From a9f198839e89447f63fc359ec49acfd24a509654 Mon Sep 17 00:00:00 2001
From: Craig Perkins <cwperx@amazon.com>
Date: Thu, 19 Mar 2026 12:12:41 -0400
Subject: [PATCH 1/5] Copy scripts from tools to bin/ directory in assembly and
 make scripts agnostic to directory

Signed-off-by: Craig Perkins <cwperx@amazon.com>
---
 build.gradle                                     |  3 +++
 .../security/tools/democonfig/Installer.java     |  4 ++--
 .../tools/democonfig/InstallerTests.java         | 14 +++-----------
 tools/audit_config_migrater.sh                   | 15 ++++++++++++++-
 tools/hash.sh                                    | 16 ++++++++++++++--
 tools/install_demo_configuration.sh              | 15 +++++++++++----
 tools/securityadmin.sh                           | 15 ++++++++++++++-
 7 files changed, 61 insertions(+), 21 deletions(-)

diff --git a/build.gradle b/build.gradle
index 032fb943ac..c13357af55 100644
--- a/build.gradle
+++ b/build.gradle
@@ -448,6 +448,9 @@ bundlePlugin {
     from('config') {
         into 'config'
     }
+    from('tools') {
+        into 'bin'
+    }
     from('tools') {
         into 'tools'
     }
diff --git a/src/main/java/org/opensearch/security/tools/democonfig/Installer.java b/src/main/java/org/opensearch/security/tools/democonfig/Installer.java
index 9f50340b06..6fdcac2e7a 100644
--- a/src/main/java/org/opensearch/security/tools/democonfig/Installer.java
+++ b/src/main/java/org/opensearch/security/tools/democonfig/Installer.java
@@ -258,8 +258,8 @@ void initializeVariables() {
      * Sets the base directory to be used by the script.
      */
     void setBaseDir() {
-        File baseDirFile = new File(SCRIPT_DIR).getParentFile().getParentFile().getParentFile();
-        BASE_DIR = baseDirFile != null ? baseDirFile.getAbsolutePath() : null;
+        File baseDirFile = new File(SCRIPT_DIR);
+        BASE_DIR = baseDirFile.isDirectory() ? baseDirFile.getAbsolutePath() : null;
 
         if (BASE_DIR == null || !new File(BASE_DIR).isDirectory()) {
             System.out.println("DEBUG: basedir does not exist");
diff --git a/src/test/java/org/opensearch/security/tools/democonfig/InstallerTests.java b/src/test/java/org/opensearch/security/tools/democonfig/InstallerTests.java
index 69028a507e..92668d5b28 100644
--- a/src/test/java/org/opensearch/security/tools/democonfig/InstallerTests.java
+++ b/src/test/java/org/opensearch/security/tools/democonfig/InstallerTests.java
@@ -208,15 +208,9 @@ public void testGatherInputs_withAssumeYes() {
 
     @Test
     public void testInitializeVariables_setBaseDir_invalidPath() {
-        String[] invalidScriptDirPath = { "/scriptDir", "-y" };
+        String[] invalidScriptDirPath = { "/nonexistent/opensearch-home", "-y" };
         installer.readOptions(invalidScriptDirPath);
 
-        // If BASE_DIR cannot be determined, a NullPointerException is expected.
-        assertThrows("Expected NullPointerException to be thrown", NullPointerException.class, installer::initializeVariables);
-
-        String[] invalidScriptDirPath2 = { "/opensearch/plugins/opensearch-security/tools", "-y" };
-        installer.readOptions(invalidScriptDirPath2);
-
         installer.setExitHandler(status -> { throw new TestExitException(status); });
         TestExitException ex = assertThrows("Expected exit with status -1", TestExitException.class, installer::initializeVariables);
         assertThat(ex.getStatus(), equalTo(-1));
@@ -233,8 +227,7 @@ public void testSetBaseDir_valid() {
 
         installer.setBaseDir();
 
-        String expectedBaseDirValue = new File(currentDir).getParentFile().getParentFile().getParentFile().getAbsolutePath()
-            + File.separator;
+        String expectedBaseDirValue = new File(currentDir).getAbsolutePath() + File.separator;
         assertThat(installer.BASE_DIR, equalTo(expectedBaseDirValue));
     }
 
@@ -257,8 +250,7 @@ public void testSetOpenSearchVariables_invalidPath() {
         verifyStdOutContainsString("Unable to determine OpenSearch plugins directory. Quit.");
         verifyStdOutContainsString("Unable to determine OpenSearch lib directory. Quit.");
 
