Skip to content

Add entitlements known issues #127061

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 6 commits into from
Apr 22, 2025
Merged

Add entitlements known issues #127061

Changes from 2 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
7173cd7
add entitlements known issues
ldematte Apr 18, 2025
3c6a374
fixes
ldematte Apr 18, 2025
1c935aa
Apply suggestions from code review
ldematte Apr 22, 2025
c2fd447
Merge remote-tracking branch 'upstream/main' into entitlements/know-i…
ldematte Apr 22, 2025
bde29e3
Merge branch 'entitlements/know-issues' of github.com:ldematte/elasti…
ldematte Apr 22, 2025
b8f0214
PR comments
ldematte Apr 22, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions docs/release-notes/known-issues.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,3 +7,9 @@ mapped_pages:
# Elasticsearch known issues [elasticsearch-known-issues]
Known issues are significant defects or limitations that may impact your implementation. These issues are actively being worked on and will be addressed in a future release. Review the Elasticsearch known issues to help you make informed decisions, such as upgrading to a new version.

## 9.0.0 [elasticsearch-9.0.0-known-issues]
* Elasticsearch on Windows may fail to start, or it may forbid some file-related operations, when referencing paths with a case different from the one stored by the filesystem. Windows treats paths in a case-insensitive way, but the filesystem stores them with case. _Entitlements_, the new security system used by Elasticsearch, treat all paths as case-sensitive, and can therefore prevent access to a path that should be accessible. An example: if Elasticsearch is installed in `C:\ELK\elasticsearch`, and you try to launch it as `c:\elk\elasticsearch\bin\elasticsearch.bat`, you will get a `NotEntitledException` while booting. We block access to `c:\elk\elasticsearch` as it does not match with `C:\ELK\elasticsearch`.\
As a workaround, please ensure that all paths you specify (command line, config files, etc.) have the same casing as stored in the filesystem (i.e. the exact same files and directory names as showed in Windows Explorer on in `cmd`).
* Active Directory Authentication is blocked by default; _Entitlements_, the new security system used by Elasticsearch, has a policy for the `x-pack-core` module that is too restrictive, and does not allow the LDAP library used for AD authentication to perform outbound network connections. \
This is fixed by patching the policy for `x-pack-core` to add a `outbound_network` entitlement for the LDAP library to include the correct entitlements (see [PR #126992](https://github.com/elastic/elasticsearch/pull/126992)).\
As a workaround, the policy can be temporarily patched via a JVM option: create a file called `${ES_CONF_PATH}/jvm_options/workaround-127061.options` and add this line `-Des.entitlements.policy.x-pack-core=dmVyc2lvbnM6CiAgLSA4LjE4LjAKICAtIDkuMC4wCnBvbGljeToKICB1bmJvdW5kaWQubGRhcHNkazoKICAgIC0gc2V0X2h0dHBzX2Nvbm5lY3Rpb25fcHJvcGVydGllcwogICAgLSBvdXRib3VuZF9uZXR3b3Jr` to the file. See the [JVM settings](https://www.elastic.co/docs/reference/elasticsearch/jvm-settings) docs for more details.
Loading