Elasticsearch: Security: Migrate tool throws a NPE when not using a password

[elasticmachine]

Original comment by @gmoskovicz:

x-pack version: 6.0 and 6.1

If you run the migration tool command without a password you get a NullPointerException:

bin/x-pack/migrate native -U http://localhost:9200 -u elastic

Response:

starting migration of users and roles...
importing users from [/Users/Gabriel/Documents/ElasticSearch/elasticsearch-6.0.0/config/x-pack/users]...
Exception in thread "main" ElasticsearchException[failed to get users that already exist, skipping user import]; nested: NullPointerException;
    at org.elasticsearch.xpack.security.authc.esnative.ESNativeRealmMigrateTool$MigrateUserOrRoles.importUsers(ESNativeRealmMigrateTool.java:272)
    at org.elasticsearch.xpack.security.authc.esnative.ESNativeRealmMigrateTool$MigrateUserOrRoles.execute(ESNativeRealmMigrateTool.java:149)
    at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:69)
    at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:134)
    at org.elasticsearch.cli.MultiCommand.execute(MultiCommand.java:69)
    at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:134)
    at org.elasticsearch.cli.Command.main(Command.java:90)
    at org.elasticsearch.xpack.security.authc.esnative.ESNativeRealmMigrateTool.main(ESNativeRealmMigrateTool.java:91)
Caused by: java.lang.NullPointerException
    at org.elasticsearch.xpack.security.authc.esnative.ESNativeRealmMigrateTool$MigrateUserOrRoles.postURL(ESNativeRealmMigrateTool.java:179)
    at org.elasticsearch.xpack.security.authc.esnative.ESNativeRealmMigrateTool$MigrateUserOrRoles.getUsersThatExist(ESNativeRealmMigrateTool.java:218)
    at org.elasticsearch.xpack.security.authc.esnative.ESNativeRealmMigrateTool$MigrateUserOrRoles.importUsers(ESNativeRealmMigrateTool.java:270)
    ... 7 more

This is because LINK REDACTED

                            new SecureString(password.value(options).toCharArray())));

[ashishguptak]

Hello, Can I take up this bug? any pointers are much appreciated

[tvernum]

@ashishguptak
You can work on this if you like.
The exception is throw from here: https://github.com/elastic/elasticsearch/blob/6.x/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authc/esnative/ESNativeRealmMigrateTool.java#L166-L168 which assumes that there is always a username and password.

I think the best fix is to make the username and password required. The x-pack user and roles APIs aren't available unless security is enabled, so the tool should always be called with the -u and -p options specified.

joptsimple includes a mechanism for marking arguments as required. That should be sufficient to solve this bug.

[ashishguptak]

thank you @tvernum for the inputs

[thiyagu06]

Any working on this? Or shall I take it up?

[MargaritaSolovyeva]

Hi, I would like to take this up. Is this one still relevant?

[ramneetb]

Hi, Can I take this up ?

[tvernum]

At this point in time, it does not appear that anyone is working on this. Feel free to take it up.

[MiguelFerreira1998]

Hi,
i would like to work on this issue, can I? Any help will be appreciated!

[tvernum]

@MiguelFerreira1998 There is already a PR open for this issue, sorry.