# I am not able to create roles with new user  and how to add new role with single index based

**URL:** <https://forum.search-guard.com/t/i-am-not-able-to-create-roles-with-new-user-and-how-to-add-new-role-with-single-index-based/1103>\
**Category:** Search Guard\
**Created:** [September 3, 2018, 11:25am UTC](https://forum.search-guard.com/t/i-am-not-able-to-create-roles-with-new-user-and-how-to-add-new-role-with-single-index-based/1103 "2018-09-03T11:25:53Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Poonam](https://avatars.discourse-cdn.com/v4/letter/p/b38774/32.png) [@Poonam](https://forum.search-guard.com/u/Poonam)\
**Post date:** [September 3, 2018, 11:25am UTC](https://forum.search-guard.com/t/i-am-not-able-to-create-roles-with-new-user-and-how-to-add-new-role-with-single-index-based/1103/1 "2018-09-03T11:25:53Z")

</div>

When asking questions, please provide the following information:

- Search Guard and Elasticsearch version

- Installed and used enterprise modules, if any

- JVM version and operating system version

- Search Guard configuration files

- Elasticsearch log messages on debug level

- Other installed Elasticsearch or Kibana plugins, if any

---

<div class="post-metadata">

**Author:** ![Poonam](https://avatars.discourse-cdn.com/v4/letter/p/b38774/32.png) [@Poonam](https://forum.search-guard.com/u/Poonam)\
**Post date:** [September 3, 2018, 11:43am UTC](https://forum.search-guard.com/t/i-am-not-able-to-create-roles-with-new-user-and-how-to-add-new-role-with-single-index-based/1103/2 "2018-09-03T11:43:35Z")

</div>

> I am using search guard community version.  
> \*Elasticsearch version- 6.4.0

- Search Guard version - [23.0](https://oss.sonatype.org/service/local/repositories/releases/content/com/floragunn/search-guard-6/6.4.0-23.0/search-guard-6-6.4.0-23.0.zip)

> - Installed and used enterprise modules, if any -no

I have created 2 new users nitu and poonam with two new roles niturole and poonamrole. I am able to access these users from kibana GUI but not able to access their readonly role. I can see dashboard only in admin role not even in read modes of other roles as well and how to configure new role with a specific index studentdb where I can see only its index data with readall role.

I was using search guard demo script for POC

**this is my search guard sg\_roles.yml**

# Allows everything, but no changes to searchguard configuration index

sg\_all\_access:  
readonly: true  
cluster:  
- UNLIMITED  
indices:  
‘_':  
'_’:  
- UNLIMITED  
tenants:  
admin\_tenant: RW

# Read all, but no write permissions

sg\_readall:  
readonly: true  
cluster:  
- CLUSTER\_COMPOSITE\_OPS\_RO  
indices:  
‘_':  
'_’:  
- UNLIMITED  
#a new role for only reading content  
**sg\_niturole:**  
readonly: true  
cluster:  
- CLUSTER\_COMPOSITE\_OPS\_RO  
indices:  
‘studentdb’:  
‘\*’:  
- INDICES\_ALL

**sg\_poonamrole:**  
readonly: true  
cluster:  
- CLUSTER\_COMPOSITE\_OPS\_RO  
indices:  
‘_':  
'_’:  
- MANAGE  
- INDEX  
- READ  
- SEARCH

# Read all and monitor, but no write permissions

sg\_readall\_and\_monitor:  
cluster:  
- CLUSTER\_MONITOR  
- CLUSTER\_COMPOSITE\_OPS\_RO  
indices:  
‘_':  
'_’:  
- READ

# For users which use kibana, access to indices must be granted separately

sg\_kibana\_user:  
readonly: true  
cluster:  
- INDICES\_MONITOR  
- CLUSTER\_COMPOSITE\_OPS  
indices:  
‘?kibana’:  
‘_':  
- MANAGE  
- INDEX  
- READ  
- DELETE  
‘?kibana-6’:  
'_’:  
- MANAGE  
- INDEX  
- READ  
- DELETE  
‘_':  
'_’:  
- indices:data/read/field\_caps\*

