Demo configuration script requires admin password

config/admin_password.txt

@@ -0,0 +1 @@
+testPassword

config/internal_users.yml

@@ -11,7 +11,7 @@ _meta:
 ## Demo users
 
 admin:
-  hash: "$2a$12$VcCDgh2NDk07JGN0rjGbM.Ad41qVR/YFJcgHp0UGns5JDymv..TOG"
+  hash:
   reserved: true
   backend_roles:
   - "admin"

src/test/java/org/opensearch/security/InitializationIntegrationTests.java

@@ -283,8 +283,8 @@ public void testDefaultConfig() throws Exception {
         RestHelper rh = nonSslRestHelper();
         Thread.sleep(10000);
 
-        Assert.assertEquals(HttpStatus.SC_OK, rh.executeGetRequest("", encodeBasicHeader("admin", "admin")).getStatusCode());
-        HttpResponse res = rh.executeGetRequest("/_cluster/health", encodeBasicHeader("admin", "admin"));
+        Assert.assertEquals(HttpStatus.SC_OK, rh.executeGetRequest("", encodeBasicHeader("admin", "testPassword")).getStatusCode());
+        HttpResponse res = rh.executeGetRequest("/_cluster/health", encodeBasicHeader("admin", "testPassword"));
         Assert.assertEquals(res.getBody(), HttpStatus.SC_OK, res.getStatusCode());
     }
 
@@ -300,14 +300,14 @@ public void testInvalidDefaultConfig() throws Exception {
             Thread.sleep(10000);
             Assert.assertEquals(
                 HttpStatus.SC_SERVICE_UNAVAILABLE,
-                rh.executeGetRequest("", encodeBasicHeader("admin", "admin")).getStatusCode()
+                rh.executeGetRequest("", encodeBasicHeader("admin", "testPassword")).getStatusCode()
             );
 
             ClusterHelper.updateDefaultDirectory(defaultInitDirectory);
             restart(Settings.EMPTY, null, settings, false);
             rh = nonSslRestHelper();
             Thread.sleep(10000);
-            Assert.assertEquals(HttpStatus.SC_OK, rh.executeGetRequest("", encodeBasicHeader("admin", "admin")).getStatusCode());
+            Assert.assertEquals(HttpStatus.SC_OK, rh.executeGetRequest("", encodeBasicHeader("admin", "testPassword")).getStatusCode());
         } finally {
             ClusterHelper.resetSystemProperties();
         }

src/test/java/org/opensearch/security/test/SingleClusterTest.java

@@ -80,7 +80,8 @@ protected void setup(
         Settings nodeOverride,
         boolean initSecurityIndex
     ) throws Exception {
-        setup(initTransportClientSettings, dynamicSecuritySettings, nodeOverride, initSecurityIndex, ClusterConfiguration.DEFAULT);
+        Settings settings = Settings.builder().put(nodeOverride).put("plugins.security.bootstrap.admin.password", "testPassword").build();
+        setup(initTransportClientSettings, dynamicSecuritySettings, settings, initSecurityIndex, ClusterConfiguration.DEFAULT);
     }
 
     protected void restart(

tools/install_demo_configuration.bat

@@ -75,6 +75,8 @@ cd %CUR%
 echo Basedir: %BASE_DIR%
 
 set "OPENSEARCH_CONF_FILE=%BASE_DIR%config\opensearch.yml"
+set "INTERNAL_USERS_FILE"=%BASE_DIR%config\internal_users.yml"
+set "ADMIN_PASSWORD_FILE"=%BASE_DIR%config\admin_password.txt"
 set "OPENSEARCH_CONF_DIR=%BASE_DIR%config\"
 set "OPENSEARCH_BIN_DIR=%BASE_DIR%bin\"
 set "OPENSEARCH_PLUGINS_DIR=%BASE_DIR%plugins\"
@@ -319,6 +321,66 @@ echo plugins.security.restapi.roles_enabled: ["all_access", "security_rest_api_a
 echo plugins.security.system_indices.enabled: true >> "%OPENSEARCH_CONF_FILE%"
 echo plugins.security.system_indices.indices: [".plugins-ml-config", ".plugins-ml-connector", ".plugins-ml-model-group", ".plugins-ml-model", ".plugins-ml-task", ".plugins-ml-conversation-meta", ".plugins-ml-conversation-interactions", ".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opensearch-notifications-*", ".opensearch-notebooks", ".opensearch-observability", ".ql-datasources", ".opendistro-asynchronous-search-response*", ".replication-metadata-store", ".opensearch-knn-models", ".geospatial-ip2geo-data*", ".opendistro-job-scheduler-lock"] >> "%OPENSEARCH_CONF_FILE%"
 