-        String expectedBaseDirValue = new File(currentDir).getParentFile().getParentFile().getParentFile().getAbsolutePath()
-            + File.separator;
+        String expectedBaseDirValue = new File(currentDir).getAbsolutePath() + File.separator;
         String expectedOpensearchConfFilePath = expectedBaseDirValue + "config" + File.separator + "opensearch.yml";
         String expectedOpensearchBinDirPath = expectedBaseDirValue + "bin" + File.separator;
         String expectedOpensearchPluginDirPath = expectedBaseDirValue + "plugins" + File.separator;
diff --git a/tools/audit_config_migrater.sh b/tools/audit_config_migrater.sh
index 01b77cf412..4bec1e322b 100755
--- a/tools/audit_config_migrater.sh
+++ b/tools/audit_config_migrater.sh
@@ -15,6 +15,19 @@ else
     DIR="$( cd "$( dirname "$(realpath "$SCRIPT_PATH")" )" && pwd -P)"
 fi
 
+if [ -z "$OPENSEARCH_HOME" ]; then
+  OPENSEARCH_HOME="$DIR"
+  while [ "$OPENSEARCH_HOME" != "/" ] && [ -z "$(ls "$OPENSEARCH_HOME/lib/opensearch-"*.jar 2>/dev/null)" ]; do
+    OPENSEARCH_HOME="$(dirname "$OPENSEARCH_HOME")"
+  done
+  if [ "$OPENSEARCH_HOME" = "/" ]; then
+    echo "Could not locate OpenSearch home. Set OPENSEARCH_HOME manually." >&2
+    exit 1
+  fi
+fi
+
+PLUGIN_DIR="$OPENSEARCH_HOME/plugins/opensearch-security"
+
 BIN_PATH="java"
 
 # now set the path to java: first OPENSEARCH_JAVA_HOME, then JAVA_HOME
@@ -26,4 +39,4 @@ else
     echo "WARNING: nor OPENSEARCH_JAVA_HOME nor JAVA_HOME is set, will use $(which $BIN_PATH)"
 fi
 
-"$BIN_PATH" $JAVA_OPTS -cp "$DIR/../../opendistro_security_ssl/*:$DIR/../*:$DIR/../deps/*:$DIR/../../../lib/*" org.opensearch.security.tools.AuditConfigMigrater "$@"
+"$BIN_PATH" $JAVA_OPTS -cp "$PLUGIN_DIR/*:$PLUGIN_DIR/deps/*:$OPENSEARCH_HOME/lib/*" org.opensearch.security.tools.AuditConfigMigrater "$@"
diff --git a/tools/hash.sh b/tools/hash.sh
index c391232851..9ec5d69c0c 100755
--- a/tools/hash.sh
+++ b/tools/hash.sh
@@ -15,6 +15,19 @@ else
     DIR="$( cd "$( dirname "$(realpath "$SCRIPT_PATH")" )" && pwd -P)"
 fi
 
+if [ -z "$OPENSEARCH_HOME" ]; then
+  OPENSEARCH_HOME="$DIR"
+  while [ "$OPENSEARCH_HOME" != "/" ] && [ -z "$(ls "$OPENSEARCH_HOME/lib/opensearch-"*.jar 2>/dev/null)" ]; do
+    OPENSEARCH_HOME="$(dirname "$OPENSEARCH_HOME")"
+  done
+  if [ "$OPENSEARCH_HOME" = "/" ]; then
+    echo "Could not locate OpenSearch home. Set OPENSEARCH_HOME manually." >&2
+    exit 1
+  fi
+fi
+
+PLUGIN_DIR="$OPENSEARCH_HOME/plugins/opensearch-security"
+
 BIN_PATH="java"
 
 # now set the path to java: first OPENSEARCH_JAVA_HOME, then JAVA_HOME
@@ -26,5 +39,4 @@ else
     echo "WARNING: nor OPENSEARCH_JAVA_HOME nor JAVA_HOME is set, will use $(which $BIN_PATH)"
 fi
 
