# LDAP auth for ES no bypass or execute filters at all for action indices:monitor/status

**URL:** <https://forum.search-guard.com/t/ldap-auth-for-es-no-bypass-or-execute-filters-at-all-for-action-indices-monitor-status/135>\
**Category:** Search Guard\
**Created:** [March 21, 2016, 6:38pm UTC](https://forum.search-guard.com/t/ldap-auth-for-es-no-bypass-or-execute-filters-at-all-for-action-indices-monitor-status/135 "2016-03-21T18:38:47Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Cds\_Support](https://avatars.discourse-cdn.com/v4/letter/c/3e96dc/32.png) [@Cds\_Support](https://forum.search-guard.com/u/Cds_Support)\
**Post date:** [March 21, 2016, 6:38pm UTC](https://forum.search-guard.com/t/ldap-auth-for-es-no-bypass-or-execute-filters-at-all-for-action-indices-monitor-status/135/1 "2016-03-21T18:38:47Z")

</div>

Hello,

I’m trying to do auth through our posix LDAP. I’m trying to configure search-guard where any user in the admins LDAP group has full (read/write) access to all indexes. Then any user in the kibana-users LDAP group has read/write on .kibana index and read to logstash-\* indexes. Everything works fine without search-guard enabled so my ELK stack has been working before enabling search-guard.

Below are the versions for our two node (server) ELK stack on CentOS 6.7.

Logstash 1.5.3

Elasticsearch 1.7.1

Kibana 4.0.1

Redis 2.8.6

search-guard 1.7.3.0

Our posix LDAP tree is below.

root DSE: cn=posix

group base: cn=groups,cn=posix

admin group: cn=admins,cn=groups,cn=posix \<----Attribute for users in this group is memberUid

kibana-users group: cn=kibana-users,cn=groups,cn=posix \<----Attribute for users in this group is memberUid

user base: cn=users,cn=posix \<----Attribute for users in this group is uid

Below is my search-guard config section of the elasticsearch.yml file.

### Search-guard plugin config

searchguard.enabled: true

searchguard.ssl.transport.http.enabled: false

searchguard.allow\_all\_from\_loopback: true

searchguard.key\_path: /snapshot/search-guard-keys/preprod/

searchguard.http.xforwardedfor.header: DUMMY

searchguard.authentication.authentication\_backend.impl: com.floragunn.searchguard.authentication.backend.ldap.LDAPAuthenticationBackend

searchguard.authentication.authentication\_backend.cache.enable: false

searchguard.authentication.authorizer.impl: com.floragunn.searchguard.authorization.ldap.LDAPAuthorizator

searchguard.authentication.authorizer.cache.enable: false

searchguard.authentication.http\_authenticator.impl: com.floragunn.searchguard.authentication.http.basic.HTTPBasicAuthenticator

searchguard.authentication.ldap.host: [“[ldap.posixserver.com:389](http://ldap.posixserver.com:389)”]

searchguard.authentication.ldap.ldaps.ssl.enabled: false

searchguard.authentication.ldap.ldaps.starttls.enabled: false

searchguard.authentication.ldap.bind\_dn: “uid=linux,cn=system,cn=posix”

searchguard.authentication.ldap.password: password111

searchguard.authentication.ldap.userbase: “cn=posix”

searchguard.authentication.ldap.usersearch: (uid={0})

searchguard.authentication.ldap.username\_attribute: uid

searchguard.authentication.authorization.ldap.rolebase: “cn=groups,cn=posix”

searchguard.authentication.authorization.ldap.rolesearch: (cn={0})

searchguard.authentication.authorization.ldap.userroleattribute: memberUid

searchguard.authentication.authorization.ldap.userrolename: cn

searchguard.authentication.authorization.ldap.resolve\_nested\_roles: false

searchguard.actionrequestfilter.names: [“kibana-server”, “kibana-user”, “kibana-admin”, “logstash-server”, “logstash-user”]

searchguard.actionrequestfilter.kibana-server.allowed\_actions: [

“cluster:monitor/nodes/info\*”,

“cluster:monitor/health\*”,

“indices:admin/create\*”,

“indices:admin/exists\*”,

“indices:admin/mapping/put\*”,

“indices:admin/mappings/fields/get\*”,

“indices:admin/refresh\*”,

“indices:admin/validate/query\*”,

“indices:data/read/get\*”,

“indices:data/read/mget\*”,

“indices:data/read/search\*”,

“indices:data/write/delete\*”,

“indices:data/write/index\*”,

“indices:data/write/update\*”

]

searchguard.actionrequestfilter.kibana-user.allowed\_actions: [

“cluster:monitor/nodes/info\*”,

“cluster:monitor/health\*”,

“indices:admin/exists\*”,

“indices:admin/mappings/fields/get\*”,

“indices:admin/validate/query\*”,

“indices:data/read/get\*”,

“indices:data/read/mget\*”,

“indices:data/read/search\*”

]

searchguard.actionrequestfilter.kibana-admin.allowed\_actions: [

“cluster:monitor/nodes/info\*”,

“cluster:monitor/health\*”,

“indices:admin/exists\*”,

“indices:admin/mapping/put\*”,

“indices:admin/mappings/fields/get\*”,

“indices:admin/refresh\*”,

“indices:admin/validate/query\*”,

“indices:data/read/get\*”,

“indices:data/read/mget\*”,

“indices:data/read/search\*”,

“indices:data/write/delete\*”,

“indices:data/write/index\*”,

“indices:data/write/update\*”,

“indices:admin/create\*”

]

searchguard.actionrequestfilter.logstash-server.allowed\_actions: [

“indices:admin/template/get\*”,

“indices:admin/template/put\*”,

“indices:admin/create\*”,

“indices:data/write/bulk\*”,

“indices:data/write/index\*”,

“indices:data/write/delete\*”,

“indices:data/write/update\*”,

“indices:data/read/search\*”,

“indices:data/read/scroll\*”

]

searchguard.actionrequestfilter.logstash-user.allowed\_actions: [

“indices:admin/mappings/fields/get\*”,

“indices:admin/validate/query\*”,

“indices:data/read/search\*”,

“indices:data/read/msearch\*”,

“indices:admin/get\*”

]

Below is what I ran to create the searchguard index.

curl -XPUT “[http://localhost:9200/searchguard/ac/ac](http://localhost:9200/searchguard/ac/ac)” -d '{

“acl”: [

{

“ **Comment** ”: “By default no filters are executed and no filters a by-passed. In such a case an exception is thrown and access will be denied.”,

“filters\_bypass”: ,

“filters\_execute”:

},

{

“ **Comment** ”: “For role _admins_ all filters are bypassed (so none will be executed). This means unrestricted access.”,

“roles”: [“admins”],

“filters\_bypass”: [“\*”],

“filters\_execute”:

},

{

“ **Comment** ”: “Allow kibana-users group manage kibana indices”,

“roles”: [“kibana-users”],

“indices”: [“.kibana”],

“filters\_bypass”: [“actionrequestfilter.kibana-users”],

“filters\_execute”: [“actionrequestfilter.kibana-admin”]

},

{

“ **Comment** ”: “Allow kibana-users group read logstash indices”,

“roles”: [“kibana-users”],

“indices”: [“logstash-\*”],

“filters\_bypass”: ,

“filters\_execute”: [“actionrequestfilter.logstash-user”]

}

]

}’

Below is the error I’m getting when logging into the elasticsearch headplugin. [http://logstash1.linuxlogs.com:9200/\_plugin/head/](http://logstash1.linuxlogs.com:9200/_plugin/head/) I can get into the head plugin, but nothing is showing up. So I’m wondering what I am missing in my configuration set up that is getting this error for me below and why I can’t see anything in the head plugin. The ‘testuser’ below is part of the admins LDAP group so it should have full (read/write) access to all indexes.

