# Kibana Multitenancy not working **URL:** \ **Category:** Search Guard\ **Created:** [May 24, 2018, 4:43pm UTC](https://forum.search-guard.com/t/kibana-multitenancy-not-working/931 "2018-05-24T16:43:52Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Jordano\_Moscoso](https://avatars.discourse-cdn.com/v4/letter/j/ac91a4/32.png) [@Jordano\_Moscoso](https://forum.search-guard.com/u/Jordano_Moscoso)\ **Post date:** [May 24, 2018, 4:43pm UTC](https://forum.search-guard.com/t/kibana-multitenancy-not-working/931/1 "2018-05-24T16:43:52Z")
I successfuly configure multitenancy on kibana but the default tenants are not working, because changes on global and private are shared. This is the sg\_config.yml part for kibana: ``` kibana: server_username: 'kibanaserver' multitenancy_enabled: true index: ".kibana" do_not_fail_on_forbidden: true ``` `` This is the kibana.yml file configuration: server.port: 5601 server.host: 0.0.0.0 elasticsearch.url: “[https://172.17.0.1:9200/](https://172.17.0.1:9200/)” elasticsearch.ssl.verificationMode: “certificate” elasticsearch.ssl.certificate: “/usr/share/kibana/kibanaserver.pem” elasticsearch.ssl.key: “/usr/share/kibana/kibanaserver.key” elasticsearch.ssl.certificateAuthorities: [“/usr/share/kibana/root-ca.pem”] elasticsearch.username: kibanaserver elasticsearch.password: password elasticsearch.requestHeadersWhitelist: [“sgtenant”, “Authorization”, “authorization”] kibana.index: “.kibana” searchguard.allow\_client\_certificates: true searchguard.basicauth.enabled: true searchguard.multitenancy.enabled: true searchguard.multitenancy.tenants.enable\_global: true searchguard.multitenancy.tenants.enable\_private: true `` I want the users to have a private tenant for them but when i change create visualizations on private, they also appear on global. Also i have seen that no new index is created. only .kibana is present. Thanks for your help. I’m testing search-guard in order to buy a license. Im using v6.2.4. PD: I have tried disabling both and using a custom tenant on sg\_roles.yml, but looks like the parser doesnt overwrite the ${user\_name} on tenant names: tenants: “private-${user\_name}”: RW `` ---
**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\ **Post date:** [May 24, 2018, 5:05pm UTC](https://forum.search-guard.com/t/kibana-multitenancy-not-working/931/2 "2018-05-24T17:05:59Z")
Hi, thanks for reporting. This is actually a bug in the current version of the Kibana plugin. It is fixed and will be included in the next release of the Kibana plugin, which is expected early next week. > **···** > > On Thursday, May 24, 2018 at 6:36:17 PM UTC+2, Jordano Moscoso wrote: > > > I successfuly configure multitenancy on kibana but the default tenants are not working, because changes on global and private are shared. > > > This is the sg\_config.yml part for kibana: > > > ``` > > kibana: > > server_username: 'kibanaserver' > > multitenancy_enabled: true > > index: ".kibana" > > do_not_fail_on_forbidden: true > > > > ``` > > > `` > > > > > > > > > This is the kibana.yml file configuration: > > > > > > > > > server.port: 5601 > > server.host: 0.0.0.0 > > elasticsearch.url: “[https://172.17.0.1:9200/](https://172.17.0.1:9200/)” > > elasticsearch.ssl.verificationMode: “certificate” > > elasticsearch.ssl.certificate: “/usr/share/kibana/kibanaserver.pem” > > elasticsearch.ssl.key: “/usr/share/kibana/kibanaserver.key” > > elasticsearch.ssl.certificateAuthorities: [“/usr/share/kibana/root-ca.pem”] > > elasticsearch.username: kibanaserver > > elasticsearch.password: password > > elasticsearch.requestHeadersWhitelist: [“sgtenant”, “Authorization”, “authorization”] > > kibana.index: “.kibana” > > searchguard.allow\_client\_certificates: true > > searchguard.basicauth.enabled: true > > searchguard.multitenancy.enabled: true > > searchguard.multitenancy.tenants.enable\_global: true > > searchguard.multitenancy.tenants.enable\_private: true > > > `` > > > > > > I want the users to have a private tenant for them but when i change create visualizations on private, they also appear on global. > > > > > > Also i have seen that no new index is created. only .kibana is present. > > > > > > Thanks for your help. I’m testing search-guard in order to buy a license. > > > > > > Im using v6.2.4. > > > > > > PD: I have tried disabling both and using a custom tenant on sg\_roles.yml, but looks like the parser doesnt overwrite the ${user\_name} on tenant names: > > > > > > tenants: > > “private-${user\_name}”: RW > > > `` > > > ---