-
-"$BIN_PATH" $JAVA_OPTS -cp "$DIR/../../opendistro_security_ssl/*:$DIR/../*:$DIR/../deps/*:$DIR/../../../lib/*" org.opensearch.security.tools.Hasher "$@"
+"$BIN_PATH" $JAVA_OPTS -cp "$PLUGIN_DIR/*:$PLUGIN_DIR/deps/*:$OPENSEARCH_HOME/lib/*" org.opensearch.security.tools.Hasher "$@"
diff --git a/tools/install_demo_configuration.sh b/tools/install_demo_configuration.sh
index d3a3ae8f75..75d69548d5 100755
--- a/tools/install_demo_configuration.sh
+++ b/tools/install_demo_configuration.sh
@@ -25,12 +25,19 @@ else
     DIR="$( cd "$( dirname "$(realpath "$SCRIPT_PATH")" )" && pwd -P)"
 fi
 
-
 if [ -z "$OPENSEARCH_HOME" ]; then
-  # move to opensearch root folder and set the variable
-  OPENSEARCH_HOME=`cd "$DIR/../../.."; pwd`
+  OPENSEARCH_HOME="$DIR"
+  while [ "$OPENSEARCH_HOME" != "/" ] && [ -z "$(ls "$OPENSEARCH_HOME/lib/opensearch-"*.jar 2>/dev/null)" ]; do
+    OPENSEARCH_HOME="$(dirname "$OPENSEARCH_HOME")"
+  done
+  if [ "$OPENSEARCH_HOME" = "/" ]; then
+    echo "Could not locate OpenSearch home. Set OPENSEARCH_HOME manually." >&2
+    exit 1
+  fi
 fi
 
+PLUGIN_DIR="$OPENSEARCH_HOME/plugins/opensearch-security"
+
 # now set the path to java: OPENSEARCH_JAVA_HOME -> JAVA_HOME -> bundled JRE -> bundled JDK
 if [ -n "$OPENSEARCH_JAVA_HOME" ]; then
   JAVA="$OPENSEARCH_JAVA_HOME/bin/java"
@@ -61,4 +68,4 @@ if [ ! -x "$JAVA" ]; then
     exit 1
 fi
 
-"$JAVA" -Dorg.apache.logging.log4j.simplelog.StatusLogger.level=OFF -cp "$DIR/../*:$DIR/../../../lib/*:$DIR/../deps/*" org.opensearch.security.tools.democonfig.Installer "$DIR" "$@" 2>/dev/null
+"$JAVA" -Dorg.apache.logging.log4j.simplelog.StatusLogger.level=OFF -cp "$PLUGIN_DIR/*:$PLUGIN_DIR/deps/*:$OPENSEARCH_HOME/lib/*" org.opensearch.security.tools.democonfig.Installer "$OPENSEARCH_HOME" "$@" 2>/dev/null
diff --git a/tools/securityadmin.sh b/tools/securityadmin.sh
index 91fb8271c5..824f17ce00 100755
--- a/tools/securityadmin.sh
+++ b/tools/securityadmin.sh
@@ -15,6 +15,19 @@ else
     DIR="$( cd "$( dirname "$(realpath "$SCRIPT_PATH")" )" && pwd -P)"
 fi
 
+if [ -z "$OPENSEARCH_HOME" ]; then
+  OPENSEARCH_HOME="$DIR"
+  while [ "$OPENSEARCH_HOME" != "/" ] && [ -z "$(ls "$OPENSEARCH_HOME/lib/opensearch-"*.jar 2>/dev/null)" ]; do
+    OPENSEARCH_HOME="$(dirname "$OPENSEARCH_HOME")"
+  done
+  if [ "$OPENSEARCH_HOME" = "/" ]; then
+    echo "Could not locate OpenSearch home. Set OPENSEARCH_HOME manually." >&2
+    exit 1
+  fi
+fi
+
+PLUGIN_DIR="$OPENSEARCH_HOME/plugins/opensearch-security"
+
 BIN_PATH="java"
 
 # now set the path to java: first OPENSEARCH_JAVA_HOME, then JAVA_HOME
@@ -26,4 +39,4 @@ else
     echo "WARNING: nor OPENSEARCH_JAVA_HOME nor JAVA_HOME is set, will use $(which $BIN_PATH)"
 fi
 
-"$BIN_PATH" $JAVA_OPTS -Dorg.apache.logging.log4j.simplelog.StatusLogger.level=OFF -cp "$DIR/../*:$DIR/../../../lib/*:$DIR/../deps/*" org.opensearch.security.tools.SecurityAdmin "$@" 2>/dev/null
+"$BIN_PATH" $JAVA_OPTS -Dorg.apache.logging.log4j.simplelog.StatusLogger.level=OFF -cp "$PLUGIN_DIR/*:$PLUGIN_DIR/deps/*:$OPENSEARCH_HOME/lib/*" org.opensearch.security.tools.SecurityAdmin "$@" 2>/dev/null

