash1 = $pwdhasher->create_bcrypt_password_hash( password => 'my plaintext password');
my $hash2 = $pwdhasher->create_argon2_password_hash( password => 'my plaintext password');
my $hash3 = $pwdhasher->create_pbkdf2_password_hash( password => 'my plaintext password');

# store $hash1
# $hash1 == something like $2y$12$KCHnaCykMhrXNkfpPlDmRejRYAd2rhixnWgcpICQyTEc8HI.0G8Ca

# later create users using stored hashed passwords

my $cli = OpenSearch::Client->new( .... );
my $result = $cli->security->patch_users(
    body => [
        {
            op    => 'add',
            path  => '/myuserone',
            value => {
                description => 'Read only query user',
                hash        => '$2y$12$KCHnaCykMhrXNkfpPlDmRejRYAd2rhixnWgcpICQyTEc8HI.0G8Ca'
            }
        },
        {
            op    => 'add',
            path  => '/myusertwo',
            value => {
                description => 'Indexing user',
                hash        => '$2y$12$ak6pPjW3aEbVaU7FX03HLuGWO0K5oNa3PRvUE.A6six2vdvq0uTue'
            }
        },
    ]
);

DESCRIPTION

Allows creation of BCrypt, Argon2 and PBKDF2 password hashes that can be stored for later use in user creation.

These are the same types of hash produced by plugins/opensearch-security/tools/hash.sh.

BCrypt is the default password hashing algorithm in all versions of OpenSearch

PBKDF2 password hashes and the ability to configure password hash settings in opensearch.yml are supported from OpenSearch 2.16.0

Argon2 password hashes are supported from OpenSearch 3.2.0

NOTE : You cannot retrieve a cluster's password hashing settings using the REST API. You must be able to access opensearch.yml on a node.

METHODS

create_bcrypt_password_hash

Create a BCrypt password hash from a plain text password.

You cannot use hashes produced by this method if your plugins.security.password.hashing.algorithm is not the default BCrypt

Returns the hashed password. On error an empty string is returned and $ph->errorstring is populated.

use OpenSearch::Client::Hash;
my $ph = OpenSearch::Client::Hash->new;

my $hash1 = $ph->create_bcrypt_password_hash( password => 'my plaintext password' );

if( $ph->errorstring ) {
    ......
}

my $hash2 = $ph->create_bcrypt_password_hash(
    password => 'my other plaintext password',
    type     => '2y',
    rounds   => 12
);

unless( $hash2 ) {
    my $error = $ph->errorstring;
    .....
}

password

Required. The plaintext password to hash.

In BCrypt passwords are limted to a maximum of 72 characters and may not contain any null-byte.

type

Optional. Default is '2y'. Allowed values are '2y', '2a' and '2b'.

Specifies the minor version of the BCrypt algorithm to use for hashing.

Do not set this option unless your plugins.security.password.hashing.bcrypt.minor setting is not the default Y when you must match it with 2a for A and 2b for B.

rounds

Optional. Default is 12.

Specifies the number of rounds to use for password hashing with BCrypt. Valid values are between 4 and 31, inclusive.

Do not set this option unless your plugins.security.password.hashing.bcrypt.rounds setting is something other than 12 when you must match it here.

create_argon2_password_hash

Create an Argon2 password hash from a plain text password.

You cannot use hashes produced by this method unless :

your plugins.security.password.hashing.algorithm is Argon2
your plugins.security.password.hashing.argon2.version is the default 19

Returns the hashed password. On error an empty string is returned and $ph->errorstring is populated.

use OpenSearch::Client::Hash;
my $ph = OpenSearch::Client::Hash->new;

my $hash1 = $ph->create_argon2_password_hash( password => 'my plaintext password' );

if( $ph->errorstring ) {
    ......
}

my $hash2 = $ph->create_argon2_password_hash(
    password   => 'my other plaintext password',
    type       => 'argon2id',
    length     => 32,
    iterations => 3,
    memory     => 65536,
);

unless( $hash2 ) {
    my $error = $ph->errorstring;
    .....
}

password

Required. The plaintext password to hash.

type

Optional. Default is 'argon2id'. Allowed values are 'argon2id', 'argon2i' and 'argon2d'.