# For the kibana server

sg\_kibana\_server:  
readonly: true  
cluster:  
- CLUSTER\_MONITOR  
- CLUSTER\_COMPOSITE\_OPS  
- cluster:admin/xpack/monitoring\*  
- indices:admin/template\*  
indices:  
‘?kibana’:  
‘_':  
- INDICES\_ALL  
‘?kibana-6’:  
'_’:  
- INDICES\_ALL  
‘?reporting\*’:  
‘_':  
- INDICES\_ALL  
'?monitoring_’:  
‘\*’:  
- INDICES\_ALL

**This is my sg\_roles\_mapping.yml file**

sg\_all\_access:  
readonly: true  
backendroles:  
- admin  
sg\_logstash:  
backendroles:  
- logstash

sg\_kibana\_server:  
readonly: true  
users:  
- kibanaserver

sg\_kibana\_user:  
backendroles:  
- kibanauser  
sg\_readall:  
readonly: true  
backendroles:  
- readall  
sg\_manage\_snapshots:  
readonly: true  
backendroles:  
- snapshotrestore  
sg\_own\_index:  
users:  
- ‘\*’  
**sg\_niturole:**  
readonly: true  
backendroles:  
- admin  
**sg\_poonamrole:**  
readonly: true  
backendroles:  
- readall  
- search  
- data\_access

**this is my sg\_internal\_users.yml**

#password is: admin  
admin:  
readonly: true  
hash: $2a$12$VcCDgh2NDk07JGN0rjGbM.Ad41qVR/YFJcgHp0UGns5JDymv..TOG  
roles:  
- admin  
attributes:  
#no dots allowed in attribute names  
attribute1: value1  
attribute2: value2  
attribute3: value3  
#password is: logstash  
logstash:  
hash: $2a$12$u1ShR4l4uBS3Uv59Pa2y5.1uQuZBrZtmNfqB3iM/.jL0XoV9sghS2  
roles:  
- logstash  
#password is: kibanaserver  
kibanaserver:  
readonly: true  
hash: $2y$12$MRkUaL4Q6WPDbr6rgTVZ1.a8Xm.hps8Q0ONc2Yh6FJTQG0TdgVug2  
#password is: kibanaro  
kibanaro:  
hash: $2a$12$JJSXNfTowz7Uu5ttXfeYpeYE0arACvcwlPBStB1F.MI7f0U9Z4DGC  
roles:  
- kibanauser  
- readall  
#password is: readall  
readall:  
hash: $2a$12$ae4ycwzwvLtZxwZ82RmiEunBbIPiAmGZduBAjKN0TXdwQFtCwARz2  
#password is: readall  
roles:  
- readall  
#password is: snapshotrestore  
snapshotrestore:  
hash: $2y$12$DpwmetHKwgYnorbgdvORCenv4NAK8cPUg8AI6pxLCuWf/ALc0.v7W  
roles:  
- snapshotrestore

# password is :poonam

**poonam:**  
hash: $2y$12$MRkUaL4Q6WPDbr6rgTVZ1.a8Xm.hps8Q0ONc2Yh6FJTQG0TdgVug2  
roles:  
- poonamrole

# password is :nitu

**nitu:**  
hash: $2y$12$jaGYV6N7niIpdNyrBMAgh.9.TyIR62jH.masyku3YnsdMoOBzEvI2  
roles:  
- niturole

---

<div class="post-metadata">

**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\
**Post date:** [September 5, 2018, 11:56pm UTC](https://forum.search-guard.com/t/i-am-not-able-to-create-roles-with-new-user-and-how-to-add-new-role-with-single-index-based/1103/3 "2018-09-05T23:56:50Z")

</div>

Your role mapping does not seem correct, you are not mapping the backend roles of your users to the respective SG roles.

With this definition here:

# password is :poonam

poonam:  
hash: $2y$12$MRkUaL4Q6WPDbr6rgTVZ1.a8Xm.hps8Q0ONc2Yh6FJTQG0TdgVug2  
roles:  
- poonamrole

# password is :nitu

nitu:  
hash: $2y$12$jaGYV6N7niIpdNyrBMAgh.9.TyIR62jH.masyku3YnsdMoOBzEvI2  
roles:  
- niturole

``

You are assigning niturole and poonamrole to your users. You need to use these in the roles mapping:

**sg\_niturole:**  
readonly: true  
backendroles:  
- niturole  
**sg\_poonamrole:**  
readonly: true  
backendroles:  
- poonamrole