[2016-03-21 13:19:35,056][INFO][com.floragunn.searchguard.rest.DefaultRestFilter] Authenticated user is User [name=testuser, roles=]

[2016-03-21 13:19:35,062][WARN][com.floragunn.searchguard.filter.SearchGuardActionFilter] Cannot determine types for indices:monitor/status (class org.elasticsearch.action.admin.indices.status.IndicesStatusRequest) due to types method not found

[2016-03-21 13:19:35,064][INFO][com.floragunn.searchguard.rest.DefaultRestFilter] Authenticated user is User [name=testuser, roles=]

[2016-03-21 13:19:35,071][ERROR][com.floragunn.searchguard.filter.SearchGuardActionFilter] Error while apply() due to com.floragunn.searchguard.tokeneval.MalformedConfigurationException: no bypass or execute filters at all for action indices:monitor/status

com.floragunn.searchguard.tokeneval.MalformedConfigurationException: no bypass or execute filters at all

```
at com.floragunn.searchguard.tokeneval.TokenEvaluator$Evaluator.validateAndMerge(TokenEvaluator.java:374)

at com.floragunn.searchguard.tokeneval.TokenEvaluator$Evaluator.<init>(TokenEvaluator.java:362)

at com.floragunn.searchguard.tokeneval.TokenEvaluator.getEvaluator(TokenEvaluator.java:310)

at com.floragunn.searchguard.filter.SearchGuardActionFilter.apply0(SearchGuardActionFilter.java:253)

at com.floragunn.searchguard.filter.SearchGuardActionFilter.apply(SearchGuardActionFilter.java:90)

at org.elasticsearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:165)

at com.floragunn.searchguard.filter.FLSActionFilter.applySecure(FLSActionFilter.java:76)

at com.floragunn.searchguard.filter.AbstractActionFilter.apply(AbstractActionFilter.java:97)

at org.elasticsearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:165)

at com.floragunn.searchguard.filter.DLSActionFilter.applySecure(DLSActionFilter.java:73)

at com.floragunn.searchguard.filter.AbstractActionFilter.apply(AbstractActionFilter.java:97)

at org.elasticsearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:165)

at com.floragunn.searchguard.filter.RequestActionFilter.applySecure(RequestActionFilter.java:94)

at com.floragunn.searchguard.filter.AbstractActionFilter.apply(AbstractActionFilter.java:97)

at org.elasticsearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:165)

at org.elasticsearch.action.support.TransportAction.execute(TransportAction.java:82)

at org.elasticsearch.client.node.NodeIndicesAdminClient.execute(NodeIndicesAdminClient.java:77)

at org.elasticsearch.client.FilterClient$IndicesAdmin.execute(FilterClient.java:120)

at org.elasticsearch.rest.BaseRestHandler$HeadersAndContextCopyClient$IndicesAdmin.execute(BaseRestHandler.java:149)

at org.elasticsearch.client.support.AbstractIndicesAdminClient.status(AbstractIndicesAdminClient.java:577)

at org.elasticsearch.rest.action.admin.indices.status.RestIndicesStatusAction.handleRequest(RestIndicesStatusAction.java:61)

at org.elasticsearch.rest.BaseRestHandler.handleRequest(BaseRestHandler.java:53)

at org.elasticsearch.rest.RestController.executeHandler(RestController.java:225)

at org.elasticsearch.rest.RestController$RestHandlerFilter.process(RestController.java:299)

at org.elasticsearch.rest.RestController$ControllerFilterChain.continueProcessing(RestController.java:280)

at com.floragunn.searchguard.rest.DefaultRestFilter.processSecure(DefaultRestFilter.java:37)

at com.floragunn.searchguard.rest.AbstractACRestFilter.process(AbstractACRestFilter.java:198)

at org.elasticsearch.rest.RestController$ControllerFilterChain.continueProcessing(RestController.java:283)

at org.elasticsearch.rest.RestController.dispatchRequest(RestController.java:180)

at org.elasticsearch.http.HttpServer.internalDispatchRequest(HttpServer.java:121)

at org.elasticsearch.http.HttpServer$Dispatcher.dispatchRequest(HttpServer.java:83)

at org.elasticsearch.http.netty.NettyHttpServerTransport.dispatchRequest(NettyHttpServerTransport.java:327)

at org.elasticsearch.http.netty.HttpRequestHandler.messageReceived(HttpRequestHandler.java:63)

at org.elasticsearch.common.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)

at org.elasticsearch.common.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)

at org.elasticsearch.common.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791)

at org.elasticsearch.http.netty.pipelining.HttpPipeliningHandler.messageReceived(HttpPipeliningHandler.java:60)

at org.elasticsearch.common.netty.channel.SimpleChannelHandler.handleUpstream(SimpleChannelHandler.java:88)

at org.elasticsearch.common.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)

at org.elasticsearch.common.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791)

at org.elasticsearch.common.netty.handler.codec.http.HttpChunkAggregator.messageReceived(HttpChunkAggregator.java:145)

at org.elasticsearch.common.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)

at org.elasticsearch.common.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)

at org.elasticsearch.common.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791)

at org.elasticsearch.common.netty.handler.codec.http.HttpContentDecoder.messageReceived(HttpContentDecoder.java:108)

at org.elasticsearch.common.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)

at org.elasticsearch.common.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)

at org.elasticsearch.common.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791)

at org.elasticsearch.common.netty.channel.Channels.fireMessageReceived(Channels.java:296)

at org.elasticsearch.common.netty.handler.codec.frame.FrameDecoder.unfoldAndFireMessageReceived(FrameDecoder.java:459)

at org.elasticsearch.common.netty.handler.codec.replay.ReplayingDecoder.callDecode(ReplayingDecoder.java:536)

at org.elasticsearch.common.netty.handler.codec.replay.ReplayingDecoder.messageReceived(ReplayingDecoder.java:435)

at org.elasticsearch.common.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)

at org.elasticsearch.common.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)

at org.elasticsearch.common.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791)

at org.elasticsearch.common.netty.OpenChannelsHandler.handleUpstream(OpenChannelsHandler.java:74)

at org.elasticsearch.common.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)

at org.elasticsearch.common.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:559)

at org.elasticsearch.common.netty.channel.Channels.fireMessageReceived(Channels.java:268)

at org.elasticsearch.common.netty.channel.Channels.fireMessageReceived(Channels.java:255)

at org.elasticsearch.common.netty.channel.socket.nio.NioWorker.read(NioWorker.java:88)

at org.elasticsearch.common.netty.channel.socket.nio.AbstractNioWorker.process(AbstractNioWorker.java:108)

at org.elasticsearch.common.netty.channel.socket.nio.AbstractNioSelector.run(AbstractNioSelector.java:337)

at org.elasticsearch.common.netty.channel.socket.nio.AbstractNioWorker.run(AbstractNioWorker.java:89)

at org.elasticsearch.common.netty.channel.socket.nio.NioWorker.run(NioWorker.java:178)

at org.elasticsearch.common.netty.util.ThreadRenamingRunnable.run(ThreadRenamingRunnable.java:108)

at org.elasticsearch.common.netty.util.internal.DeadLockProofWorker$1.run(DeadLockProofWorker.java:42)

at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)

at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)

at java.lang.Thread.run(Thread.java:745)

```

[2016-03-21 13:19:35,122][INFO][com.floragunn.searchguard.rest.DefaultRestFilter] Authenticated user is User [name=testuser, roles=]

---

<div class="post-metadata">

**Author:** ![Cds\_Support](https://avatars.discourse-cdn.com/v4/letter/c/3e96dc/32.png) [@Cds\_Support](https://forum.search-guard.com/u/Cds_Support)\
**Post date:** [March 22, 2016, 8:07pm UTC](https://forum.search-guard.com/t/ldap-auth-for-es-no-bypass-or-execute-filters-at-all-for-action-indices-monitor-status/135/2 "2016-03-22T20:07:58Z")

</div>

FYI… I’m using openLDAP for our LDAP service.