Do not set this option unless your plugins.security.password.hashing.argon2.type setting is not the default Argon2id when you must match it here.

length

Optional. Desired length of the final derived key. Default is 32.

Do not set this option unless your plugins.security.password.hashing.argon2.length setting is not the default 32 when you must match it here.

iterations

Optional. Number of times the pseudo-random function is applied to the password. Default is 3.

Do not set this option unless your plugins.security.password.hashing.argon2.iterations setting is not the default 3 when you must match it here.

memory

Optional. Amount of memory to use for hashing in KiB. Default is 65536.

Do not set this option unless your plugins.security.password.hashing.argon2.memory setting is not the default 65536 when you must match it here.

create_pbkdf2_password_hash

Create a PBKDF2 password hash from a plain text password.

You cannot use hashes produced by this method unless your plugins.security.password.hashing.algorithm is PBKDF2

Returns the hashed password. On error an empty string is returned and $ph->errorstring is populated.

use OpenSearch::Client::Hash;
my $ph = OpenSearch::Client::Hash->new;

my $hash1 = $ph->create_pbkdf2_password_hash( password => 'my plaintext password' );

if( $ph->errorstring ) {
    ......
}

my $hash2 = $ph->create_pbkdf2_password_hash(
    password   => 'my other plaintext password',
    function   => 'SHA256',
    length     => 256,
    iterations => 600000,
);

unless( $hash2 ) {
    my $error = $ph->errorstring;
    .....
}

password

Required. The plaintext password to hash.

function

Optional. Default is 'SHA256'. Allowed values are 'SHA1', 'SHA224', 'SHA256', 'SHA384' and 'SHA512'.

Do not set this option unless your plugins.security.password.hashing.pbkdf2.function setting is not the default SHA256 when you must match it here.

length

Optional. Desired length of the final derived key. Default is 256.

Do not set this option unless your plugins.security.password.hashing.pbkdf2.length setting is not the default 256 when you must match it here.

iterations

Optional. Number of times the pseudo-random function is applied to the password. Default is 600000.

Do not set this option unless your plugins.security.password.hashing.pbkdf2.iterations setting is not the default 600000 when you must match it here.

AUTHOR

Mark Dootson <mdootson@cpan.org>

COPYRIGHT AND LICENSE

This is free software, licensed under:

The Apache License, Version 2.0, January 2004

To install OpenSearch::Client::Hash, copy and paste the appropriate command in to your terminal.

cpanm

cpanm OpenSearch::Client::Hash

CPAN shell

perl -MCPAN -e shell
install OpenSearch::Client::Hash

For more information on module installation, please visit the detailed CPAN module installation guide.

	Global
`s`	Focus search bar
`?`	Bring up this help dialog

	GitHub
`g` `p`	Go to pull requests
`g` `i`	Go to GitHub issues (only if GitHub is preferred repository)

	POD
`g` `a`	Go to author
`g` `c`	Go to changes
`g` `i`	Go to issues
`g` `d`	Go to dist
`g` `r`	Go to repository/SCM
`g` `s`	Go to source
`g` `b`	Go to file browse

Search terms
module: (e.g. module:Plugin)
distribution: (e.g. distribution:Dancer auth)
author: (e.g. author:SONGMU Redis)
version: (e.g. version:1.00)

NAME

VERSION

SYNOPSYS

DESCRIPTION

METHODS

create_bcrypt_password_hash

create_argon2_password_hash

create_pbkdf2_password_hash

SEE ALSO

AUTHOR

COPYRIGHT AND LICENSE

Module Install Instructions

Keyboard Shortcuts