If you do not require any sophisticated role mapping, you can also set the mapping mode to BACKENDROLES\_ONLY:

[https://docs.search-guard.com/latest/role-mapping-modes](https://docs.search-guard.com/latest/role-mapping-modes)

Then you don’t need a roles mapping, and you can use the roles you define in sg\_internal\_users.yml directly, like:

internal users:

# password is :poonam

poonam:  
hash: $2y$12$MRkUaL4Q6WPDbr6rgTVZ1.a8Xm.hps8Q0ONc2Yh6FJTQG0TdgVug2  
roles:  
- poonamrole

# password is :nitu

nitu:  
hash: $2y$12$jaGYV6N7niIpdNyrBMAgh.9.TyIR62jH.masyku3YnsdMoOBzEvI2  
roles:  
- niturole

sg\_roles.yml:

niturole:

readonly: true

cluster:

- CLUSTER\_COMPOSITE\_OPS\_RO

indices:

‘studentdb’:

‘\*’:

- INDICES\_ALL

poonamrole:

readonly: true

cluster:

- CLUSTER\_COMPOSITE\_OPS\_RO

indices:

‘\*’:

‘\*’:

- MANAGE

- INDEX

- READ

- SEARCH

``

> **···**
>
> On Monday, September 3, 2018 at 7:43:35 AM UTC-4, Poonam wrote:
> 
> > > I am using search guard community version.  
> > > \*Elasticsearch version- 6.4.0
> 
> > - Search Guard version - [23.0](https://oss.sonatype.org/service/local/repositories/releases/content/com/floragunn/search-guard-6/6.4.0-23.0/search-guard-6-6.4.0-23.0.zip)
> 
> > > - Installed and used enterprise modules, if any -no
> 
> > I have created 2 new users nitu and poonam with two new roles niturole and poonamrole. I am able to access these users from kibana GUI but not able to access their readonly role. I can see dashboard only in admin role not even in read modes of other roles as well and how to configure new role with a specific index studentdb where I can see only its index data with readall role.
> 
> > 
> 
> > 
> 
> > 
> 
> > I was using search guard demo script for POC
> 
> > 
> 
> > **this is my search guard sg\_roles.yml**
> 
> > 
> 
> > # Allows everything, but no changes to searchguard configuration index
> > 
> > sg\_all\_access:  
> > readonly: true  
> > cluster:  
> > - UNLIMITED  
> > indices:  
> > ‘_':  
> > '_’:  
> > - UNLIMITED  
> > tenants:  
> > admin\_tenant: RW
> > 
> > # Read all, but no write permissions
> > 
> > sg\_readall:  
> > readonly: true  
> > cluster:  
> > - CLUSTER\_COMPOSITE\_OPS\_RO  
> > indices:  
> > ‘_':  
> > '_’:  
> > - UNLIMITED  
> > #a new role for only reading content  
> > **sg\_niturole:**  
> > readonly: true  
> > cluster:  
> > - CLUSTER\_COMPOSITE\_OPS\_RO  
> > indices:  
> > ‘studentdb’:  
> > ‘\*’:  
> > - INDICES\_ALL
> > 
> > **sg\_poonamrole:**  
> > readonly: true  
> > cluster:  
> > - CLUSTER\_COMPOSITE\_OPS\_RO  
> > indices:  
> > ‘_':  
> > '_’:  
> > - MANAGE  
> > - INDEX  
> > - READ  
> > - SEARCH
> > 
> > # Read all and monitor, but no write permissions
> > 
> > sg\_readall\_and\_monitor:  
> > cluster:  
> > - CLUSTER\_MONITOR  
> > - CLUSTER\_COMPOSITE\_OPS\_RO  
> > indices:  
> > ‘_':  
> > '_’:  
> > - READ
> > 
> > # For users which use kibana, access to indices must be granted separately
> > 
> > sg\_kibana\_user:  
> > readonly: true  
> > cluster:  