From 0099c54b68e6e6b7785ae4cd00b2653693d8bacf Mon Sep 17 00:00:00 2001
From: Craig Perkins <cwperx@amazon.com>
Date: Thu, 19 Mar 2026 12:22:29 -0400
Subject: [PATCH 2/5] Add to CHANGELOG

Signed-off-by: Craig Perkins <cwperx@amazon.com>
---
 CHANGELOG.md | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 40d5c99b13..99040b5fc6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,17 +7,18 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 ### Added
 
 ### Changed
+- Copy scripts from tools to bin/ directory in assembly and make scripts agnostic to directory ([#6023](https://github.com/opensearch-project/security/pull/6023))
 
 ### Features
 
 ### Enhancements
 - Make security plugin aware of FIPS build param (-Pcrypto.standard=FIPS-140-3) ([#5952](https://github.com/opensearch-project/security/pull/5952))
-- Hardens input validation for resource sharing APIs ([#5831](https://github.com/opensearch-project/security/pull/5831)
+- Hardens input validation for resource sharing APIs ([#5831](https://github.com/opensearch-project/security/pull/5831))
 - Optimize getFieldFilter to only return a predicate when index has FLS restrictions for user ([#5777](https://github.com/opensearch-project/security/pull/5777))
-- Make encryption_key optional for obo token authenticator ([#6017](https://github.com/opensearch-project/security/pull/6017)
+- Make encryption_key optional for obo token authenticator ([#6017](https://github.com/opensearch-project/security/pull/6017))
 
 ### Bug Fixes
-- Fix audit log writing errors for rollover-enabled alias indices ([#5878](https://github.com/opensearch-project/security/pull/5878)
+- Fix audit log writing errors for rollover-enabled alias indices ([#5878](https://github.com/opensearch-project/security/pull/5878))
 - Fix the issue of unprocessed X-Request-Id ([#5954](https://github.com/opensearch-project/security/pull/5954))
 - Improve DLS error message to identify undefined user attributes when query substitution fails ([#5975](https://github.com/opensearch-project/security/pull/5975))
 

From 27c87935e85f743097bc3f4b4ca18bba077e2169 Mon Sep 17 00:00:00 2001
From: Craig Perkins <cwperx@amazon.com>
Date: Thu, 19 Mar 2026 12:25:04 -0400
Subject: [PATCH 3/5] Update batch script

Signed-off-by: Craig Perkins <cwperx@amazon.com>
---
 tools/audit_config_migrater.bat      | 18 ++++++++++-
 tools/hash.bat                       | 45 ++++++++++++++++++----------
 tools/install_demo_configuration.bat | 24 ++++++++++-----
 tools/securityadmin.bat              | 44 ++++++++++++++++++---------
 4 files changed, 94 insertions(+), 37 deletions(-)

diff --git a/tools/audit_config_migrater.bat b/tools/audit_config_migrater.bat
index 78f1b1abc0..a25cb7104b 100644
--- a/tools/audit_config_migrater.bat
+++ b/tools/audit_config_migrater.bat
@@ -1,6 +1,22 @@
 @echo off
 set DIR=%~dp0
 
+if not defined OPENSEARCH_HOME (
+  set "OPENSEARCH_HOME=%DIR%"
+  :find_home
+  if exist "%OPENSEARCH_HOME%lib\opensearch-*.jar" goto found_home
+  for %%I in ("%OPENSEARCH_HOME%.") do set "PARENT=%%~dpI"
+  if "%PARENT%" == "%OPENSEARCH_HOME%" (
+    echo Could not locate OpenSearch home. Set OPENSEARCH_HOME manually. 1>&2
+    exit /b 1
+  )
+  set "OPENSEARCH_HOME=%PARENT%"
+  goto find_home
+  :found_home
+)
+
+set "PLUGIN_DIR=%OPENSEARCH_HOME%plugins\opensearch-security"
+
 if defined OPENSEARCH_JAVA_HOME (
   set BIN_PATH="%OPENSEARCH_JAVA_HOME%\bin\java.exe"
 ) else if defined JAVA_HOME (
@@ -11,4 +27,4 @@ if defined OPENSEARCH_JAVA_HOME (
   exit /b 1
 )
 