**Author:** ![Jordano\_Moscoso](https://avatars.discourse-cdn.com/v4/letter/j/ac91a4/32.png) [@Jordano\_Moscoso](https://forum.search-guard.com/u/Jordano_Moscoso)\ **Post date:** [May 24, 2018, 6:59pm UTC](https://forum.search-guard.com/t/kibana-multitenancy-not-working/931/3 "2018-05-24T18:59:36Z")
Thanks for response, i will wait for it then. Or can i use the github repo? El El jue, 24 de may. de 2018 a las 12:06, Jochen Kressin [jkressin@floragunn.com](mailto:jkressin@floragunn.com) escribió: > **···** > > > Hi, thanks for reporting. This is actually a bug in the current version of the Kibana plugin. It is fixed and will be included in the next release of the Kibana plugin, which is expected early next week. > > > On Thursday, May 24, 2018 at 6:36:17 PM UTC+2, Jordano Moscoso wrote: > > > > I successfuly configure multitenancy on kibana but the default tenants are not working, because changes on global and private are shared. > > > > This is the sg\_config.yml part for kibana: > > > > ``` > > > kibana: > > > server_username: 'kibanaserver' > > > multitenancy_enabled: true > > > index: ".kibana" > > > do_not_fail_on_forbidden: true > > > > > > ``` > > > > `` > > > > > > > > > > > > This is the kibana.yml file configuration: > > > > > > > > > > > > server.port: 5601 > > > server.host: 0.0.0.0 > > > elasticsearch.url: “[https://172.17.0.1:9200/](https://172.17.0.1:9200/)” > > > elasticsearch.ssl.verificationMode: “certificate” > > > elasticsearch.ssl.certificate: “/usr/share/kibana/kibanaserver.pem” > > > elasticsearch.ssl.key: “/usr/share/kibana/kibanaserver.key” > > > elasticsearch.ssl.certificateAuthorities: [“/usr/share/kibana/root-ca.pem”] > > > elasticsearch.username: kibanaserver > > > elasticsearch.password: password > > > elasticsearch.requestHeadersWhitelist: [“sgtenant”, “Authorization”, “authorization”] > > > kibana.index: “.kibana” > > > searchguard.allow\_client\_certificates: true > > > searchguard.basicauth.enabled: true > > > searchguard.multitenancy.enabled: true > > > searchguard.multitenancy.tenants.enable\_global: true > > > searchguard.multitenancy.tenants.enable\_private: true > > > > `` > > > > > > > > I want the users to have a private tenant for them but when i change create visualizations on private, they also appear on global. > > > > > > > > Also i have seen that no new index is created. only .kibana is present. > > > > > > > > Thanks for your help. I’m testing search-guard in order to buy a license. > > > > > > > > Im using v6.2.4. > > > > > > > > PD: I have tried disabling both and using a custom tenant on sg\_roles.yml, but looks like the parser doesnt overwrite the ${user\_name} on tenant names: > > > > > > > > tenants: > > > “private-${user\_name}”: RW > > > > `` > > > > > > > – > > > > You received this message because you are subscribed to the Google Groups “Search Guard Community Forum” group. > > > > To unsubscribe from this group and stop receiving emails from it, send an email to [search-guard+unsubscribe@googlegroups.com](mailto:search-guard+unsubscribe@googlegroups.com). > > > > To post to this group, send email to [search-guard@googlegroups.com](mailto:search-guard@googlegroups.com). > > > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/e9391dfd-facf-42e9-82d8-f4043258867b%40googlegroups.com](https://groups.google.com/d/msgid/search-guard/e9391dfd-facf-42e9-82d8-f4043258867b%40googlegroups.com?utm_medium=email&utm_source=footer). > > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\ **Post date:** [May 24, 2018, 10:31pm UTC](https://forum.search-guard.com/t/kibana-multitenancy-not-working/931/4 "2018-05-24T22:31:33Z")