> **···**
>
> On Monday, March 21, 2016 at 1:38:48 PM UTC-5, Cds Support wrote:
> 
> > Hello,
> 
> > 
> 
> > I’m trying to do auth through our posix LDAP. I’m trying to configure search-guard where any user in the admins LDAP group has full (read/write) access to all indexes. Then any user in the kibana-users LDAP group has read/write on .kibana index and read to logstash-\* indexes. Everything works fine without search-guard enabled so my ELK stack has been working before enabling search-guard.
> 
> > 
> 
> > Below are the versions for our two node (server) ELK stack on CentOS 6.7.
> 
> > 
> 
> > Logstash 1.5.3
> 
> > Elasticsearch 1.7.1
> 
> > Kibana 4.0.1
> 
> > Redis 2.8.6
> 
> > search-guard 1.7.3.0
> 
> > 
> 
> > 
> 
> > Our posix LDAP tree is below.
> 
> > 
> 
> > root DSE: cn=posix
> 
> > group base: cn=groups,cn=posix
> 
> > admin group: cn=admins,cn=groups,cn=posix \<----Attribute for users in this group is memberUid
> 
> > kibana-users group: cn=kibana-users,cn=groups,cn=posix \<----Attribute for users in this group is memberUid
> 
> > user base: cn=users,cn=posix \<----Attribute for users in this group is uid
> 
> > 
> 
> > 
> 
> > Below is my search-guard config section of the elasticsearch.yml file.
> 
> > 
> 
> > ### Search-guard plugin config
> 
> > 
> 
> > searchguard.enabled: true
> 
> > searchguard.ssl.transport.http.enabled: false
> 
> > searchguard.allow\_all\_from\_loopback: true
> 
> > searchguard.key\_path: /snapshot/search-guard-keys/preprod/
> 
> > searchguard.http.xforwardedfor.header: DUMMY
> 
> > 
> 
> > searchguard.authentication.authentication\_backend.impl: com.floragunn.searchguard.authentication.backend.ldap.LDAPAuthenticationBackend
> 
> > searchguard.authentication.authentication\_backend.cache.enable: false
> 
> > searchguard.authentication.authorizer.impl: com.floragunn.searchguard.authorization.ldap.LDAPAuthorizator
> 
> > searchguard.authentication.authorizer.cache.enable: false
> 
> > searchguard.authentication.http\_authenticator.impl: com.floragunn.searchguard.authentication.http.basic.HTTPBasicAuthenticator
> 
> > 
> 
> > searchguard.authentication.ldap.host: [“[ldap.posixserver.com:389](http://ldap.posixserver.com:389)”]
> 
> > searchguard.authentication.ldap.ldaps.ssl.enabled: false
> 
> > searchguard.authentication.ldap.ldaps.starttls.enabled: false
> 
> > 
> 
> > searchguard.authentication.ldap.bind\_dn: “uid=linux,cn=system,cn=posix”
> 
> > searchguard.authentication.ldap.password: password111
> 
> > searchguard.authentication.ldap.userbase: “cn=posix”
> 
> > searchguard.authentication.ldap.usersearch: (uid={0})
> 
> > searchguard.authentication.ldap.username\_attribute: uid
> 
> > 
> 
> > searchguard.authentication.authorization.ldap.rolebase: “cn=groups,cn=posix”
> 
> > searchguard.authentication.authorization.ldap.rolesearch: (cn={0})
> 
> > searchguard.authentication.authorization.ldap.userroleattribute: memberUid
> 
> > searchguard.authentication.authorization.ldap.userrolename: cn
> 
> > searchguard.authentication.authorization.ldap.resolve\_nested\_roles: false
> 
> > 
> 
> > searchguard.actionrequestfilter.names: [“kibana-server”, “kibana-user”, “kibana-admin”, “logstash-server”, “logstash-user”]
> 
> > searchguard.actionrequestfilter.kibana-server.allowed\_actions: [
> 
> > “cluster:monitor/nodes/info\*”,
> 
> > “cluster:monitor/health\*”,
> 
> > “indices:admin/create\*”,
> 
> > “indices:admin/exists\*”,
> 
> > “indices:admin/mapping/put\*”,
> 
> > “indices:admin/mappings/fields/get\*”,
> 
> > “indices:admin/refresh\*”,
> 
> > “indices:admin/validate/query\*”,
> 
> > “indices:data/read/get\*”,
> 
> > “indices:data/read/mget\*”,
> 
> > “indices:data/read/search\*”,
> 
> > “indices:data/write/delete\*”,
> 
> > “indices:data/write/index\*”,
> 
> > “indices:data/write/update\*”
> 
> > ]
> 
> > searchguard.actionrequestfilter.kibana-user.allowed\_actions: [
> 
> > “cluster:monitor/nodes/info\*”,
> 
> > “cluster:monitor/health\*”,
> 
> > “indices:admin/exists\*”,
> 
> > “indices:admin/mappings/fields/get\*”,
> 
> > “indices:admin/validate/query\*”,
> 
> > “indices:data/read/get\*”,
> 
> > “indices:data/read/mget\*”,
> 
> > “indices:data/read/search\*”
> 
> > ]
> 
> > searchguard.actionrequestfilter.kibana-admin.allowed\_actions: [
> 
> > “cluster:monitor/nodes/info\*”,
> 
> > “cluster:monitor/health\*”,
> 
> > “indices:admin/exists\*”,
> 
> > “indices:admin/mapping/put\*”,
> 
> > “indices:admin/mappings/fields/get\*”,
> 
> > “indices:admin/refresh\*”,
> 
> > “indices:admin/validate/query\*”,
> 
> > “indices:data/read/get\*”,
> 
> > “indices:data/read/mget\*”,
> 
> > “indices:data/read/search\*”,
> 
> > “indices:data/write/delete\*”,
> 
> > “indices:data/write/index\*”,
> 
> > “indices:data/write/update\*”,
> 
> > “indices:admin/create\*”
> 
> > ]
> 
> > searchguard.actionrequestfilter.logstash-server.allowed\_actions: [
> 
> > “indices:admin/template/get\*”,
> 
> > “indices:admin/template/put\*”,
> 
> > “indices:admin/create\*”,
> 
> > “indices:data/write/bulk\*”,
> 
> > “indices:data/write/index\*”,
> 
> > “indices:data/write/delete\*”,
> 
> > “indices:data/write/update\*”,
> 
> > “indices:data/read/search\*”,
> 
> > “indices:data/read/scroll\*”
> 
> > ]
> 
> > searchguard.actionrequestfilter.logstash-user.allowed\_actions: [
> 
> > “indices:admin/mappings/fields/get\*”,
> 
> > “indices:admin/validate/query\*”,
> 
> > “indices:data/read/search\*”,
> 
> > “indices:data/read/msearch\*”,
> 
> > “indices:admin/get\*”
> 
> > ]
> 
> > 
> 
> > 
> 
> > 
> 
> > Below is what I ran to create the searchguard index.
> 
> > 
> 
> > curl -XPUT “[http://localhost:9200/searchguard/ac/ac](http://localhost:9200/searchguard/ac/ac)” -d '{
> 
> > “acl”: [
> 
> > {
> 
> > “ **Comment** ”: “By default no filters are executed and no filters a by-passed. In such a case an exception is thrown and access will be denied.”,
> 
> > “filters\_bypass”: ,
> 
> > “filters\_execute”:
> 
> > },
> 
> > {
> 
> > “ **Comment** ”: “For role _admins_ all filters are bypassed (so none will be executed). This means unrestricted access.”,
> 
> > “roles”: [“admins”],
> 
> > “filters\_bypass”: [“\*”],
> 
> > “filters\_execute”:
> 
> > },
> 
> > {
> 
> > “ **Comment** ”: “Allow kibana-users group manage kibana indices”,
> 
> > “roles”: [“kibana-users”],
> 
> > “indices”: [“.kibana”],
> 
> > “filters\_bypass”: [“actionrequestfilter.kibana-users”],
> 
> > “filters\_execute”: [“actionrequestfilter.kibana-admin”]
> 
> > },
> 
> > {
> 
> > “ **Comment** ”: “Allow kibana-users group read logstash indices”,
> 
> > “roles”: [“kibana-users”],
> 
> > “indices”: [“logstash-\*”],
> 
> > “filters\_bypass”: ,
> 
> > “filters\_execute”: [“actionrequestfilter.logstash-user”]
> 
> > }
> 
> > ]
> 
> > }’
> 
> > 
> 
> > 
> 
> > 
> 
> > 
> 
> > Below is the error I’m getting when logging into the elasticsearch headplugin. [http://logstash1.linuxlogs.com:9200/\_plugin/head/](http://logstash1.linuxlogs.com:9200/_plugin/head/) I can get into the head plugin, but nothing is showing up. So I’m wondering what I am missing in my configuration set up that is getting this error for me below and why I can’t see anything in the head plugin. The ‘testuser’ below is part of the admins LDAP group so it should have full (read/write) access to all indexes.
> 
> > 
> 
> > 
> 
> > [2016-03-21 13:19:35,056][INFO][com.floragunn.searchguard.rest.DefaultRestFilter] Authenticated user is User [name=testuser, roles=]
> 
> > [2016-03-21 13:19:35,062][WARN][com.floragunn.searchguard.filter.SearchGuardActionFilter] Cannot determine types for indices:monitor/status (class org.elasticsearch.action.admin.indices.status.IndicesStatusRequest) due to types method not found