-%BIN_PATH% -cp "%DIR%\..\*;%DIR%\..\..\..\lib\*;%DIR%\..\deps\*" org.opensearch.security.tools.AuditConfigMigrater %*
+%BIN_PATH% -cp "%PLUGIN_DIR%\*;%PLUGIN_DIR%\deps\*;%OPENSEARCH_HOME%lib\*" org.opensearch.security.tools.AuditConfigMigrater %*
diff --git a/tools/hash.bat b/tools/hash.bat
index a50611465c..653c59ccf7 100644
--- a/tools/hash.bat
+++ b/tools/hash.bat
@@ -1,15 +1,30 @@
-@echo off
-set DIR=%~dp0
-
-if defined OPENSEARCH_JAVA_HOME (
-  set BIN_PATH="%OPENSEARCH_JAVA_HOME%\bin\java.exe"
-) else if defined JAVA_HOME (
-  set BIN_PATH="%JAVA_HOME%\bin\java.exe"
-) else (
-  echo Unable to find java runtime
-  echo OPENSEARCH_JAVA_HOME or JAVA_HOME must be defined
-  exit /b 1
-)
-
-%BIN_PATH% -cp "%DIR%\..\*;%DIR%\..\..\..\lib\*;%DIR%\..\deps\*" org.opensearch.security.tools.Hasher %*
-
+@echo off
+set DIR=%~dp0
+
+if not defined OPENSEARCH_HOME (
+  set "OPENSEARCH_HOME=%DIR%"
+  :find_home
+  if exist "%OPENSEARCH_HOME%lib\opensearch-*.jar" goto found_home
+  for %%I in ("%OPENSEARCH_HOME%.") do set "PARENT=%%~dpI"
+  if "%PARENT%" == "%OPENSEARCH_HOME%" (
+    echo Could not locate OpenSearch home. Set OPENSEARCH_HOME manually. 1>&2
+    exit /b 1
+  )
+  set "OPENSEARCH_HOME=%PARENT%"
+  goto find_home
+  :found_home
+)
+
+set "PLUGIN_DIR=%OPENSEARCH_HOME%plugins\opensearch-security"
+
+if defined OPENSEARCH_JAVA_HOME (
+  set BIN_PATH="%OPENSEARCH_JAVA_HOME%\bin\java.exe"
+) else if defined JAVA_HOME (
+  set BIN_PATH="%JAVA_HOME%\bin\java.exe"
+) else (
+  echo Unable to find java runtime
+  echo OPENSEARCH_JAVA_HOME or JAVA_HOME must be defined
+  exit /b 1
+)
+
+%BIN_PATH% -cp "%PLUGIN_DIR%\*;%PLUGIN_DIR%\deps\*;%OPENSEARCH_HOME%lib\*" org.opensearch.security.tools.Hasher %*
diff --git a/tools/install_demo_configuration.bat b/tools/install_demo_configuration.bat
index 5cf4d715fa..3dc9b69823 100755
--- a/tools/install_demo_configuration.bat
+++ b/tools/install_demo_configuration.bat
@@ -1,14 +1,24 @@
 @echo off
 set DIR=%~dp0
-
 set CUR_DIR=%DIR%
 
-rem set opensearch home for instances when using bundled jdk
 if not defined OPENSEARCH_HOME (
-  for %%I in ("%DIR%..\..\..") do set "OPENSEARCH_HOME=%%~dpfI"
+  set "OPENSEARCH_HOME=%DIR%"
+  :find_home
+  if exist "%OPENSEARCH_HOME%lib\opensearch-*.jar" goto found_home
+  for %%I in ("%OPENSEARCH_HOME%.") do set "PARENT=%%~dpI"
+  if "%PARENT%" == "%OPENSEARCH_HOME%" (
+    echo Could not locate OpenSearch home. Set OPENSEARCH_HOME manually. 1>&2
+    exit /b 1
+  )
+  set "OPENSEARCH_HOME=%PARENT%"
+  goto find_home
+  :found_home
 )
 cd %CUR_DIR%
 
+set "PLUGIN_DIR=%OPENSEARCH_HOME%plugins\opensearch-security"
+
 if not "%OPENSEARCH_JAVA_HOME%" == "" (
   set "JAVA=%OPENSEARCH_JAVA_HOME%\bin\java.exe"
   set JAVA_TYPE=OPENSEARCH_JAVA_HOME
@@ -16,14 +26,14 @@ if not "%OPENSEARCH_JAVA_HOME%" == "" (
   set "JAVA=%JAVA_HOME%\bin\java.exe"
   set JAVA_TYPE=JAVA_HOME
 ) else (
-  set "JAVA=%OPENSEARCH_HOME%\jdk\bin\java.exe"
-  set "JAVA_HOME=%OPENSEARCH_HOME%\jdk"
+  set "JAVA=%OPENSEARCH_HOME%jdk\bin\java.exe"
+  set "JAVA_HOME=%OPENSEARCH_HOME%jdk"
   set JAVA_TYPE=bundled jdk
 )
 
 if not exist "%JAVA%" (
-  echo "could not find java in %JAVA_TYPE% at %JAVA%" >&2
+  echo "could not find java in %JAVA_TYPE% at %JAVA%" 1>&2
   exit /b 1
 )
 
