Kibana permissions

It’s unclear to me what exactly needs to be done to give a user access to kibana.
What minimum permissions are needed for the following 2 roles:

  1. full read access for tenant foo
  2. read/write access for tenant ‘foo’


Use the built-in roles.

A minimal set of roles for a Kibana user:

  1. Full read access: SGS_KIBANA_USER and SGS_READALL.
  2. Full read/write access: SGS_KIBANA_USER and SGS_ALL_ACCESS.

If you want to check what set of permissions defines these roles, switch the System items in SG UI.

sounds a bit too much. I gave the SGS_KIBANA_USER role and specific access to some indices, but that’s not enough because index-pattern management seems not possible

There should be an error in the Elasticsearch log then. Show me it.

[2020-10-15T14:05:42,175][INFO ][c.f.s.p.PrivilegesEvaluator] [node01] No index-level perm match for User [name=fwernli, backend_roles=[], requestedTenant=null] Resolved [aliases=[*], indices=[*], allIndices=[*], types=[*], originalRequested=[], remoteIndices=[]] [Action [indices:admin/resolve/index]] [RolesChecked [site, cta_query_human, grafana_admin, SGS_KIBANA_USER]]
[2020-10-15T14:05:42,176][INFO ][c.f.s.p.PrivilegesEvaluator] [node01] No permissions for [indices:admin/resolve/index]

it is also unclear to me what role or privilege is needed for allowing read/write to private kibana tenant

An important thing to keep in mind with multi tenancy is that Kibana tenants and ES access permissions are orthogonal concepts.

The tenant defines which “buckets” of Kibana saved objects (i.e., index patterns, visualisations, …) you are allowed to use. By default, the private tenant is enabled (see searchguard.multitenancy.tenants.enable_private on ). Thus, any authenticated user is allowed to save index patterns in their private tenant/bucket without any further privilege.

The question which indexes a user is allowed to access and which operations a user is allowed to perform is - on the other hand - completely independent of the selected tenant. This is only governed by the index_permissions and cluster_permissions of a user.

1 Like

Thanks for this clarification.
That also means that I probably hit a bug : I do have the private tenant implicitly enabled, but can’t create any index pattern. Oddly, I don’t see any security log message in ES, and kibana only logs the following:

Oct 19 10:54:14 kibana01 kibana[29728]: {"type":"response","@timestamp":"2020-10-19T08:54:14Z","tags":[],"pid":29728,"method":"post","statusCode":403,"req":{"url":"/api/saved_objects/index-pattern","method":"post","headers":{"host":"","user-agent":"Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0","accept":"*/*","accept-language":"en,en-US;q=0.8,fr;q=0.5,de;q=0.3","accept-encoding":"gzip, deflate, br","referer":"","content-type":"application/json","kbn-version":"7.9.1","origin":"","content-length":"78","dnt":"1","connection":"keep-alive","sgtenant":"__user__"},"remoteAddress":"","userAgent":"","referer":""},"res":{"statusCode":403,"responseTime":31,"contentLength":9},"message":"POST /api/saved_objects/index-pattern 403 31ms - 9.0B"}

The kibana interface merely says Error: Forbidden

On which versions of ES/SG does this error occur?

search-guard-7 7.9.1-45.0.0

Did you enable do_not_fail_on_forbidden? If not, could you enable it and try again?

The option is enabled, yes