Skip to content

Commit da0b87f

Browse files
Add documentation for Argon2 hashing algorithm (#10163)
* feat: added documentation for Argon2 hashing algorithm Signed-off-by: Aiden Lindsay <aiden.o.lindsay@gmail.com> * Add writer edits Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> --------- Signed-off-by: Aiden Lindsay <aiden.o.lindsay@gmail.com> Signed-off-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> Co-authored-by: Naarcha-AWS <97990722+Naarcha-AWS@users.noreply.github.com> (cherry picked from commit 8b8b965) Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
1 parent bcf820a commit da0b87f

File tree

1 file changed

+23
-15
lines changed

1 file changed

+23
-15
lines changed

_install-and-configure/configuring-opensearch/security-settings.md

Lines changed: 23 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -22,9 +22,7 @@ The Security plugin supports the following common settings:
2222

2323
- `plugins.security.authcz.admin_dn` (Static): Defines the DNs of certificates to which admin privileges should be assigned. Required.
2424

25-
- `plugins.security.roles_mapping_resolution` (Static): Defines how backend roles are mapped to Security roles.
26-
27-
Valid values are:
25+
- `plugins.security.roles_mapping_resolution` (Static): Defines how backend roles are mapped to Security roles. The following values are supported:
2826
- `MAPPING_ONLY`(Default): Mappings must be configured explicitly in `roles_mapping.yml`.
2927
- `BACKENDROLES_ONLY`: Backend roles are mapped to security roles directly. Settings in `roles_mapping.yml` have no effect.
3028
- `BOTH`: Backend roles are mapped to security roles both directly and through `roles_mapping.yml`.
@@ -125,27 +123,19 @@ The Security plugin supports the following expert-level settings:
125123
If you change any of the following password hashing properties, you must rehash all internal passwords to ensure compatibility and security.
126124
{: .warning}
127125

128-
- `plugins.security.password.hashing.algorithm`: (Static): Specifies the password hashing algorithm to use.
129-
130-
Valid values are:
131-
126+
- `plugins.security.password.hashing.algorithm`: (Static): Specifies the password hashing algorithm to use. The following values are supported:
132127
- `BCrypt` (Default)
133128
- `PBKDF2`
129+
- `Argon2`
134130

135131
- `plugins.security.password.hashing.bcrypt.rounds` (Static): Specifies the number of rounds to use for password hashing with `BCrypt`. Valid values are between `4` and `31`, inclusive. Default is `12`.
136132

137-
- `plugins.security.password.hashing.bcrypt.minor` (Static): Specifies the minor version of the `BCrypt` algorithm to use for password hashing.
138-
139-
Valid values are:
140-
133+
- `plugins.security.password.hashing.bcrypt.minor` (Static): Specifies the minor version of the `BCrypt` algorithm to use for password hashing. The following values are supported:
141134
- `A`
142135
- `B`
143136
- `Y` (Default)
144137

145-
- `plugins.security.password.hashing.pbkdf2.function` (Static): Specifies the pseudo-random function applied to the password.
146-
147-
Valid values are:
148-
138+
- `plugins.security.password.hashing.pbkdf2.function` (Static): Specifies the pseudo-random function applied to the password. The following values are supported:
149139
- `SHA1`
150140
- `SHA224`
151141
- `SHA256` (Default)
@@ -156,6 +146,24 @@ If you change any of the following password hashing properties, you must rehash
156146

157147
- `plugins.security.password.hashing.pbkdf2.length` (Static): Specifies the desired length of the final derived key. Default is `256`.
158148

149+
- `plugins.security.password.hashing.argon2.iterations`: Specifies the number of passes over memory that the algorithm performs. Increasing this value raises CPU computation time and improves resistance to brute-force attacks. Default: `3`.
150+
151+
- `plugins.security.password.hashing.argon2.memory`: Specifies the amount of memory (in kibibytes) used during hashing. Default: `65536` (64 MiB).
152+
153+
- `plugins.security.password.hashing.argon2.parallelism`: Specifies the number of parallel threads used for computation. Default: `1`.
154+
155+
- `plugins.security.password.hashing.argon2.length`: Specifies the length (in bytes) of the resulting hash output. Default: `32`.
156+
157+
- `plugins.security.password.hashing.argon2.type`: Specifies which variant of Argon2 to use. The following values are supported:
158+
- `Argon2i`
159+
- `Argon2d`
160+
- `Argon2id` (default)
161+
162+
- `plugins.security.password.hashing.argon2.version`: Specifies which version of Argon2 to use. The following values are supported:
163+
- `16`
164+
- `19` (default)
165+
166+
159167

160168
## Audit log settings
161169

0 commit comments

Comments
 (0)