# Kibana dashboard\_only\_user login error

**URL:** <https://forum.search-guard.com/t/kibana-dashboard-only-user-login-error/2235>\
**Category:** Search Guard\
**Created:** [November 1, 2021, 8:49am UTC](https://forum.search-guard.com/t/kibana-dashboard-only-user-login-error/2235 "2021-11-01T08:49:20Z")\
**Posts on this page:** 14\
**Page:** 1

<div class="post-metadata">

**Author:** ![peter82](https://avatars.discourse-cdn.com/v4/letter/p/9e8a1a/32.png) [@peter82](https://forum.search-guard.com/u/peter82)\
**Post date:** [November 1, 2021, 8:49am UTC](https://forum.search-guard.com/t/kibana-dashboard-only-user-login-error/2235/1 "2021-11-01T08:49:20Z")

</div>

Elastic/Kibana  
7.10.2  
search-guard-7  
Version: 7.10.2-52.3.0

## Steps to reproduce:

I followed your steps to configure kibana dashboard only user [support for kibana\_dashboard\_only\_user](https://forum.search-guard.com/t/support-for-kibana-dashboard-only-user/840) but I am not able to login. I am getting “No application was found at this URL. Try going back or choosing an app from the menu.”

No matter what I set as default Route I am being forwarded to “[https://kibana.com/basePath/app/kibana#/dashboards](https://kibana.com/basePath/app/kibana#/dashboards)” and getting “Application Not Found” Error. If I rewrite the URL to “[https://kibana.com/basePath/app/dashboards#](https://kibana.com/basePath/app/dashboards#)” I land to dashboard space of “kiosek” tenant and everything works as expected. Looks like the only impacted user with this is dashboard only user “do” in this case.

My setup:

## sg\_roles.yml

```auto
read_only:
  cluster_permissions:
  - "CLUSTER_COMPOSITE_OPS_RO"
  index_permissions:
  - index_patterns:
    - "*"
    allowed_actions:
    - "SGS_READ"
    fls:
    masked_fields: []
  tenant_permissions:
  - tenant_patterns:
    - "kiosek"
    allowed_actions:
    - "SGS_KIBANA_ALL_READ"

```

## sg\_internal\_user.yml

```auto
do:
  hash: "$2y$12$v/dJK3of2GF/VTyqy8RIT.Ib/Uj8Ne6zdpT5F27JdRG4AHj7sSck."
  reserved: false
  description: "Kibana dashboard only user"
  search_guard_roles:
  - "SGS_KIBANA_USER"
  - "read_only"

```

## kibana.yml

```auto
searchguard.readonly_mode.roles: ["read_only"]

```

## defaultRoute in kibana advanced settings I’ve tried:

- /app/home
- /app/dashboards
- /app/dashboards#

## kibana.yml I’ve tried with or without defaultAppId settings

kibana.defaultAppId: dashboards

---

<div class="post-metadata">

**Author:** ![sirHusky](https://avatars.discourse-cdn.com/v4/letter/s/e9a140/32.png) [@sirHusky](https://forum.search-guard.com/u/sirHusky)\
**Post date:** [November 1, 2021, 10:43am UTC](https://forum.search-guard.com/t/kibana-dashboard-only-user-login-error/2235/2 "2021-11-01T10:43:52Z")

</div>

@peter82  
I don’t fully follow the issue.

The permissions that were defined are only for 1 tenant (kiosek). Therefore only user that has access to this tenant will be able to see the dashboards.

DefaultRoute can be left at default of /app/home.

When the user logs in, he/she would need to select the relevant tenant and then click on dashboards and any dashboards in that tenant should be visible. If the user has no read access to the tenant the “Application Not Found” label will be visible.

Is this not the behaviour you are seeing? If not, can you share the full kibana.yml and is there a reason for using base\_path?

---

<div class="post-metadata">

**Author:** ![peter82](https://avatars.discourse-cdn.com/v4/letter/p/9e8a1a/32.png) [@peter82](https://forum.search-guard.com/u/peter82)\
**Post date:** [November 1, 2021, 11:02am UTC](https://forum.search-guard.com/t/kibana-dashboard-only-user-login-error/2235/3 "2021-11-01T11:02:23Z")

</div>

Yes that’s what I am seeing but I don’t want this user to choose the tenant, instead I want “do” user to be automatically directed to tenant “kiosek”, because he has permissions to see only this tenant. I posted the setup for the user, can you see the issue ?

I am using basePath because that’s how we access kibana via apache reverse proxy.

THx, Peter.