> 
> > [2016-03-21 13:19:35,064][INFO][com.floragunn.searchguard.rest.DefaultRestFilter] Authenticated user is User [name=testuser, roles=]
> 
> > [2016-03-21 13:19:35,071][ERROR][com.floragunn.searchguard.filter.SearchGuardActionFilter] Error while apply() due to com.floragunn.searchguard.tokeneval.MalformedConfigurationException: no bypass or execute filters at all for action indices:monitor/status
> 
> > com.floragunn.searchguard.tokeneval.MalformedConfigurationException: no bypass or execute filters at all
> 
> > at com.floragunn.searchguard.tokeneval.TokenEvaluator$Evaluator.validateAndMerge(TokenEvaluator.java:374)
> 
> > at com.floragunn.searchguard.tokeneval.TokenEvaluator$Evaluator.(TokenEvaluator.java:362)
> 
> > at com.floragunn.searchguard.tokeneval.TokenEvaluator.getEvaluator(TokenEvaluator.java:310)
> 
> > at com.floragunn.searchguard.filter.SearchGuardActionFilter.apply0(SearchGuardActionFilter.java:253)
> 
> > at com.floragunn.searchguard.filter.SearchGuardActionFilter.apply(SearchGuardActionFilter.java:90)
> 
> > at org.elasticsearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:165)
> 
> > at com.floragunn.searchguard.filter.FLSActionFilter.applySecure(FLSActionFilter.java:76)
> 
> > at com.floragunn.searchguard.filter.AbstractActionFilter.apply(AbstractActionFilter.java:97)
> 
> > at org.elasticsearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:165)
> 
> > at com.floragunn.searchguard.filter.DLSActionFilter.applySecure(DLSActionFilter.java:73)
> 
> > at com.floragunn.searchguard.filter.AbstractActionFilter.apply(AbstractActionFilter.java:97)
> 
> > at org.elasticsearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:165)
> 
> > at com.floragunn.searchguard.filter.RequestActionFilter.applySecure(RequestActionFilter.java:94)
> 
> > at com.floragunn.searchguard.filter.AbstractActionFilter.apply(AbstractActionFilter.java:97)
> 
> > at org.elasticsearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:165)
> 
> > at org.elasticsearch.action.support.TransportAction.execute(TransportAction.java:82)
> 
> > at org.elasticsearch.client.node.NodeIndicesAdminClient.execute(NodeIndicesAdminClient.java:77)
> 
> > at org.elasticsearch.client.FilterClient$IndicesAdmin.execute(FilterClient.java:120)
> 
> > at org.elasticsearch.rest.BaseRestHandler$HeadersAndContextCopyClient$IndicesAdmin.execute(BaseRestHandler.java:149)
> 
> > at org.elasticsearch.client.support.AbstractIndicesAdminClient.status(AbstractIndicesAdminClient.java:577)
> 
> > at org.elasticsearch.rest.action.admin.indices.status.RestIndicesStatusAction.handleRequest(RestIndicesStatusAction.java:61)
> 
> > at org.elasticsearch.rest.BaseRestHandler.handleRequest(BaseRestHandler.java:53)
> 
> > at org.elasticsearch.rest.RestController.executeHandler(RestController.java:225)
> 
> > at org.elasticsearch.rest.RestController$RestHandlerFilter.process(RestController.java:299)
> 
> > at org.elasticsearch.rest.RestController$ControllerFilterChain.continueProcessing(RestController.java:280)
> 
> > at com.floragunn.searchguard.rest.DefaultRestFilter.processSecure(DefaultRestFilter.java:37)
> 
> > at com.floragunn.searchguard.rest.AbstractACRestFilter.process(AbstractACRestFilter.java:198)
> 
> > at org.elasticsearch.rest.RestController$ControllerFilterChain.continueProcessing(RestController.java:283)
> 
> > at org.elasticsearch.rest.RestController.dispatchRequest(RestController.java:180)
> 
> > at org.elasticsearch.http.HttpServer.internalDispatchRequest(HttpServer.java:121)
> 
> > at org.elasticsearch.http.HttpServer$Dispatcher.dispatchRequest(HttpServer.java:83)
> 
> > at org.elasticsearch.http.netty.NettyHttpServerTransport.dispatchRequest(NettyHttpServerTransport.java:327)
> 
> > at org.elasticsearch.http.netty.HttpRequestHandler.messageReceived(HttpRequestHandler.java:63)
> 
> > at org.elasticsearch.common.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)
> 
> > at org.elasticsearch.common.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)
> 
> > at org.elasticsearch.common.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791)
> 
> > at org.elasticsearch.http.netty.pipelining.HttpPipeliningHandler.messageReceived(HttpPipeliningHandler.java:60)
> 
> > at org.elasticsearch.common.netty.channel.SimpleChannelHandler.handleUpstream(SimpleChannelHandler.java:88)
> 
> > at org.elasticsearch.common.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)
> 
> > at org.elasticsearch.common.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791)
> 
> > at org.elasticsearch.common.netty.handler.codec.http.HttpChunkAggregator.messageReceived(HttpChunkAggregator.java:145)
> 
> > at org.elasticsearch.common.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)
> 
> > at org.elasticsearch.common.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)
> 
> > at org.elasticsearch.common.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791)
> 
> > at org.elasticsearch.common.netty.handler.codec.http.HttpContentDecoder.messageReceived(HttpContentDecoder.java:108)
> 
> > at org.elasticsearch.common.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)
> 
> > at org.elasticsearch.common.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)
> 
> > at org.elasticsearch.common.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791)
> 
> > at org.elasticsearch.common.netty.channel.Channels.fireMessageReceived(Channels.java:296)
> 
> > at org.elasticsearch.common.netty.handler.codec.frame.FrameDecoder.unfoldAndFireMessageReceived(FrameDecoder.java:459)
> 
> > at org.elasticsearch.common.netty.handler.codec.replay.ReplayingDecoder.callDecode(ReplayingDecoder.java:536)
> 
> > at org.elasticsearch.common.netty.handler.codec.replay.ReplayingDecoder.messageReceived(ReplayingDecoder.java:435)
> 
> > at org.elasticsearch.common.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)
> 
> > at org.elasticsearch.common.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)
> 
> > at org.elasticsearch.common.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791)
> 
> > at org.elasticsearch.common.netty.OpenChannelsHandler.handleUpstream(OpenChannelsHandler.java:74)
> 
> > at org.elasticsearch.common.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)
> 
> > at org.elasticsearch.common.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:559)
> 
> > at org.elasticsearch.common.netty.channel.Channels.fireMessageReceived(Channels.java:268)
> 
> > at org.elasticsearch.common.netty.channel.Channels.fireMessageReceived(Channels.java:255)
> 
> > at org.elasticsearch.common.netty.channel.socket.nio.NioWorker.read(NioWorker.java:88)
> 
> > at org.elasticsearch.common.netty.channel.socket.nio.AbstractNioWorker.process(AbstractNioWorker.java:108)
> 
> > at org.elasticsearch.common.netty.channel.socket.nio.AbstractNioSelector.run(AbstractNioSelector.java:337)
> 
> > at org.elasticsearch.common.netty.channel.socket.nio.AbstractNioWorker.run(AbstractNioWorker.java:89)
> 
> > at org.elasticsearch.common.netty.channel.socket.nio.NioWorker.run(NioWorker.java:178)
> 
> > at org.elasticsearch.common.netty.util.ThreadRenamingRunnable.run(ThreadRenamingRunnable.java:108)
> 
> > at org.elasticsearch.common.netty.util.internal.DeadLockProofWorker$1.run(DeadLockProofWorker.java:42)
> 
> > at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
> 
> > at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
> 
> > at java.lang.Thread.run(Thread.java:745)
> 
> > [2016-03-21 13:19:35,122][INFO][com.floragunn.searchguard.rest.DefaultRestFilter] Authenticated user is User [name=testuser, roles=]
> 
> >