I would not recommend it, the test suites are still running and thus we cannot guarantee a stable state in the HEAD of the repos at this point. > **···** > > On Thursday, May 24, 2018 at 8:59:48 PM UTC+2, Jordano Moscoso wrote: > > > Thanks for response, i will wait for it then. Or can i use the github repo? > > > > > > El El jue, 24 de may. de 2018 a las 12:06, Jochen Kressin [jkressin@floragunn.com](mailto:jkressin@floragunn.com) escribió: > > > > Hi, thanks for reporting. This is actually a bug in the current version of the Kibana plugin. It is fixed and will be included in the next release of the Kibana plugin, which is expected early next week. > > > > On Thursday, May 24, 2018 at 6:36:17 PM UTC+2, Jordano Moscoso wrote: > > > > > I successfuly configure multitenancy on kibana but the default tenants are not working, because changes on global and private are shared. > > > > > This is the sg\_config.yml part for kibana: > > > > > ``` > > > > kibana: > > > > server_username: 'kibanaserver' > > > > multitenancy_enabled: true > > > > index: ".kibana" > > > > do_not_fail_on_forbidden: true > > > > > > > > ``` > > > > > `` > > > > > > > > > > > > > > > This is the kibana.yml file configuration: > > > > > > > > > > > > > > > server.port: 5601 > > > > server.host: 0.0.0.0 > > > > elasticsearch.url: “[https://172.17.0.1:9200/](https://172.17.0.1:9200/)” > > > > elasticsearch.ssl.verificationMode: “certificate” > > > > elasticsearch.ssl.certificate: “/usr/share/kibana/kibanaserver.pem” > > > > elasticsearch.ssl.key: “/usr/share/kibana/kibanaserver.key” > > > > elasticsearch.ssl.certificateAuthorities: [“/usr/share/kibana/root-ca.pem”] > > > > elasticsearch.username: kibanaserver > > > > elasticsearch.password: password > > > > elasticsearch.requestHeadersWhitelist: [“sgtenant”, “Authorization”, “authorization”] > > > > kibana.index: “.kibana” > > > > searchguard.allow\_client\_certificates: true > > > > searchguard.basicauth.enabled: true > > > > searchguard.multitenancy.enabled: true > > > > searchguard.multitenancy.tenants.enable\_global: true > > > > searchguard.multitenancy.tenants.enable\_private: true > > > > > `` > > > > > > > > > > I want the users to have a private tenant for them but when i change create visualizations on private, they also appear on global. > > > > > > > > > > Also i have seen that no new index is created. only .kibana is present. > > > > > > > > > > Thanks for your help. I’m testing search-guard in order to buy a license. > > > > > > > > > > Im using v6.2.4. > > > > > > > > > > PD: I have tried disabling both and using a custom tenant on sg\_roles.yml, but looks like the parser doesnt overwrite the ${user\_name} on tenant names: > > > > > > > > > > tenants: > > > > “private-${user\_name}”: RW > > > > > `` > > > > > > > > > – > > > > > > You received this message because you are subscribed to the Google Groups “Search Guard Community Forum” group. > > > > > > To unsubscribe from this group and stop receiving emails from it, send an email to [search-guard+unsubscribe@googlegroups.com](mailto:search-guard+unsubscribe@googlegroups.com). > > > > > > To post to this group, send email to [search-guard@googlegroups.com](mailto:search-guard@googlegroups.com). > > > > > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/e9391dfd-facf-42e9-82d8-f4043258867b%40googlegroups.com](https://groups.google.com/d/msgid/search-guard/e9391dfd-facf-42e9-82d8-f4043258867b%40googlegroups.com?utm_medium=email&utm_source=footer). > > > > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Jordano\_Moscoso](https://avatars.discourse-cdn.com/v4/letter/j/ac91a4/32.png) [@Jordano\_Moscoso](https://forum.search-guard.com/u/Jordano_Moscoso)\ **Post date:** [May 25, 2018, 3:28pm UTC](https://forum.search-guard.com/t/kibana-multitenancy-not-working/931/5 "2018-05-25T15:28:00Z")
Ok, Thanks. El El jue, 24 de may. de 2018 a las 17:31, Jochen Kressin [jkressin@floragunn.com](mailto:jkressin@floragunn.com) escribió: > **···** > > > I would not recommend it, the test suites are still running and thus we cannot guarantee a stable state in the HEAD of the repos at this point. > > > On Thursday, May 24, 2018 at 8:59:48 PM UTC+2, Jordano Moscoso wrote: > > > > > Thanks for response, i will wait for it then. Or can i use the github repo? > > > > > > > > El El jue, 24 de may. de 2018 a las 12:06, Jochen Kressin [jkressin@floragunn.com](mailto:jkressin@floragunn.com) escribió: > > > > > Hi, thanks for reporting. This is actually a bug in the current version of the Kibana plugin. It is fixed and will be included in the next release of the Kibana plugin, which is expected early next week. > > > > > On Thursday, May 24, 2018 at 6:36:17 PM UTC+2, Jordano Moscoso wrote: > > > > > > I successfuly configure multitenancy on kibana but the default tenants are not working, because changes on global and private are shared. > > > > > > This is the sg\_config.yml part