---

<div class="post-metadata">

**Author:** ![sirHusky](https://avatars.discourse-cdn.com/v4/letter/s/e9a140/32.png) [@sirHusky](https://forum.search-guard.com/u/sirHusky)\
**Post date:** [November 1, 2021, 11:20am UTC](https://forum.search-guard.com/t/kibana-dashboard-only-user-login-error/2235/4 "2021-11-01T11:20:10Z")

</div>

@peter82  
You will need to set up preferred tenant using below line in kibana.yml

`searchguard.multitenancy.tenants.preferred: ["kiosek", "global_tenant"]`

Further documentation is available [here](https://docs.search-guard.com/latest/kibana-multi-tenancy#kibana-multitenancy)

---

<div class="post-metadata">

**Author:** ![peter82](https://avatars.discourse-cdn.com/v4/letter/p/9e8a1a/32.png) [@peter82](https://forum.search-guard.com/u/peter82)\
**Post date:** [November 1, 2021, 11:37am UTC](https://forum.search-guard.com/t/kibana-dashboard-only-user-login-error/2235/5 "2021-11-01T11:37:34Z")

</div>

Hmm but I already have tried that and with different tenants order as well… ok here is my

## kibana.yml the SG part:

```auto
#####################SSOSG############################################
searchguard.auth.type: "basicauth"
#searchguard.auth.type: "saml"
searchguard.cookie.isSameSite: None
searchguard.cookie.secure: true
searchguard.cookie.name: "cookie_env_app" # unique name
searchguard.cookie.password: "xxx"

searchguard.session.keepalive: true

server.xsrf.whitelist: ["/searchguard/saml/acs", "/searchguard/saml/logout"]
elasticsearch.requestHeadersWhitelist: ["sgtenant", "authorization", "Authorization", "X-Forwarded-For", "x-proxy-user", "x-proxy-roles", "urltoken", "jwtheader"]

searchguard.auth.debug: true

# prevent system users from logging to kibana
searchguard.basicauth.forbidden_usernames: ["kibanaserver"]

# enable multitenancy
searchguard.multitenancy.enabled: true

#disable private tenant
searchguard.multitenancy.tenants.enable_private: false

#disable global tenant
searchguard.multitenancy.tenants.enable_global: false

# tenants
searchguard.multitenancy.tenants.preferred: ["tenant1","tenant2", "kiosek"]

# readonly roles
searchguard.readonly_mode.roles: ["read_only"]

```

## sg\_tenants.yml

```auto
tenant1:
  reserved: false
  description: "Tenant for application user"

tenant2:
  reserved: false
  description: "Tenant for application user"

kiosek:
  reserved: false
  description: "kiosek tenant"

```

 ![error_kiosek](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/2X/7/7b6b993bf88d269eeff400497169b3956e720380.jpeg)

---

<div class="post-metadata">

**Author:** ![peter82](https://avatars.discourse-cdn.com/v4/letter/p/9e8a1a/32.png) [@peter82](https://forum.search-guard.com/u/peter82)\
**Post date:** [November 1, 2021, 1:02pm UTC](https://forum.search-guard.com/t/kibana-dashboard-only-user-login-error/2235/6 "2021-11-01T13:02:41Z")

</div>

Ok the 403 error is not related to the issue, every user was getting it during logon.

“res”:{“statusCode”:403,“responseTime”:30,“contentLength”:9},“message”:“POST  
api/v1/searchguard\_authtokens/authtoken/\_search 403 30ms - 9.0B”}

I updated cluster\_permissions for the role, nonetheless original login issue remains.

```auto
read_only:
  cluster_permissions:
  - "CLUSTER_COMPOSITE_OPS_RO"
  - "cluster:admin:searchguard:authtoken/_own/search" # Could you explain what is it for ?

```

“res”:{“statusCode”:200,“responseTime”:21,“contentLength”:9},“message”:“POST /api/v1/searchguard\_authtokens/authtoken/\_search 200 21ms - 9.0B”}

---

<div class="post-metadata">

**Author:** ![sirHusky](https://avatars.discourse-cdn.com/v4/letter/s/e9a140/32.png) [@sirHusky](https://forum.search-guard.com/u/sirHusky)\
**Post date:** [November 1, 2021, 7:23pm UTC](https://forum.search-guard.com/t/kibana-dashboard-only-user-login-error/2235/7 "2021-11-01T19:23:38Z")

</div>

@peter82  
Does the “do” user have access to “tenant1” or “tenant2” and when you login as “do” user what tenant is selected under “multitenancy” tab.

---

<div class="post-metadata">

**Author:** ![peter82](https://avatars.discourse-cdn.com/v4/letter/p/9e8a1a/32.png) [@peter82](https://forum.search-guard.com/u/peter82)\
**Post date:** [November 2, 2021, 7:40am UTC](https://forum.search-guard.com/t/kibana-dashboard-only-user-login-error/2235/8 "2021-11-02T07:40:48Z")

</div>

No “do” user does not have access to “tenant1” or “tenant2” but it makes no difference if it has. I’ve tried to make “do” user with unlimited cluster + index access + all tenants and its still the same. The user is stuck at “Application not found” banner after login, so it can’t select anything.

