SO 2.3.200 broke my authentication

[ben-sec]

Hello!

After I have updated my distributed SO deployment to 2.3.200 I get the following error in SOC

and can no longer login to Elasticsearch via Kibana (Username or password is incorrect). What happened here and how can I correct it? I already rebooted my Manager and the Search Nodes without success.

Cheers, Ben

[InfosecGoon]

What do you get as output from this command on the Manager?

sudo salt-call pillar.get elasticsearch:auth:enabled

[ben-sec]

True. It was an update from 190 to 200 and Elasticsearch authentication has been enabled previously.

[InfosecGoon]

Two things I would check, then:

1. The actual cause of the error in SOC should show up in /opt/so/log/sensoroni/sensoroni.log - if there's an issue with the Elasticsearch environment, it should show up there.
2. It's possible that your SOC accounts and Elastic accounts are out of sync, try running this from a root command prompt: "FORCE_SYNC=true so-user sync".

[ben-sec]

The FORCE_SYNC command did the trick. Thanks a lot!