for kibana: > > > > > > ``` > > > > > kibana: > > > > > server_username: 'kibanaserver' > > > > > multitenancy_enabled: true > > > > > index: ".kibana" > > > > > do_not_fail_on_forbidden: true > > > > > > > > > > ``` > > > > > > `` > > > > > > > > > > > > > > > > > > This is the kibana.yml file configuration: > > > > > > > > > > > > > > > > > > server.port: 5601 > > > > > server.host: 0.0.0.0 > > > > > elasticsearch.url: “[https://172.17.0.1:9200/](https://172.17.0.1:9200/)” > > > > > elasticsearch.ssl.verificationMode: “certificate” > > > > > elasticsearch.ssl.certificate: “/usr/share/kibana/kibanaserver.pem” > > > > > elasticsearch.ssl.key: “/usr/share/kibana/kibanaserver.key” > > > > > elasticsearch.ssl.certificateAuthorities: [“/usr/share/kibana/root-ca.pem”] > > > > > elasticsearch.username: kibanaserver > > > > > elasticsearch.password: password > > > > > elasticsearch.requestHeadersWhitelist: [“sgtenant”, “Authorization”, “authorization”] > > > > > kibana.index: “.kibana” > > > > > searchguard.allow\_client\_certificates: true > > > > > searchguard.basicauth.enabled: true > > > > > searchguard.multitenancy.enabled: true > > > > > searchguard.multitenancy.tenants.enable\_global: true > > > > > searchguard.multitenancy.tenants.enable\_private: true > > > > > > `` > > > > > > > > > > > > I want the users to have a private tenant for them but when i change create visualizations on private, they also appear on global. > > > > > > > > > > > > Also i have seen that no new index is created. only .kibana is present. > > > > > > > > > > > > Thanks for your help. I’m testing search-guard in order to buy a license. > > > > > > > > > > > > Im using v6.2.4. > > > > > > > > > > > > PD: I have tried disabling both and using a custom tenant on sg\_roles.yml, but looks like the parser doesnt overwrite the ${user\_name} on tenant names: > > > > > > > > > > > > tenants: > > > > > “private-${user\_name}”: RW > > > > > > `` > > > > > > > > > > > – > > > > > > > > You received this message because you are subscribed to the Google Groups “Search Guard Community Forum” group. > > > > > > > > To unsubscribe from this group and stop receiving emails from it, send an email to [search-guard+unsubscribe@googlegroups.com](mailto:search-guard+unsubscribe@googlegroups.com). > > > > > > > > To post to this group, send email to [search-guard@googlegroups.com](mailto:search-guard@googlegroups.com). > > > > > > > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/e9391dfd-facf-42e9-82d8-f4043258867b%40googlegroups.com](https://groups.google.com/d/msgid/search-guard/e9391dfd-facf-42e9-82d8-f4043258867b%40googlegroups.com?utm_medium=email&utm_source=footer). > > > > > > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). > > > – > > > > You received this message because you are subscribed to the Google Groups “Search Guard Community Forum” group. > > > > To unsubscribe from this group and stop receiving emails from it, send an email to [search-guard+unsubscribe@googlegroups.com](mailto:search-guard+unsubscribe@googlegroups.com). > > > > To post to this group, send email to [search-guard@googlegroups.com](mailto:search-guard@googlegroups.com). > > > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/7cd72061-3818-4ff4-a77d-acae92ba454d%40googlegroups.com](https://groups.google.com/d/msgid/search-guard/7cd72061-3818-4ff4-a77d-acae92ba454d%40googlegroups.com?utm_medium=email&utm_source=footer). > > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Jordano\_Moscoso](https://avatars.discourse-cdn.com/v4/letter/j/ac91a4/32.png) [@Jordano\_Moscoso](https://forum.search-guard.com/u/Jordano_Moscoso)\ **Post date:** [May 30, 2018, 2:32pm UTC](https://forum.search-guard.com/t/kibana-multitenancy-not-working/931/6 "2018-05-30T14:32:38Z")