---

<div class="post-metadata">

**Author:** ![Cds\_Support](https://avatars.discourse-cdn.com/v4/letter/c/3e96dc/32.png) [@Cds\_Support](https://forum.search-guard.com/u/Cds_Support)\
**Post date:** [March 29, 2016, 1:11pm UTC](https://forum.search-guard.com/t/ldap-auth-for-es-no-bypass-or-execute-filters-at-all-for-action-indices-monitor-status/135/3 "2016-03-29T13:11:16Z")

</div>

\*\*\*\*Update on this. I got it where it can see the ldap groups for roles, but it’s grabbing all of the ldap groups.

Below is the authorization settings in elasticsearch.yml file

searchguard.authentication.authorization.ldap.rolebase: “cn=groups,cn=posix”

searchguard.authentication.authorization.ldap.rolesearch: (&(objectClass=posixGroup))(memberUid={0}))

searchguard.authentication.authorization.ldap.rolename: cn

searchguard.authentication.authorization.ldap.resolve\_nested\_roles: false

Below shows in the log how it assigns the role for every ldap group we have to the user. The testuser is only a part of the kibana-users ldap group. So how do I get it to only recognize it being part of the kibana-users ldap group as a role? Any help would be appreciated.

[2016-03-28 10:32:41,161][INFO][com.floragunn.searchguard.rest.DefaultRestFilter] Authenticated user is User [name=testuser, roles=[webdev, rddev, admins, automation, dba, secure, appgroup, wasgroup, appdev, icpdev, kibana-users, devs, conversion, sysadm]]

> **···**
>
> On Tuesday, March 22, 2016 at 3:07:58 PM UTC-5, Cds Support wrote:
> 
> > FYI… I’m using openLDAP for our LDAP service.
> 
> > 
> 
> > 
> 
> > On Monday, March 21, 2016 at 1:38:48 PM UTC-5, Cds Support wrote:
> > 
> > > Hello,
> 
> > >
> 
> > > I’m trying to do auth through our posix LDAP. I’m trying to configure search-guard where any user in the admins LDAP group has full (read/write) access to all indexes. Then any user in the kibana-users LDAP group has read/write on .kibana index and read to logstash-\* indexes. Everything works fine without search-guard enabled so my ELK stack has been working before enabling search-guard.
> 
> > >
> 
> > > Below are the versions for our two node (server) ELK stack on CentOS 6.7.
> 
> > >
> 
> > > Logstash 1.5.3
> 
> > > Elasticsearch 1.7.1
> 
> > > Kibana 4.0.1
> 
> > > Redis 2.8.6
> 
> > > search-guard 1.7.3.0
> 
> > >
> 
> > >
> 
> > > Our posix LDAP tree is below.
> 
> > >
> 
> > > root DSE: cn=posix
> 
> > > group base: cn=groups,cn=posix
> 
> > > admin group: cn=admins,cn=groups,cn=posix \<----Attribute for users in this group is memberUid
> 
> > > kibana-users group: cn=kibana-users,cn=groups,cn=posix \<----Attribute for users in this group is memberUid
> 
> > > user base: cn=users,cn=posix \<----Attribute for users in this group is uid
> 
> > >
> 
> > >
> 
> > > Below is my search-guard config section of the elasticsearch.yml file.
> 
> > >
> 
> > > ### Search-guard plugin config
> 
> > >
> 
> > > searchguard.enabled: true
> 
> > > searchguard.ssl.transport.http.enabled: false
> 
> > > searchguard.allow\_all\_from\_loopback: true
> 
> > > searchguard.key\_path: /snapshot/search-guard-keys/preprod/
> 
> > > searchguard.http.xforwardedfor.header: DUMMY
> 
> > >
> 
> > > searchguard.authentication.authentication\_backend.impl: com.floragunn.searchguard.authentication.backend.ldap.LDAPAuthenticationBackend
> 
> > > searchguard.authentication.authentication\_backend.cache.enable: false
> 
> > > searchguard.authentication.authorizer.impl: com.floragunn.searchguard.authorization.ldap.LDAPAuthorizator
> 
> > > searchguard.authentication.authorizer.cache.enable: false
> 
> > > searchguard.authentication.http\_authenticator.impl: com.floragunn.searchguard.authentication.http.basic.HTTPBasicAuthenticator
> 
> > >
> 
> > > searchguard.authentication.ldap.host: [“[ldap.posixserver.com:389](http://ldap.posixserver.com:389)”]
> 
> > > searchguard.authentication.ldap.ldaps.ssl.enabled: false
> 
> > > searchguard.authentication.ldap.ldaps.starttls.enabled: false
> 
> > >
> 
> > > searchguard.authentication.ldap.bind\_dn: “uid=linux,cn=system,cn=posix”
> 
> > > searchguard.authentication.ldap.password: password111
> 
> > > searchguard.authentication.ldap.userbase: “cn=posix”
> 
> > > searchguard.authentication.ldap.usersearch: (uid={0})
> 
> > > searchguard.authentication.ldap.username\_attribute: uid
> 
> > >
> 
> > > searchguard.authentication.authorization.ldap.rolebase: “cn=groups,cn=posix”
> 
> > > searchguard.authentication.authorization.ldap.rolesearch: (cn={0})
> 
> > > searchguard.authentication.authorization.ldap.userroleattribute: memberUid
> 
> > > searchguard.authentication.authorization.ldap.userrolename: cn
> 
> > > searchguard.authentication.authorization.ldap.resolve\_nested\_roles: false
> 
> > >
> 
> > > searchguard.actionrequestfilter.names: [“kibana-server”, “kibana-user”, “kibana-admin”, “logstash-server”, “logstash-user”]
> 
> > > searchguard.actionrequestfilter.kibana-server.allowed\_actions: [
> 
> > > “cluster:monitor/nodes/info\*”,
> 
> > > “cluster:monitor/health\*”,
> 
> > > “indices:admin/create\*”,
> 
> > > “indices:admin/exists\*”,
> 
> > > “indices:admin/mapping/put\*”,
> 
> > > “indices:admin/mappings/fields/get\*”,
> 
> > > “indices:admin/refresh\*”,
> 
> > > “indices:admin/validate/query\*”,
> 
> > > “indices:data/read/get\*”,
> 
> > > “indices:data/read/mget\*”,
> 
> > > “indices:data/read/search\*”,
> 
> > > “indices:data/write/delete\*”,
> 
> > > “indices:data/write/index\*”,
> 
> > > “indices:data/write/update\*”
> 
> > > ]
> 
> > > searchguard.actionrequestfilter.kibana-user.allowed\_actions: [
> 
> > > “cluster:monitor/nodes/info\*”,
> 
> > > “cluster:monitor/health\*”,
> 
> > > “indices:admin/exists\*”,
> 
> > > “indices:admin/mappings/fields/get\*”,
> 
> > > “indices:admin/validate/query\*”,
> 
> > > “indices:data/read/get\*”,
> 
> > > “indices:data/read/mget\*”,
> 
> > > “indices:data/read/search\*”
> 
> > > ]
> 
> > > searchguard.actionrequestfilter.kibana-admin.allowed\_actions: [
> 
> > > “cluster:monitor/nodes/info\*”,
> 
> > > “cluster:monitor/health\*”,
> 
> > > “indices:admin/exists\*”,
> 
> > > “indices:admin/mapping/put\*”,
> 
> > > “indices:admin/mappings/fields/get\*”,
> 
> > > “indices:admin/refresh\*”,
> 
> > > “indices:admin/validate/query\*”,
> 
> > > “indices:data/read/get\*”,
> 
> > > “indices:data/read/mget\*”,
> 
> > > “indices:data/read/search\*”,
> 
> > > “indices:data/write/delete\*”,
> 
> > > “indices:data/write/index\*”,
> 
> > > “indices:data/write/update\*”,
> 
> > > “indices:admin/create\*”
> 
> > > ]
> 
> > > searchguard.actionrequestfilter.logstash-server.allowed\_actions: [
> 
> > > “indices:admin/template/get\*”,
> 
> > > “indices:admin/template/put\*”,
> 
> > > “indices:admin/create\*”,
> 
> > > “indices:data/write/bulk\*”,
> 
> > > “indices:data/write/index\*”,
> 
> > > “indices:data/write/delete\*”,
> 
> > > “indices:data/write/update\*”,
> 
> > > “indices:data/read/search\*”,
> 
> > > “indices:data/read/scroll\*”
> 
> > > ]
> 
> > > searchguard.actionrequestfilter.logstash-user.allowed\_actions: [
> 
> > > “indices:admin/mappings/fields/get\*”,
> 
> > > “indices:admin/validate/query\*”,
> 
> > > “indices:data/read/search\*”,
> 
> > > “indices:data/read/msearch\*”,
> 
> > > “indices:admin/get\*”
> 
> > > ]
> 
> > >
> 
> > >
> 
> > >
> 
> > > Below is what I ran to create the searchguard index.
> 
> > >
> 
> > > curl -XPUT “[http://localhost:9200/searchguard/ac/ac](http://localhost:9200/searchguard/ac/ac)” -d '{
> 
> > > “acl”: [
> 
> > > {
> 
> > > “ **Comment** ”: “By default no filters are executed and no filters a by-passed. In such a case an exception is thrown and access will be denied.”,
> 
> > > “filters\_bypass”: ,
> 
> > > “filters\_execute”:
> 
> > > },
> 
> > > {
> 
> > > “ **Comment** ”: “For role _admins_ all filters are bypassed (so none will be executed). This means unrestricted access.”,
> 
> > > “roles”: [“admins”],
> 
> > > “filters\_bypass”: [“\*”],
> 
> > > “filters\_execute”:
> 
> > > },
> 
> > > {
> 
> > > “ **Comment** ”: “Allow kibana-users group manage kibana indices”,
> 
> > > “roles”: [“kibana-users”],
> 
> > > “indices”: [“.kibana”],
> 
> > > “filters\_bypass”: [“actionrequestfilter.kibana-users”],
> 
> > > “filters\_execute”: [“actionrequestfilter.kibana-admin”]
> 
> > > },
> 
> > > {
> 
> > > “ **Comment** ”: “Allow kibana-users group read logstash indices”,
> 
> > > “roles”: [“kibana-users”],
> 
> > > “indices”: [“logstash-\*”],
> 
> > > “filters\_bypass”: ,
> 
> > > “filters\_execute”: [“actionrequestfilter.logstash-user”]
> 
> > > }
> 
> > > ]
> 
> > > }’
> 
> > >
> 
> > >
> 
> > >
> 
> > >
> 
> > > Below is the error I’m getting when logging into the elasticsearch headplugin. [http://logstash1.linuxlogs.com:9200/\_plugin/head/](http://logstash1.linuxlogs.com:9200/_plugin/head/) I can get into the head plugin, but nothing is showing up. So I’m wondering what I am missing in my configuration set up that is getting this error for me below and why I can’t see anything in the head plugin. The ‘testuser’ below is part of the admins LDAP group so it should have full (read/write) access to all indexes.