-"%JAVA%" -Dorg.apache.logging.log4j.simplelog.StatusLogger.level=OFF -cp "%DIR%\..\*;%DIR%\..\..\..\lib\*;%DIR%\..\deps\*" org.opensearch.security.tools.democonfig.Installer %DIR% %* 2> nul
+"%JAVA%" -Dorg.apache.logging.log4j.simplelog.StatusLogger.level=OFF -cp "%PLUGIN_DIR%\*;%PLUGIN_DIR%\deps\*;%OPENSEARCH_HOME%lib\*" org.opensearch.security.tools.democonfig.Installer "%OPENSEARCH_HOME%" %* 2> nul
diff --git a/tools/securityadmin.bat b/tools/securityadmin.bat
index a44562b6d9..ad39fa4ba2 100644
--- a/tools/securityadmin.bat
+++ b/tools/securityadmin.bat
@@ -1,14 +1,30 @@
-@echo off
-set DIR=%~dp0
-
-if defined OPENSEARCH_JAVA_HOME (
-  set BIN_PATH="%OPENSEARCH_JAVA_HOME%\bin\java.exe"
-) else if defined JAVA_HOME (
-  set BIN_PATH="%JAVA_HOME%\bin\java.exe"
-) else (
-  echo Unable to find java runtime
-  echo OPENSEARCH_JAVA_HOME or JAVA_HOME must be defined
-  exit /b 1
-)
-
-%BIN_PATH% -Dorg.apache.logging.log4j.simplelog.StatusLogger.level=OFF -cp "%DIR%\..\*;%DIR%\..\..\..\lib\*;%DIR%\..\deps\*" org.opensearch.security.tools.SecurityAdmin %* 2> nul
\ No newline at end of file
+@echo off
+set DIR=%~dp0
+
+if not defined OPENSEARCH_HOME (
+  set "OPENSEARCH_HOME=%DIR%"
+  :find_home
+  if exist "%OPENSEARCH_HOME%lib\opensearch-*.jar" goto found_home
+  for %%I in ("%OPENSEARCH_HOME%.") do set "PARENT=%%~dpI"
+  if "%PARENT%" == "%OPENSEARCH_HOME%" (
+    echo Could not locate OpenSearch home. Set OPENSEARCH_HOME manually. 1>&2
+    exit /b 1
+  )
+  set "OPENSEARCH_HOME=%PARENT%"
+  goto find_home
+  :found_home
+)
+
+set "PLUGIN_DIR=%OPENSEARCH_HOME%plugins\opensearch-security"
+
+if defined OPENSEARCH_JAVA_HOME (
+  set BIN_PATH="%OPENSEARCH_JAVA_HOME%\bin\java.exe"
+) else if defined JAVA_HOME (
+  set BIN_PATH="%JAVA_HOME%\bin\java.exe"
+) else (
+  echo Unable to find java runtime
+  echo OPENSEARCH_JAVA_HOME or JAVA_HOME must be defined
+  exit /b 1
+)
+
+%BIN_PATH% -Dorg.apache.logging.log4j.simplelog.StatusLogger.level=OFF -cp "%PLUGIN_DIR%\*;%PLUGIN_DIR%\deps\*;%OPENSEARCH_HOME%lib\*" org.opensearch.security.tools.SecurityAdmin %* 2> nul

From 816e8a413c554ca9c12d99c84398a8d98727da7f Mon Sep 17 00:00:00 2001
From: Craig Perkins <cwperx@amazon.com>
Date: Thu, 19 Mar 2026 12:38:19 -0400
Subject: [PATCH 4/5] Attempt to fix Windows

Signed-off-by: Craig Perkins <cwperx@amazon.com>
---
 tools/audit_config_migrater.bat      | 24 ++++++++++++------------
 tools/hash.bat                       | 24 ++++++++++++------------
 tools/install_demo_configuration.bat | 26 +++++++++++++-------------
 tools/securityadmin.bat              | 24 ++++++++++++------------
 4 files changed, 49 insertions(+), 49 deletions(-)

diff --git a/tools/audit_config_migrater.bat b/tools/audit_config_migrater.bat
index a25cb7104b..60e8add703 100644
--- a/tools/audit_config_migrater.bat
+++ b/tools/audit_config_migrater.bat
@@ -1,19 +1,19 @@
 @echo off
 set DIR=%~dp0
 