Just to comment that i updated kibana plugin and its working fine. Thanks. El El vie, 25 de may. de 2018 a las 10:28, Jordano Moscoso [osmondhacks@gmail.com](mailto:osmondhacks@gmail.com) escribió: > **···** > > > Ok, Thanks. > > > El El jue, 24 de may. de 2018 a las 17:31, Jochen Kressin [jkressin@floragunn.com](mailto:jkressin@floragunn.com) escribió: > > > > I would not recommend it, the test suites are still running and thus we cannot guarantee a stable state in the HEAD of the repos at this point. > > > > On Thursday, May 24, 2018 at 8:59:48 PM UTC+2, Jordano Moscoso wrote: > > > > > > > Thanks for response, i will wait for it then. Or can i use the github repo? > > > > > > > > > > El El jue, 24 de may. de 2018 a las 12:06, Jochen Kressin [jkressin@floragunn.com](mailto:jkressin@floragunn.com) escribió: > > > > > > Hi, thanks for reporting. This is actually a bug in the current version of the Kibana plugin. It is fixed and will be included in the next release of the Kibana plugin, which is expected early next week. > > > > > > On Thursday, May 24, 2018 at 6:36:17 PM UTC+2, Jordano Moscoso wrote: > > > > > > > I successfuly configure multitenancy on kibana but the default tenants are not working, because changes on global and private are shared. > > > > > > > This is the sg\_config.yml part for kibana: > > > > > > > ``` > > > > > > kibana: > > > > > > server_username: 'kibanaserver' > > > > > > multitenancy_enabled: true > > > > > > index: ".kibana" > > > > > > do_not_fail_on_forbidden: true > > > > > > > > > > > > ``` > > > > > > > `` > > > > > > > > > > > > > > > > > > > > > This is the kibana.yml file configuration: > > > > > > > > > > > > > > > > > > > > > server.port: 5601 > > > > > > server.host: 0.0.0.0 > > > > > > elasticsearch.url: “[https://172.17.0.1:9200/](https://172.17.0.1:9200/)” > > > > > > elasticsearch.ssl.verificationMode: “certificate” > > > > > > elasticsearch.ssl.certificate: “/usr/share/kibana/kibanaserver.pem” > > > > > > elasticsearch.ssl.key: “/usr/share/kibana/kibanaserver.key” > > > > > > elasticsearch.ssl.certificateAuthorities: [“/usr/share/kibana/root-ca.pem”] > > > > > > elasticsearch.username: kibanaserver > > > > > > elasticsearch.password: password > > > > > > elasticsearch.requestHeadersWhitelist: [“sgtenant”, “Authorization”, “authorization”] > > > > > > kibana.index: “.kibana” > > > > > > searchguard.allow\_client\_certificates: true > > > > > > searchguard.basicauth.enabled: true > > > > > > searchguard.multitenancy.enabled: true > > > > > > searchguard.multitenancy.tenants.enable\_global: true > > > > > > searchguard.multitenancy.tenants.enable\_private: true > > > > > > > `` > > > > > > > > > > > > > > I want the users to have a private tenant for them but when i change create visualizations on private, they also appear on global. > > > > > > > > > > > > > > Also i have seen that no new index is created. only .kibana is present. > > > > > > > > > > > > > > Thanks for your help. I’m testing search-guard in order to buy a license. > > > > > > > > > > > > > > Im using v6.2.4. > > > > > > > > > > > > > > PD: I have tried disabling both and using a custom tenant on sg\_roles.yml, but looks like the parser doesnt overwrite the ${user\_name} on tenant names: > > > > > > > > > > > > > > tenants: > > > > > > “private-${user\_name}”: RW > > > > > > > `` > > > > > > > > > > > > > – > > > > > > > > > > You received this message because you are subscribed to the Google Groups “Search Guard Community Forum” group. > > > > > > > > > > To unsubscribe from this group and stop receiving emails from it, send an email to [search-guard+unsubscribe@googlegroups.com](mailto:search-guard+unsubscribe@googlegroups.com). > > > > > > > > > > To post to this group, send email to [search-guard@googlegroups.com](mailto:search-guard@googlegroups.com). > > > > > > > > > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/e9391dfd-facf-42e9-82d8-f4043258867b%40googlegroups.com](https://groups.google.com/d/msgid/search-guard/e9391dfd-facf-42e9-82d8-f4043258867b%40googlegroups.com?utm_medium=email&utm_source=footer). > > > > > > > > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). > > > > – > > > > > > You received this message because you are subscribed to the Google Groups “Search Guard Community Forum” group. > > > > > > To unsubscribe from this group and stop receiving emails from it, send an email to [search-guard+unsubscribe@googlegroups.com](mailto:search-guard+unsubscribe@googlegroups.com). > > > > > > To post to this group, send email to [search-guard@googlegroups.com](mailto:search-guard@googlegroups.com). > > > > > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/7cd72061-3818-4ff4-a77d-acae92ba454d%40googlegroups.com](https://groups.google.com/d/msgid/search-guard/7cd72061-3818-4ff4-a77d-acae92ba454d%40googlegroups.com?utm_medium=email&utm_source=footer). > > > > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).