Unable to restore snapshot from URL repository with basic authentication - elasticsearch

Question

Problem:
I'm trying to create snapshot on ES instance ES1, and restore to another instance ES2. It fails to restore when the remote URL requires basic authentication.
ES version: 6.5.4
Success and failure cases:
Success case: When the website exposing the ES1 repository folder is open to the internet (no authentication), the listing/restore works fine. For example when the repo URL is "http://snapshots.example-server.com"
Failure case: When I add basic authentication to the same URL, it doesn't work. For example when the repo URL is: "http://username:password#snapshots.example-server.com"
When I try to list snapshots in the URL repository with basic authentication, the error I get is:
{
"error": {
"root_cause": [
{
"type": "repository_exception",
"reason": "[remote-repo] could not read repository data from index blob"
}
],
"type": "repository_exception",
"reason": "[remote-repo] could not read repository data from index blob",
"caused_by": {
"type": "i_o_exception",
"reason": "Server returned HTTP response code: 401 for URL: http://username:password#snapshots.example-server.com/index.latest"
}
},
"status": 500
}
The Setup:
Setting up ES1:
Step 1: Modify config file:
path.repo: ["/path/to/es1_repo"]
Step 2: Creating the repo:
PUT /_snapshot/es1_repo
{
"type": "fs",
"settings": {
"location": "/path/to/es1_repo"
}
}
Step 3: Making the repository path accessible from internet:
I have setup an nginx server on the ES1 machine, to expose "/path/to/es1_repo” directory listing, let's say at: http://snapshots.example-server.com. It has basic authentication enabled. You could, for example, access the repo as http://username:password#snapshots.example-server.com and you would see the directory listing.
Step 4: Create the snapshot:
PUT /_snapshot/es1_repo/snapshot_1?wait_for_completion=true
{
"indices": "the_index_name",
"ignore_unavailable": true,
"include_global_state": false
}
Setting up ES2:
Step 5: Add to elastic config:
repositories.url.allowed_urls: "http://username:password#snapshots.example-server.com"
Step 6: Register repo
PUT _snapshot/remote-repo
{
"type": "url",
"settings": {
"url": "http://username:password#snapshots.example-server.com"
}
}
Step 7: Check if the snapshot is accessible:
GET _snapshot/remote-repo/_all
At this step the error pasted at the top appears. If I disable basic authentication, it works fine.
What could be the issue here?

Answer 1

You should make these:
Add to whitelist the repository in elasticsearch.yaml or docker environment
repositories.url.allowed_urls: "http://snapshots.example-server.com"
Create the snapshots repository
PUT _snapshot/remote-repo
{
"type": "url",
"settings": {
"url": "http://snapshots.example-server.com",
"client": "your_client",
}
}
Add username and password to the Elasticsearch keystore
bin/elasticsearch-keystore add url.client.your_client.username
bin/elasticsearch-keystore add url.client.your_client.password