ManticoreSearch has published a comprehensive checklist for implementing authentication in production environments. The guide warns that the “set and forget” approach rarely works and outlines a structured process for enabling auth while minimizing disruption.
The document distinguishes between three main topologies: standalone nodes, setups with distributed tables and remote agents, and replication clusters. Each topology requires different preparation steps before authentication is activated.
Inventory and Preparation
Before any configuration changes, administrators are instructed to inventory every client accessing Manticore Search, including search frontends, data-loading workers, cron jobs, BI dashboards, and backup scripts. For each client, teams must record the protocol, target tables, and required permissions.
Additional checks include confirming whether the deployment uses RT-mode or plain-mode, verifying the pid_file setting, and ensuring all nodes support the same authentication protocol. Backups of the data directory, configuration files, manticore.json, and any existing authentication store are mandatory.
User Creation and Least Privilege
The checklist emphasizes creating users for specific tasks rather than broad access. Examples include separate accounts for read-only search operations, data ingestion, schema migrations, and security administration. Each user receives only the minimum rights required, such as GRANT read ON 'products' or GRANT replication ON 'posts'.
Administrators are advised to test both allowed and denied actions for every account. Bearer tokens returned by CREATE USER or TOKEN commands must be stored securely and never left in logs or command history.
Staging Tests and Production Rollout
Testing must first occur in a staging environment that mirrors the production topology. Configuration examples are provided for both RT-mode (auth = 1) and plain-mode (auth = /var/lib/manticore/auth.json).
For production rollout, the guide recommends performing the change inside a planned maintenance window. After enabling authentication, all clients without credentials will be rejected. Teams must update SQL connections with usernames and passwords and configure HTTP clients to use either Basic authentication or Bearer tokens.
Special procedures exist for distributed and replication scenarios to ensure identical authentication stores are deployed across nodes and that cluster users are correctly registered before nodes are restarted.