+
+REM Initialize the variable
+set "ADMIN_PASSWORD="
+
+REM Read the content of admin_password.txt into the ADMIN_PASSWORD variable
+for /f "usebackq" %%i in ("%ADMIN_PASSWORD_FILE%") do (
+    set "ADMIN_PASSWORD=%%i"
+)
+
+REM If ADMIN_PASSWORD is empty, check the environment variable as a fallback
+if not defined ADMIN_PASSWORD (
+    if defined ENV_ADMIN_PASSWORD (
+        set "ADMIN_PASSWORD=!ENV_ADMIN_PASSWORD!"
+    ) else (
+        echo Unable to find admin password for cluster, please run "set ENV_ADMIN_PASSWORD=<your_password>" or create a file {OPENSEARCH_ROOT}\admin_password.txt with a single line that contains the password followed by a newline.
+        exit /b 1
+    )
+)
+
+
+set "salt="
+for /l %%i in (1,1,16) do (
+    set /a "rand=!random! %% 16"
+    set "salt=!salt!!rand!"
+)
+
+openssl passwd -bcrypt -salt !salt! "!ADMIN_PASSWORD!" > tmp_hash.txt
+
+set "HASHED_ADMIN_PASSWORD="
+for /f %%a in (tmp_hash.txt) do (
+    set "HASHED_ADMIN_PASSWORD=%%a"
+)
+
+del tmp_hash.txt
+
+for /f "tokens=1 delims=:" %%b in ('findstr /n "admin:" "%INTERNAL_USERS_FILE%"') do (
+    set "ADMIN_HASH_LINE=%%b"
+)
+
+(for /f "delims=" %%c in ('type "%INTERNAL_USERS_FILE%" ^| findstr /n "^"') do (
+    set "line=%%c"
+    setlocal enabledelayedexpansion
+    echo(!line:%ADMIN_HASH_LINE%:=! | findstr "^"
+    endlocal
+)) > tmp_internal_users.yml
+
+(for /f "delims=" %%d in ('type "tmp_internal_users.yml" ^| findstr /n "^"') do (
+    set "line=%%d"
+    setlocal enabledelayedexpansion
+    if !line:^%ADMIN_HASH_LINE%^=! neq !line! (
+        echo !line!
+    ) else (
+        echo !line!
+        echo hash: "!HASHED_ADMIN_PASSWORD!"
+    )
+    endlocal
+)) > "%INTERNAL_USERS_FILE%"
+
+del tmp_internal_users.yml
+
 :: network.host
 >nul findstr /b /c:"network.host" "%OPENSEARCH_CONF_FILE%" && (
     echo network.host already present

tools/install_demo_configuration.sh

@@ -109,6 +109,8 @@ else
     echo "DEBUG: basedir does not exist"
 fi
 OPENSEARCH_CONF_FILE="$BASE_DIR/config/opensearch.yml"
+INTERNAL_USERS_FILE = "$BASE_DIR/config/internal_users.yml"
+ADMIN_PASSWORD_FILE="$BASE_DIR/config/admin_password.txt"
 OPENSEARCH_BIN_DIR="$BASE_DIR/bin"
 OPENSEARCH_PLUGINS_DIR="$BASE_DIR/plugins"
 OPENSEARCH_MODULES_DIR="$BASE_DIR/modules"
@@ -387,6 +389,29 @@ echo 'plugins.security.restapi.roles_enabled: ["all_access", "security_rest_api_
 echo 'plugins.security.system_indices.enabled: true' | $SUDO_CMD tee -a "$OPENSEARCH_CONF_FILE" > /dev/null
 echo 'plugins.security.system_indices.indices: [".plugins-ml-config", ".plugins-ml-connector", ".plugins-ml-model-group", ".plugins-ml-model", ".plugins-ml-task", ".plugins-ml-conversation-meta", ".plugins-ml-conversation-interactions", ".opendistro-alerting-config", ".opendistro-alerting-alert*", ".opendistro-anomaly-results*", ".opendistro-anomaly-detector*", ".opendistro-anomaly-checkpoints", ".opendistro-anomaly-detection-state", ".opendistro-reports-*", ".opensearch-notifications-*", ".opensearch-notebooks", ".opensearch-observability", ".ql-datasources", ".opendistro-asynchronous-search-response*", ".replication-metadata-store", ".opensearch-knn-models", ".geospatial-ip2geo-data*", ".opendistro-job-scheduler-lock"]' | $SUDO_CMD tee -a "$OPENSEARCH_CONF_FILE" > /dev/null
 
+ADMIN_PASSWORD=$(cat "$ADMIN_PASSWORD_FILE")
+
+if [ -z "$ADMIN_PASSWORD" ]; then
+  if [ -n "$ENV_ADMIN_PASSWORD" ]; then
+    ADMIN_PASSWORD="$ENV_ADMIN_PASSWORD"
+  else
+    echo "Unable to find admin password for cluster, please run `export ENV_ADMIN_PASSWORD=<your_password>>` or create a file {OPENSEARCH_ROOT}/admin_password.txt with a single line that contains the password followed by a newline"
+    exit 1
+  fi
+fi
+
+salt=$(openssl rand -hex 8)
+
+# Generate the hash using OpenBSD-style Blowfish-based bcrypt
+HASHED_ADMIN_PASSWORD=$(openssl passwd -bcrypt -salt $salt "$ADMIN_PASSWORD")
+
+# Clear the clearTextPassword variable
+unset ADMIN_PASSWORD
+
+ADMIN_HASH_LINE=$(grep -n 'admin:' "$INTERNAL_USERS_FILE" | cut -f1 -d:)
+
+sed -i "${ADMIN_HASH_LINE}s/.*/  hash: \"$HASHED_ADMIN_PASSWORD\"/" "$INTERNAL_USERS_FILE"
+
 #network.host
 if $SUDO_CMD grep --quiet -i "^network.host" "$OPENSEARCH_CONF_FILE"; then
 	: #already present