> 
> > >
> 
> > >
> 
> > > [2016-03-21 13:19:35,056][INFO][com.floragunn.searchguard.rest.DefaultRestFilter] Authenticated user is User [name=testuser, roles=]
> 
> > > [2016-03-21 13:19:35,062][WARN][com.floragunn.searchguard.filter.SearchGuardActionFilter] Cannot determine types for indices:monitor/status (class org.elasticsearch.action.admin.indices.status.IndicesStatusRequest) due to types method not found
> 
> > > [2016-03-21 13:19:35,064][INFO][com.floragunn.searchguard.rest.DefaultRestFilter] Authenticated user is User [name=testuser, roles=]
> 
> > > [2016-03-21 13:19:35,071][ERROR][com.floragunn.searchguard.filter.SearchGuardActionFilter] Error while apply() due to com.floragunn.searchguard.tokeneval.MalformedConfigurationException: no bypass or execute filters at all for action indices:monitor/status
> 
> > > com.floragunn.searchguard.tokeneval.MalformedConfigurationException: no bypass or execute filters at all
> 
> > > ```
> > > at com.floragunn.searchguard.tokeneval.TokenEvaluator$Evaluator.validateAndMerge(TokenEvaluator.java:374)
> > > 
> > > ```
> 
> > > ```
> > > at com.floragunn.searchguard.tokeneval.TokenEvaluator$Evaluator.<init>(TokenEvaluator.java:362)
> > > 
> > > ```
> 
> > > ```
> > > at com.floragunn.searchguard.tokeneval.TokenEvaluator.getEvaluator(TokenEvaluator.java:310)
> > > 
> > > ```
> 
> > > ```
> > > at com.floragunn.searchguard.filter.SearchGuardActionFilter.apply0(SearchGuardActionFilter.java:253)
> > > 
> > > ```
> 
> > > ```
> > > at com.floragunn.searchguard.filter.SearchGuardActionFilter.apply(SearchGuardActionFilter.java:90)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:165)
> > > 
> > > ```
> 
> > > ```
> > > at com.floragunn.searchguard.filter.FLSActionFilter.applySecure(FLSActionFilter.java:76)
> > > 
> > > ```
> 
> > > ```
> > > at com.floragunn.searchguard.filter.AbstractActionFilter.apply(AbstractActionFilter.java:97)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:165)
> > > 
> > > ```
> 
> > > ```
> > > at com.floragunn.searchguard.filter.DLSActionFilter.applySecure(DLSActionFilter.java:73)
> > > 
> > > ```
> 
> > > ```
> > > at com.floragunn.searchguard.filter.AbstractActionFilter.apply(AbstractActionFilter.java:97)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:165)
> > > 
> > > ```
> 
> > > ```
> > > at com.floragunn.searchguard.filter.RequestActionFilter.applySecure(RequestActionFilter.java:94)
> > > 
> > > ```
> 
> > > ```
> > > at com.floragunn.searchguard.filter.AbstractActionFilter.apply(AbstractActionFilter.java:97)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:165)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.action.support.TransportAction.execute(TransportAction.java:82)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.client.node.NodeIndicesAdminClient.execute(NodeIndicesAdminClient.java:77)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.client.FilterClient$IndicesAdmin.execute(FilterClient.java:120)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.rest.BaseRestHandler$HeadersAndContextCopyClient$IndicesAdmin.execute(BaseRestHandler.java:149)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.client.support.AbstractIndicesAdminClient.status(AbstractIndicesAdminClient.java:577)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.rest.action.admin.indices.status.RestIndicesStatusAction.handleRequest(RestIndicesStatusAction.java:61)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.rest.BaseRestHandler.handleRequest(BaseRestHandler.java:53)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.rest.RestController.executeHandler(RestController.java:225)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.rest.RestController$RestHandlerFilter.process(RestController.java:299)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.rest.RestController$ControllerFilterChain.continueProcessing(RestController.java:280)
> > > 
> > > ```
> 
> > > ```
> > > at com.floragunn.searchguard.rest.DefaultRestFilter.processSecure(DefaultRestFilter.java:37)
> > > 
> > > ```
> 
> > > ```
> > > at com.floragunn.searchguard.rest.AbstractACRestFilter.process(AbstractACRestFilter.java:198)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.rest.RestController$ControllerFilterChain.continueProcessing(RestController.java:283)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.rest.RestController.dispatchRequest(RestController.java:180)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.http.HttpServer.internalDispatchRequest(HttpServer.java:121)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.http.HttpServer$Dispatcher.dispatchRequest(HttpServer.java:83)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.http.netty.NettyHttpServerTransport.dispatchRequest(NettyHttpServerTransport.java:327)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.http.netty.HttpRequestHandler.messageReceived(HttpRequestHandler.java:63)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.common.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.common.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.common.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.http.netty.pipelining.HttpPipeliningHandler.messageReceived(HttpPipeliningHandler.java:60)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.common.netty.channel.SimpleChannelHandler.handleUpstream(SimpleChannelHandler.java:88)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.common.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.common.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.common.netty.handler.codec.http.HttpChunkAggregator.messageReceived(HttpChunkAggregator.java:145)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.common.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.common.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.common.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.common.netty.handler.codec.http.HttpContentDecoder.messageReceived(HttpContentDecoder.java:108)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.common.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.common.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.common.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.common.netty.channel.Channels.fireMessageReceived(Channels.java:296)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.common.netty.handler.codec.frame.FrameDecoder.unfoldAndFireMessageReceived(FrameDecoder.java:459)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.common.netty.handler.codec.replay.ReplayingDecoder.callDecode(ReplayingDecoder.java:536)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.common.netty.handler.codec.replay.ReplayingDecoder.messageReceived(ReplayingDecoder.java:435)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.common.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.common.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.common.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.common.netty.OpenChannelsHandler.handleUpstream(OpenChannelsHandler.java:74)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.common.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.common.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:559)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.common.netty.channel.Channels.fireMessageReceived(Channels.java:268)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.common.netty.channel.Channels.fireMessageReceived(Channels.java:255)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.common.netty.channel.socket.nio.NioWorker.read(NioWorker.java:88)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.common.netty.channel.socket.nio.AbstractNioWorker.process(AbstractNioWorker.java:108)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.common.netty.channel.socket.nio.AbstractNioSelector.run(AbstractNioSelector.java:337)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.common.netty.channel.socket.nio.AbstractNioWorker.run(AbstractNioWorker.java:89)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.common.netty.channel.socket.nio.NioWorker.run(NioWorker.java:178)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.common.netty.util.ThreadRenamingRunnable.run(ThreadRenamingRunnable.java:108)
> > > 
> > > ```
> 
> > > ```
> > > at org.elasticsearch.common.netty.util.internal.DeadLockProofWorker$1.run(DeadLockProofWorker.java:42)
> > > 
> > > ```
> 
> > > ```
> > > at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
> > > 
> > > ```
> 
> > > ```
> > > at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
> > > 
> > > ```
> 
> > > ```
> > > at java.lang.Thread.run(Thread.java:745)
> > > 
> > > ```
> 
> > > [2016-03-21 13:19:35,122][INFO][com.floragunn.searchguard.rest.DefaultRestFilter] Authenticated user is User [name=testuser, roles=]
> 
> > >