> > - INDICES\_MONITOR  
> > - CLUSTER\_COMPOSITE\_OPS  
> > indices:  
> > ‘?kibana’:  
> > ‘_':  
> > - MANAGE  
> > - INDEX  
> > - READ  
> > - DELETE  
> > ‘?kibana-6’:  
> > '_’:  
> > - MANAGE  
> > - INDEX  
> > - READ  
> > - DELETE  
> > ‘_':  
> > '_’:  
> > - indices:data/read/field\_caps\*
> > 
> > # For the kibana server
> > 
> > sg\_kibana\_server:  
> > readonly: true  
> > cluster:  
> > - CLUSTER\_MONITOR  
> > - CLUSTER\_COMPOSITE\_OPS  
> > - cluster:admin/xpack/monitoring\*  
> > - indices:admin/template\*  
> > indices:  
> > ‘?kibana’:  
> > ‘_':  
> > - INDICES\_ALL  
> > ‘?kibana-6’:  
> > '_’:  
> > - INDICES\_ALL  
> > ‘?reporting\*’:  
> > ‘_':  
> > - INDICES\_ALL  
> > '?monitoring_’:  
> > ‘\*’:  
> > - INDICES\_ALL
> 
> > 
> 
> > 
> 
> > 
> 
> > 
> 
> > 
> 
> > **This is my sg\_roles\_mapping.yml file**
> 
> > sg\_all\_access:  
> > readonly: true  
> > backendroles:  
> > - admin  
> > sg\_logstash:  
> > backendroles:  
> > - logstash
> > 
> > sg\_kibana\_server:  
> > readonly: true  
> > users:  
> > - kibanaserver
> > 
> > sg\_kibana\_user:  
> > backendroles:  
> > - kibanauser  
> > sg\_readall:  
> > readonly: true  
> > backendroles:  
> > - readall  
> > sg\_manage\_snapshots:  
> > readonly: true  
> > backendroles:  
> > - snapshotrestore  
> > sg\_own\_index:  
> > users:  
> > - ‘\*’  
> > **sg\_niturole:**  
> > readonly: true  
> > backendroles:  
> > - admin  
> > **sg\_poonamrole:**  
> > readonly: true  
> > backendroles:  
> > - readall  
> > - search  
> > - data\_access
> 
> > 
> 
> > 
> 
> > 
> 
> > **this is my sg\_internal\_users.yml**
> 
> > 
> 
> > #password is: admin  
> > admin:  
> > readonly: true  
> > hash: $2a$12$VcCDgh2NDk07JGN0rjGbM.Ad41qVR/YFJcgHp0UGns5JDymv..TOG  
> > roles:  
> > - admin  
> > attributes:  
> > #no dots allowed in attribute names  
> > attribute1: value1  
> > attribute2: value2  
> > attribute3: value3  
> > #password is: logstash  
> > logstash:  
> > hash: $2a$12$u1ShR4l4uBS3Uv59Pa2y5.1uQuZBrZtmNfqB3iM/.jL0XoV9sghS2  
> > roles:  
> > - logstash  
> > #password is: kibanaserver  
> > kibanaserver:  
> > readonly: true  
> > hash: $2y$12$MRkUaL4Q6WPDbr6rgTVZ1.a8Xm.hps8Q0ONc2Yh6FJTQG0TdgVug2  
> > #password is: kibanaro  
> > kibanaro:  
> > hash: $2a$12$JJSXNfTowz7Uu5ttXfeYpeYE0arACvcwlPBStB1F.MI7f0U9Z4DGC  
> > roles:  
> > - kibanauser  
> > - readall  
> > #password is: readall  
> > readall:  
> > hash: $2a$12$ae4ycwzwvLtZxwZ82RmiEunBbIPiAmGZduBAjKN0TXdwQFtCwARz2  
> > #password is: readall  
> > roles:  
> > - readall  
> > #password is: snapshotrestore  
> > snapshotrestore:  
> > hash: $2y$12$DpwmetHKwgYnorbgdvORCenv4NAK8cPUg8AI6pxLCuWf/ALc0.v7W  
> > roles:  
> > - snapshotrestore
> > 
> > # password is :poonam
> > 
> > **poonam:**  
> > hash: $2y$12$MRkUaL4Q6WPDbr6rgTVZ1.a8Xm.hps8Q0ONc2Yh6FJTQG0TdgVug2  
> > roles:  
> > - poonamrole
> > 
> > # password is :nitu
> > 
> > **nitu:**  
> > hash: $2y$12$jaGYV6N7niIpdNyrBMAgh.9.TyIR62jH.masyku3YnsdMoOBzEvI2  
> > roles:  
> > - niturole