-if not defined OPENSEARCH_HOME (
-  set "OPENSEARCH_HOME=%DIR%"
-  :find_home
-  if exist "%OPENSEARCH_HOME%lib\opensearch-*.jar" goto found_home
-  for %%I in ("%OPENSEARCH_HOME%.") do set "PARENT=%%~dpI"
-  if "%PARENT%" == "%OPENSEARCH_HOME%" (
-    echo Could not locate OpenSearch home. Set OPENSEARCH_HOME manually. 1>&2
-    exit /b 1
-  )
-  set "OPENSEARCH_HOME=%PARENT%"
-  goto find_home
-  :found_home
+if defined OPENSEARCH_HOME goto find_home_done
+
+set "OPENSEARCH_HOME=%DIR%"
+:find_home
+if exist "%OPENSEARCH_HOME%lib\opensearch-*.jar" goto find_home_done
+for %%I in ("%OPENSEARCH_HOME%.") do set "PARENT=%%~dpI"
+if "%PARENT%" == "%OPENSEARCH_HOME%" (
+  echo Could not locate OpenSearch home. Set OPENSEARCH_HOME manually. 1>&2
+  exit /b 1
 )
+set "OPENSEARCH_HOME=%PARENT%"
+goto find_home
+:find_home_done
 
 set "PLUGIN_DIR=%OPENSEARCH_HOME%plugins\opensearch-security"
 
diff --git a/tools/hash.bat b/tools/hash.bat
index 653c59ccf7..dbe509e86d 100644
--- a/tools/hash.bat
+++ b/tools/hash.bat
@@ -1,19 +1,19 @@
 @echo off
 set DIR=%~dp0
 
-if not defined OPENSEARCH_HOME (
-  set "OPENSEARCH_HOME=%DIR%"
-  :find_home
-  if exist "%OPENSEARCH_HOME%lib\opensearch-*.jar" goto found_home
-  for %%I in ("%OPENSEARCH_HOME%.") do set "PARENT=%%~dpI"
-  if "%PARENT%" == "%OPENSEARCH_HOME%" (
-    echo Could not locate OpenSearch home. Set OPENSEARCH_HOME manually. 1>&2
-    exit /b 1
-  )
-  set "OPENSEARCH_HOME=%PARENT%"
-  goto find_home
-  :found_home
+if defined OPENSEARCH_HOME goto find_home_done
+
+set "OPENSEARCH_HOME=%DIR%"
+:find_home
+if exist "%OPENSEARCH_HOME%lib\opensearch-*.jar" goto find_home_done
+for %%I in ("%OPENSEARCH_HOME%.") do set "PARENT=%%~dpI"
+if "%PARENT%" == "%OPENSEARCH_HOME%" (
+  echo Could not locate OpenSearch home. Set OPENSEARCH_HOME manually. 1>&2
+  exit /b 1
 )
+set "OPENSEARCH_HOME=%PARENT%"
+goto find_home
+:find_home_done
 
 set "PLUGIN_DIR=%OPENSEARCH_HOME%plugins\opensearch-security"
 
diff --git a/tools/install_demo_configuration.bat b/tools/install_demo_configuration.bat
index 3dc9b69823..aa7b1a61e6 100755
--- a/tools/install_demo_configuration.bat
+++ b/tools/install_demo_configuration.bat
@@ -2,19 +2,19 @@
 set DIR=%~dp0
 set CUR_DIR=%DIR%
 
-if not defined OPENSEARCH_HOME (
-  set "OPENSEARCH_HOME=%DIR%"
-  :find_home
-  if exist "%OPENSEARCH_HOME%lib\opensearch-*.jar" goto found_home
-  for %%I in ("%OPENSEARCH_HOME%.") do set "PARENT=%%~dpI"
-  if "%PARENT%" == "%OPENSEARCH_HOME%" (
-    echo Could not locate OpenSearch home. Set OPENSEARCH_HOME manually. 1>&2
-    exit /b 1
-  )
-  set "OPENSEARCH_HOME=%PARENT%"
-  goto find_home
-  :found_home
+if defined OPENSEARCH_HOME goto find_home_done
+
+set "OPENSEARCH_HOME=%DIR%"
+:find_home
+if exist "%OPENSEARCH_HOME%lib\opensearch-*.jar" goto find_home_done
+for %%I in ("%OPENSEARCH_HOME%.") do set "PARENT=%%~dpI"
+if "%PARENT%" == "%OPENSEARCH_HOME%" (
+  echo Could not locate OpenSearch home. Set OPENSEARCH_HOME manually. 1>&2
+  exit /b 1
 )
+set "OPENSEARCH_HOME=%PARENT%"
+goto find_home
+:find_home_done
 cd %CUR_DIR%
 