---

<div class="post-metadata">

**Author:** ![Cds\_Support](https://avatars.discourse-cdn.com/v4/letter/c/3e96dc/32.png) [@Cds\_Support](https://forum.search-guard.com/u/Cds_Support)\
**Post date:** [March 30, 2016, 12:48pm UTC](https://forum.search-guard.com/t/ldap-auth-for-es-no-bypass-or-execute-filters-at-all-for-action-indices-monitor-status/135/4 "2016-03-30T12:48:02Z")

</div>

\*\*\*\*Update on this. I got it working with these settings below. Had to make it look at memberUid inside the group since we don’t use memberOf, which is what search-guard defaults to. Hopefully this information is helpful to others out there. This thread is considered closed now.

searchguard.authentication.authorization.ldap.rolesearch: “(memberUid={1})”

searchguard.authentication.authorization.ldap.userroleattribute: memberUid

> **···**
>
> On Tuesday, March 29, 2016 at 8:11:16 AM UTC-5, Cds Support wrote:
> 
> > \*\*\*\*Update on this. I got it where it can see the ldap groups for roles, but it’s grabbing all of the ldap groups.
> 
> > Below is the authorization settings in elasticsearch.yml file
> 
> > 
> 
> > searchguard.authentication.authorization.ldap.rolebase: “cn=groups,cn=posix”
> 
> > searchguard.authentication.authorization.ldap.rolesearch: (&(objectClass=posixGroup))(memberUid={0}))
> 
> > searchguard.authentication.authorization.ldap.rolename: cn
> 
> > searchguard.authentication.authorization.ldap.resolve\_nested\_roles: false
> 
> > 
> 
> > 
> 
> > Below shows in the log how it assigns the role for every ldap group we have to the user. The testuser is only a part of the kibana-users ldap group. So how do I get it to only recognize it being part of the kibana-users ldap group as a role? Any help would be appreciated.
> 
> > 
> 
> > [2016-03-28 10:32:41,161][INFO][com.floragunn.searchguard.rest.DefaultRestFilter] Authenticated user is User [name=testuser, roles=[webdev, rddev, admins, automation, dba, secure, appgroup, wasgroup, appdev, icpdev, kibana-users, devs, conversion, sysadm]]
> 
> > 
> 
> > 
> 
> > 
> 
> > On Tuesday, March 22, 2016 at 3:07:58 PM UTC-5, Cds Support wrote:
> > 
> > > FYI… I’m using openLDAP for our LDAP service.
> 
> > >
> 
> > >
> 
> > > On Monday, March 21, 2016 at 1:38:48 PM UTC-5, Cds Support wrote:
> > > 
> > > > Hello,
> 
> > > >
> 
> > > > I’m trying to do auth through our posix LDAP. I’m trying to configure search-guard where any user in the admins LDAP group has full (read/write) access to all indexes. Then any user in the kibana-users LDAP group has read/write on .kibana index and read to logstash-\* indexes. Everything works fine without search-guard enabled so my ELK stack has been working before enabling search-guard.
> 
> > > >
> 
> > > > Below are the versions for our two node (server) ELK stack on CentOS 6.7.
> 
> > > >
> 
> > > > Logstash 1.5.3
> 
> > > > Elasticsearch 1.7.1
> 
> > > > Kibana 4.0.1
> 
> > > > Redis 2.8.6
> 
> > > > search-guard 1.7.3.0
> 
> > > >
> 
> > > >
> 
> > > > Our posix LDAP tree is below.
> 
> > > >
> 
> > > > root DSE: cn=posix
> 
> > > > group base: cn=groups,cn=posix
> 
> > > > admin group: cn=admins,cn=groups,cn=posix \<----Attribute for users in this group is memberUid
> 
> > > > kibana-users group: cn=kibana-users,cn=groups,cn=posix \<----Attribute for users in this group is memberUid
> 
> > > > user base: cn=users,cn=posix \<----Attribute for users in this group is uid
> 
> > > >
> 
> > > >
> 
> > > > Below is my search-guard config section of the elasticsearch.yml file.
> 
> > > >
> 
> > > > ### Search-guard plugin config
> 
> > > >
> 
> > > > searchguard.enabled: true
> 
> > > > searchguard.ssl.transport.http.enabled: false
> 
> > > > searchguard.allow\_all\_from\_loopback: true
> 
> > > > searchguard.key\_path: /snapshot/search-guard-keys/preprod/
> 
> > > > searchguard.http.xforwardedfor.header: DUMMY
> 
> > > >
> 
> > > > searchguard.authentication.authentication\_backend.impl: com.floragunn.searchguard.authentication.backend.ldap.LDAPAuthenticationBackend
> 
> > > > searchguard.authentication.authentication\_backend.cache.enable: false
> 
> > > > searchguard.authentication.authorizer.impl: com.floragunn.searchguard.authorization.ldap.LDAPAuthorizator
> 
> > > > searchguard.authentication.authorizer.cache.enable: false
> 
> > > > searchguard.authentication.http\_authenticator.impl: com.floragunn.searchguard.authentication.http.basic.HTTPBasicAuthenticator
> 
> > > >
> 
> > > > searchguard.authentication.ldap.host: [“[ldap.posixserver.com:389](http://ldap.posixserver.com:389)”]
> 
> > > > searchguard.authentication.ldap.ldaps.ssl.enabled: false
> 
> > > > searchguard.authentication.ldap.ldaps.starttls.enabled: false
> 
> > > >
> 
> > > > searchguard.authentication.ldap.bind\_dn: “uid=linux,cn=system,cn=posix”
> 
> > > > searchguard.authentication.ldap.password: password111
> 
> > > > searchguard.authentication.ldap.userbase: “cn=posix”
> 
> > > > searchguard.authentication.ldap.usersearch: (uid={0})
> 
> > > > searchguard.authentication.ldap.username\_attribute: uid
> 
> > > >
> 
> > > > searchguard.authentication.authorization.ldap.rolebase: “cn=groups,cn=posix”
> 
> > > > searchguard.authentication.authorization.ldap.rolesearch: (cn={0})
> 
> > > > searchguard.authentication.authorization.ldap.userroleattribute: memberUid
> 
> > > > searchguard.authentication.authorization.ldap.userrolename: cn
> 
> > > > searchguard.authentication.authorization.ldap.resolve\_nested\_roles: false
> 
> > > >
> 
> > > > searchguard.actionrequestfilter.names: [“kibana-server”, “kibana-user”, “kibana-admin”, “logstash-server”, “logstash-user”]
> 
> > > > searchguard.actionrequestfilter.kibana-server.allowed\_actions: [
> 
> > > > “cluster:monitor/nodes/info\*”,
> 
> > > > “cluster:monitor/health\*”,
> 
> > > > “indices:admin/create\*”,
> 
> > > > “indices:admin/exists\*”,
> 
> > > > “indices:admin/mapping/put\*”,
> 
> > > > “indices:admin/mappings/fields/get\*”,
> 
> > > > “indices:admin/refresh\*”,
> 
> > > > “indices:admin/validate/query\*”,
> 
> > > > “indices:data/read/get\*”,
> 
> > > > “indices:data/read/mget\*”,
> 
> > > > “indices:data/read/search\*”,
> 
> > > > “indices:data/write/delete\*”,
> 
> > > > “indices:data/write/index\*”,
> 
> > > > “indices:data/write/update\*”
> 
> > > > ]
> 
> > > > searchguard.actionrequestfilter.kibana-user.allowed\_actions: [
> 
> > > > “cluster:monitor/nodes/info\*”,
> 
> > > > “cluster:monitor/health\*”,
> 
> > > > “indices:admin/exists\*”,
> 
> > > > “indices:admin/mappings/fields/get\*”,
> 
> > > > “indices:admin/validate/query\*”,
> 
> > > > “indices:data/read/get\*”,
> 
> > > > “indices:data/read/mget\*”,
> 
> > > > “indices:data/read/search\*”
> 
> > > > ]
> 
> > > > searchguard.actionrequestfilter.kibana-admin.allowed\_actions: [
> 
> > > > “cluster:monitor/nodes/info\*”,
> 
> > > > “cluster:monitor/health\*”,
> 
> > > > “indices:admin/exists\*”,
> 
> > > > “indices:admin/mapping/put\*”,
> 
> > > > “indices:admin/mappings/fields/get\*”,
> 
> > > > “indices:admin/refresh\*”,
> 
> > > > “indices:admin/validate/query\*”,
> 
> > > > “indices:data/read/get\*”,
> 
> > > > “indices:data/read/mget\*”,
> 
> > > > “indices:data/read/search\*”,
> 
> > > > “indices:data/write/delete\*”,
> 
> > > > “indices:data/write/index\*”,
> 
> > > > “indices:data/write/update\*”,
> 
> > > > “indices:admin/create\*”
> 
> > > > ]
> 
> > > > searchguard.actionrequestfilter.logstash-server.allowed\_actions: [
> 
> > > > “indices:admin/template/get\*”,
> 
> > > > “indices:admin/template/put\*”,
> 
> > > > “indices:admin/create\*”,
> 
> > > > “indices:data/write/bulk\*”,
> 
> > > > “indices:data/write/index\*”,
> 
> > > > “indices:data/write/delete\*”,
> 
> > > > “indices:data/write/update\*”,
> 
> > > > “indices:data/read/search\*”,
> 
> > > > “indices:data/read/scroll\*”
> 
> > > > ]
> 
> > > > searchguard.actionrequestfilter.logstash-user.allowed\_actions: [
> 
> > > > “indices:admin/mappings/fields/get\*”,
> 
> > > > “indices:admin/validate/query\*”,
> 
> > > > “indices:data/read/search\*”,
> 
> > > > “indices:data/read/msearch\*”,
> 
> > > > “indices:admin/get\*”
> 
> > > > ]
> 
> > > >
> 
> > > >
> 
> > > >
> 
> > > > Below is what I ran to create the searchguard index.
> 
> > > >
> 
> > > > curl -XPUT “[http://localhost:9200/searchguard/ac/ac](http://localhost:9200/searchguard/ac/ac)” -d '{
> 
> > > > “acl”: [
> 
> > > > {
> 
> > > > “ **Comment** ”: “By default no filters are executed and no filters a by-passed. In such a case an exception is thrown and access will be denied.”,
> 
> > > > “filters\_bypass”: ,
> 
> > > > “filters\_execute”:
> 
> > > > },
> 
> > > > {
> 
> > > > “ **Comment** ”: “For role _admins_ all filters are bypassed (so none will be executed). This means unrestricted access.”,
> 
> > > > “roles”: [“admins”],
> 
> > > > “filters\_bypass”: [“\*”],
> 
> > > > “filters\_execute”:
> 
> > > > },
> 
> > > > {
> 
> > > > “ **Comment** ”: “Allow kibana-users group manage kibana indices”,
> 
> > > > “roles”: [“kibana-users”],
> 
> > > > “indices”: [“.kibana”],
> 
> > > > “filters\_bypass”: [“actionrequestfilter.kibana-users”],
> 
> > > > “filters\_execute”: [“actionrequestfilter.kibana-admin”]
> 
> > > > },
> 
> > > > {
> 
> > > > “ **Comment** ”: “Allow kibana-users group read logstash indices”,
> 
> > > > “roles”: [“kibana-users”],
> 
> > > > “indices”: [“logstash-\*”],
> 
> > > > “filters\_bypass”: ,
> 
> > > > “filters\_execute”: [“actionrequestfilter.logstash-user”]
> 
> > > > }
> 
> > > > ]
> 
