From 1890c7244a303efdab47768ca7d6a3c82d0beb4b Mon Sep 17 00:00:00 2001
From: m0duspwnens <josh.patterson@securityonionsolutions.com>
Date: Tue, 9 Nov 2021 18:25:17 -0500
Subject: [PATCH] set elasticsearch:auth to persist through user pw change

---
 salt/elasticsearch/auth.sls | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/salt/elasticsearch/auth.sls b/salt/elasticsearch/auth.sls
index 4864b4502..2a0dd9f59 100644
--- a/salt/elasticsearch/auth.sls
+++ b/salt/elasticsearch/auth.sls
@@ -6,6 +6,7 @@
   {% set so_logstash_user_pass = salt['pillar.get']('elasticsearch:auth:users:so_logstash_user:pass', salt['random.get_str'](72)) %}
   {% set so_beats_user_pass = salt['pillar.get']('elasticsearch:auth:users:so_beats_user:pass', salt['random.get_str'](72)) %}
   {% set so_monitor_user_pass = salt['pillar.get']('elasticsearch:auth:users:so_monitor_user:pass', salt['random.get_str'](72)) %}
+  {% set auth_enabled = salt['pillar.get']('elasticsearch:auth:enabled', False) %}
 
 elastic_auth_pillar:
   file.managed:
@@ -15,7 +16,7 @@ elastic_auth_pillar:
     - contents: |
         elasticsearch:
           auth:
-            enabled: True
+            enabled: {{ auth_enabled }}
             users:
               so_elastic_user:
                 user: so_elastic