 set "PLUGIN_DIR=%OPENSEARCH_HOME%plugins\opensearch-security"
@@ -32,7 +32,7 @@ if not "%OPENSEARCH_JAVA_HOME%" == "" (
 )
 
 if not exist "%JAVA%" (
-  echo "could not find java in %JAVA_TYPE% at %JAVA%" 1>&2
+  echo could not find java in %JAVA_TYPE% at %JAVA% 1>&2
   exit /b 1
 )
 
diff --git a/tools/securityadmin.bat b/tools/securityadmin.bat
index ad39fa4ba2..3fc0fa68cd 100644
--- a/tools/securityadmin.bat
+++ b/tools/securityadmin.bat
@@ -1,19 +1,19 @@
 @echo off
 set DIR=%~dp0
 
-if not defined OPENSEARCH_HOME (
-  set "OPENSEARCH_HOME=%DIR%"
-  :find_home
-  if exist "%OPENSEARCH_HOME%lib\opensearch-*.jar" goto found_home
-  for %%I in ("%OPENSEARCH_HOME%.") do set "PARENT=%%~dpI"
-  if "%PARENT%" == "%OPENSEARCH_HOME%" (
-    echo Could not locate OpenSearch home. Set OPENSEARCH_HOME manually. 1>&2
-    exit /b 1
-  )
-  set "OPENSEARCH_HOME=%PARENT%"
-  goto find_home
-  :found_home
+if defined OPENSEARCH_HOME goto find_home_done
+
+set "OPENSEARCH_HOME=%DIR%"
+:find_home
+if exist "%OPENSEARCH_HOME%lib\opensearch-*.jar" goto find_home_done
+for %%I in ("%OPENSEARCH_HOME%.") do set "PARENT=%%~dpI"
+if "%PARENT%" == "%OPENSEARCH_HOME%" (
+  echo Could not locate OpenSearch home. Set OPENSEARCH_HOME manually. 1>&2
+  exit /b 1
 )
+set "OPENSEARCH_HOME=%PARENT%"
+goto find_home
+:find_home_done
 
 set "PLUGIN_DIR=%OPENSEARCH_HOME%plugins\opensearch-security"
 

From b53dd76a5864933307bc5d175d3a374fde7aa33a Mon Sep 17 00:00:00 2001
From: Craig Perkins <cwperx@amazon.com>
Date: Thu, 19 Mar 2026 12:48:51 -0400
Subject: [PATCH 5/5] Normalize the input

Signed-off-by: Craig Perkins <cwperx@amazon.com>
---
 tools/install_demo_configuration.bat | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/tools/install_demo_configuration.bat b/tools/install_demo_configuration.bat
index aa7b1a61e6..25ca38fe47 100755
--- a/tools/install_demo_configuration.bat
+++ b/tools/install_demo_configuration.bat
@@ -36,4 +36,7 @@ if not exist "%JAVA%" (
   exit /b 1
 )
 
-"%JAVA%" -Dorg.apache.logging.log4j.simplelog.StatusLogger.level=OFF -cp "%PLUGIN_DIR%\*;%PLUGIN_DIR%\deps\*;%OPENSEARCH_HOME%lib\*" org.opensearch.security.tools.democonfig.Installer "%OPENSEARCH_HOME%" %* 2> nul
+set "OPENSEARCH_HOME_ARG=%OPENSEARCH_HOME%"
+if "%OPENSEARCH_HOME_ARG:~-1%" == "\" set "OPENSEARCH_HOME_ARG=%OPENSEARCH_HOME_ARG:~0,-1%"
+
+"%JAVA%" -Dorg.apache.logging.log4j.simplelog.StatusLogger.level=OFF -cp "%PLUGIN_DIR%\*;%PLUGIN_DIR%\deps\*;%OPENSEARCH_HOME%lib\*" org.opensearch.security.tools.democonfig.Installer "%OPENSEARCH_HOME_ARG%" %* 2> nul