> > > > }’
> 
> > > >
> 
> > > >
> 
> > > >
> 
> > > >
> 
> > > > Below is the error I’m getting when logging into the elasticsearch headplugin. [http://logstash1.linuxlogs.com:9200/\_plugin/head/](http://logstash1.linuxlogs.com:9200/_plugin/head/) I can get into the head plugin, but nothing is showing up. So I’m wondering what I am missing in my configuration set up that is getting this error for me below and why I can’t see anything in the head plugin. The ‘testuser’ below is part of the admins LDAP group so it should have full (read/write) access to all indexes.
> 
> > > >
> 
> > > >
> 
> > > > [2016-03-21 13:19:35,056][INFO][com.floragunn.searchguard.rest.DefaultRestFilter] Authenticated user is User [name=testuser, roles=]
> 
> > > > [2016-03-21 13:19:35,062][WARN][com.floragunn.searchguard.filter.SearchGuardActionFilter] Cannot determine types for indices:monitor/status (class org.elasticsearch.action.admin.indices.status.IndicesStatusRequest) due to types method not found
> 
> > > > [2016-03-21 13:19:35,064][INFO][com.floragunn.searchguard.rest.DefaultRestFilter] Authenticated user is User [name=testuser, roles=]
> 
> > > > [2016-03-21 13:19:35,071][ERROR][com.floragunn.searchguard.filter.SearchGuardActionFilter] Error while apply() due to com.floragunn.searchguard.tokeneval.MalformedConfigurationException: no bypass or execute filters at all for action indices:monitor/status
> 
> > > > com.floragunn.searchguard.tokeneval.MalformedConfigurationException: no bypass or execute filters at all
> 
> > > > ```
> > > > at com.floragunn.searchguard.tokeneval.TokenEvaluator$Evaluator.validateAndMerge(TokenEvaluator.java:374)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at com.floragunn.searchguard.tokeneval.TokenEvaluator$Evaluator.<init>(TokenEvaluator.java:362)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at com.floragunn.searchguard.tokeneval.TokenEvaluator.getEvaluator(TokenEvaluator.java:310)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at com.floragunn.searchguard.filter.SearchGuardActionFilter.apply0(SearchGuardActionFilter.java:253)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at com.floragunn.searchguard.filter.SearchGuardActionFilter.apply(SearchGuardActionFilter.java:90)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:165)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at com.floragunn.searchguard.filter.FLSActionFilter.applySecure(FLSActionFilter.java:76)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at com.floragunn.searchguard.filter.AbstractActionFilter.apply(AbstractActionFilter.java:97)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:165)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at com.floragunn.searchguard.filter.DLSActionFilter.applySecure(DLSActionFilter.java:73)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at com.floragunn.searchguard.filter.AbstractActionFilter.apply(AbstractActionFilter.java:97)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:165)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at com.floragunn.searchguard.filter.RequestActionFilter.applySecure(RequestActionFilter.java:94)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at com.floragunn.searchguard.filter.AbstractActionFilter.apply(AbstractActionFilter.java:97)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:165)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.action.support.TransportAction.execute(TransportAction.java:82)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.client.node.NodeIndicesAdminClient.execute(NodeIndicesAdminClient.java:77)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.client.FilterClient$IndicesAdmin.execute(FilterClient.java:120)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.rest.BaseRestHandler$HeadersAndContextCopyClient$IndicesAdmin.execute(BaseRestHandler.java:149)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.client.support.AbstractIndicesAdminClient.status(AbstractIndicesAdminClient.java:577)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.rest.action.admin.indices.status.RestIndicesStatusAction.handleRequest(RestIndicesStatusAction.java:61)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.rest.BaseRestHandler.handleRequest(BaseRestHandler.java:53)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.rest.RestController.executeHandler(RestController.java:225)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.rest.RestController$RestHandlerFilter.process(RestController.java:299)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.rest.RestController$ControllerFilterChain.continueProcessing(RestController.java:280)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at com.floragunn.searchguard.rest.DefaultRestFilter.processSecure(DefaultRestFilter.java:37)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at com.floragunn.searchguard.rest.AbstractACRestFilter.process(AbstractACRestFilter.java:198)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.rest.RestController$ControllerFilterChain.continueProcessing(RestController.java:283)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.rest.RestController.dispatchRequest(RestController.java:180)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.http.HttpServer.internalDispatchRequest(HttpServer.java:121)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.http.HttpServer$Dispatcher.dispatchRequest(HttpServer.java:83)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.http.netty.NettyHttpServerTransport.dispatchRequest(NettyHttpServerTransport.java:327)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.http.netty.HttpRequestHandler.messageReceived(HttpRequestHandler.java:63)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.common.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.common.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.common.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.http.netty.pipelining.HttpPipeliningHandler.messageReceived(HttpPipeliningHandler.java:60)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.common.netty.channel.SimpleChannelHandler.handleUpstream(SimpleChannelHandler.java:88)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.common.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.common.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.common.netty.handler.codec.http.HttpChunkAggregator.messageReceived(HttpChunkAggregator.java:145)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.common.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.common.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.common.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.common.netty.handler.codec.http.HttpContentDecoder.messageReceived(HttpContentDecoder.java:108)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.common.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.common.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.common.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.common.netty.channel.Channels.fireMessageReceived(Channels.java:296)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.common.netty.handler.codec.frame.FrameDecoder.unfoldAndFireMessageReceived(FrameDecoder.java:459)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.common.netty.handler.codec.replay.ReplayingDecoder.callDecode(ReplayingDecoder.java:536)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.common.netty.handler.codec.replay.ReplayingDecoder.messageReceived(ReplayingDecoder.java:435)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.common.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.common.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.common.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.common.netty.OpenChannelsHandler.handleUpstream(OpenChannelsHandler.java:74)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.common.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.common.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:559)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.common.netty.channel.Channels.fireMessageReceived(Channels.java:268)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.common.netty.channel.Channels.fireMessageReceived(Channels.java:255)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.common.netty.channel.socket.nio.NioWorker.read(NioWorker.java:88)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.common.netty.channel.socket.nio.AbstractNioWorker.process(AbstractNioWorker.java:108)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.common.netty.channel.socket.nio.AbstractNioSelector.run(AbstractNioSelector.java:337)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.common.netty.channel.socket.nio.AbstractNioWorker.run(AbstractNioWorker.java:89)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.common.netty.channel.socket.nio.NioWorker.run(NioWorker.java:178)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.common.netty.util.ThreadRenamingRunnable.run(ThreadRenamingRunnable.java:108)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at org.elasticsearch.common.netty.util.internal.DeadLockProofWorker$1.run(DeadLockProofWorker.java:42)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
> > > > 
> > > > ```
> 
> > > > ```
> > > > at java.lang.Thread.run(Thread.java:745)
> > > > 
> > > > ```
> 
> > > > [2016-03-21 13:19:35,122][INFO][com.floragunn.searchguard.rest.DefaultRestFilter] Authenticated user is User [name=testuser, roles=]
> 
> > > >