But my case scenario is I don’t want this user to have access to another tenants and dashboards. Why when I literally just change the URL path:

from [https://kibana.domain.com/basePath/app/kibana#/dashboards](https://kibana.domain.com/basePath/app/kibana#/dashboards)  
to [https://kibana.domain.com/basePath/app/dashboards](https://kibana.domain.com/basePath/app/dashboards)

the user “do” is redirected to “kiosek” tenant, able to see only kiosek tenant and has dashboard only rights, everything works. Seems to me the problem is elsewhere then in roles and users.

---

<div class="post-metadata">

**Author:** ![sirHusky](https://avatars.discourse-cdn.com/v4/letter/s/e9a140/32.png) [@sirHusky](https://forum.search-guard.com/u/sirHusky)\
**Post date:** [November 2, 2021, 8:56am UTC](https://forum.search-guard.com/t/kibana-dashboard-only-user-login-error/2235/9 "2021-11-02T08:56:01Z")

</div>

@peter82 I’m not able to reproduce the behaviour, in my case the user is assigned the first tenant in “searchguard.multitenancy.tenants.preferred” that he/she has access to.  
They are directed to [http://localhost:5601/app/home#/](http://localhost:5601/app/home#/), and after selecting dashboards, directed to /app/dashboards#/list?\_g=…

Also, if the user has no access to any other tenant, the multitenacy tab is not available, as there is no other option for the user anyway.

What tenant is automatically selected in multitenacy tab when you log in as user “do”?

---

<div class="post-metadata">

**Author:** ![peter82](https://avatars.discourse-cdn.com/v4/letter/p/9e8a1a/32.png) [@peter82](https://forum.search-guard.com/u/peter82)\
**Post date:** [November 2, 2021, 10:07am UTC](https://forum.search-guard.com/t/kibana-dashboard-only-user-login-error/2235/10 "2021-11-02T10:07:00Z")

</div>

if I disable read only mode in kibana.yml and restart kibana, then user “do” is able to login and see only kiosek tenant which is being automatically assigned to him but of course then he can see all parts of kibana Discover/devtools etc.

---

<div class="post-metadata">

**Author:** ![sirHusky](https://avatars.discourse-cdn.com/v4/letter/s/e9a140/32.png) [@sirHusky](https://forum.search-guard.com/u/sirHusky)\
**Post date:** [November 2, 2021, 10:23am UTC](https://forum.search-guard.com/t/kibana-dashboard-only-user-login-error/2235/11 "2021-11-02T10:23:53Z")

</div>

@peter82  
From terminal, could you run the below command for “do” user and paste the response here?

`curl --insecure -u<username>:<password> -XGET "https://<opendistro>:9200/_searchguard/authinfo?pretty"`

---

<div class="post-metadata">

**Author:** ![peter82](https://avatars.discourse-cdn.com/v4/letter/p/9e8a1a/32.png) [@peter82](https://forum.search-guard.com/u/peter82)\
**Post date:** [November 2, 2021, 10:27am UTC](https://forum.search-guard.com/t/kibana-dashboard-only-user-login-error/2235/12 "2021-11-02T10:27:03Z")

</div>

```auto
:~$ curl -u 'do:do' -k -H 'Content-Type: application/json' -XGET 'https://elastic.com:9201/_searchguard/authinfo?pretty'
{
  "user" : "User do <basic/internal> [sg_roles=[read_only, SGS_KIBANA_USER]]",
  "user_name" : "do",
  "user_requested_tenant" : null,
  "remote_address" : "ip:22662",
  "backend_roles" : [],
  "custom_attribute_names" : [],
  "attribute_names" : [],
  "sg_roles" : [
    "SGS_KIBANA_USER",
    "read_only"
  ],
  "sg_tenants" : {
    "kiosek" : false,
    "SGS_GLOBAL_TENANT" : true,
    "do" : true
  },
  "principal" : null,
  "peer_certificates" : "0",
  "sso_logout_url" : null
}

```

---

<div class="post-metadata">

**Author:** ![peter82](https://avatars.discourse-cdn.com/v4/letter/p/9e8a1a/32.png) [@peter82](https://forum.search-guard.com/u/peter82)\
**Post date:** [November 2, 2021, 12:10pm UTC](https://forum.search-guard.com/t/kibana-dashboard-only-user-login-error/2235/13 "2021-11-02T12:10:20Z")

</div>

I was able to fix the login error by disabling spaces, apparently it conflicts with searchguard implementation of multitenacy. @sirHusky this settings is deprecated in 7 and won’t be available in els 8, just saying 🙂

```auto
xpack.spaces.enabled: false

```

Readonly mode works as expected now. Thanks a lot for help.

---

<div class="post-metadata">

**Author:** ![system](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/system/32/1870_2.png) [@system](https://forum.search-guard.com/u/system)\
**Post date:** [November 23, 2021, 12:10pm UTC](https://forum.search-guard.com/t/kibana-dashboard-only-user-login-error/2235/14 "2021-11-23T12:10:54Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.