# Kibana no permissions for \[indices:data/read/search\]

**URL:** <https://forum.search-guard.com/t/kibana-no-permissions-for-indices-data-read-search/1321>\
**Category:** Search Guard\
**Created:** [February 7, 2019, 5:30pm UTC](https://forum.search-guard.com/t/kibana-no-permissions-for-indices-data-read-search/1321 "2019-02-07T17:30:14Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Martin](https://avatars.discourse-cdn.com/v4/letter/m/73ab20/32.png) [@Martin](https://forum.search-guard.com/u/Martin)\
**Post date:** [February 7, 2019, 5:30pm UTC](https://forum.search-guard.com/t/kibana-no-permissions-for-indices-data-read-search/1321/1 "2019-02-07T17:30:14Z")

</div>

Hi,

I am sure I have seen an answer to this in this forum somewhere but I can’t find it.

**sg\_internal\_users.yml**

martin:

hash:

readonly: ‘true’

roles: [kibanauser, customer]

**sg\_roles\_mapping.yml**

sg\_kibana\_user:

backendroles:

- “kibanauser”

sg\_customer:

readonly: true

backendroles:

- “customer”

**sg\_roles.yml**

sg\_kibana\_user:

\<default settings from [https://github.com/floragunncom/search-guard/blob/master/sgconfig/sg\_roles.yml](https://github.com/floragunncom/search-guard/blob/master/sgconfig/sg_roles.yml)\>

sg\_customer:

readonly: true

indices:

```
'logstash-${user_name}-*':

  '*':

  - "MANAGE"

  - "INDEX"

  - "READ"

  - "indices:data/read/search*"

```

I tried adding - “indices:data/read/search\*” but this this still gives me no data in my visualisation and an error in kibana no permissions for [indices:data/read/search] and User [name=martin, roles=[kibanauser, customer], requestedTenant=null]]

If I change sg\_customer in **sg\_role.yml**

sg\_customer:

readonly: true

indices:

```
'logstash-${user_name}-*':

  '*':

  - "MANAGE"

  - "INDEX"

  - "READ"

```

**‘logstash-\*’:**

**‘\*’:**

```
  - "indices:data/read/search*"

```

Then I don’t get any errors but all the data is returned in the visualisation. It is not restricted to **logstash-martin-\*,** when I login as the user martin.

I thought I read here somewhere that there is an option I can set in kibana.yml to prevent these permission errors from appearing in the Kibana UI, and I was wondering if that might solve the issue too. i.e. Kibana wont show the entries from matching indices because there are permission errors reading other indices.

Thanks for any help.

---

<div class="post-metadata">

**Author:** ![Martin](https://avatars.discourse-cdn.com/v4/letter/m/73ab20/32.png) [@Martin](https://forum.search-guard.com/u/Martin)\
**Post date:** [February 7, 2019, 7:25pm UTC](https://forum.search-guard.com/t/kibana-no-permissions-for-indices-data-read-search/1321/2 "2019-02-07T19:25:11Z")

</div>

This error occurs when I try and use a visualisation that uses **logstash-\***. If I create a visualisation from **logstash-martin-\*** then I don’t get any permission errors, even without - “indices:data/read/search\*”  
Creating visualisations for every customer will not be scalable.

---

<div class="post-metadata">

**Author:** ![Martin](https://avatars.discourse-cdn.com/v4/letter/m/73ab20/32.png) [@Martin](https://forum.search-guard.com/u/Martin)\
**Post date:** [February 8, 2019, 12:00pm UTC](https://forum.search-guard.com/t/kibana-no-permissions-for-indices-data-read-search/1321/3 "2019-02-08T12:00:16Z")

</div>

I finally found the Kibana option I was looking for. My mistake was thinking it was an option in the kibana.yml, it is an option in sg\_config.yml. It is also described in the [docs](https://docs.search-guard.com/latest/kibana-plugin-installation#configuring-elasticsearch-enable-do-not-fail-on-forbidden)

One line from that doc really scared me:

If you are using the Enterprise Edition of Search Guard, enable the `do not fail on forbidden` mode in `sg_config.yml` like:

I am VERY relieved to find that this works in the community edition too!

---

<div class="post-metadata">

**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\
**Post date:** [February 11, 2019, 7:31am UTC](https://forum.search-guard.com/t/kibana-no-permissions-for-indices-data-read-search/1321/4 "2019-02-11T07:31:01Z")

</div>

I corrected the docs

> **···**
>
> > Am 08.02.2019 um 13:00 schrieb martin.lester@vualto.com:
> > 
> > I finally found the Kibana option I was looking for. My mistake was thinking it was an option in the kibana.yml, it is an option in sg\_config.yml. It is also described in the docs
> > 
> > One line from that doc really scared me:
> > 
> > &nbsp;&nbsp;&nbsp;If you are using the Enterprise Edition of Search Guard, enable the do not fail on forbidden mode in sg\_config.yml like:
> > 
> > I am VERY relieved to find that this works in the community edition too!
> > 
> > --  
> > You received this message because you are subscribed to the Google Groups "Search Guard Community Forum" group.  
> > To unsubscribe from this group and stop receiving emails from it, send an email to search-guard+unsubscribe@googlegroups.com.  
> > To post to this group, send email to search-guard@googlegroups.com.  
> > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/b592de52-055f-4d87-b2c2-64212c913cae%40googlegroups.com\](https://groups.google.com/d/msgid/search-guard/b592de52-055f-4d87-b2c2-64212c913cae%40googlegroups.com%5C).  
> > For more options, visit [https://groups.google.com/d/optout\](https://groups.google.com/d/optout%5C).