# Multitenancy ELK 7.8

**URL:** <https://forum.search-guard.com/t/multitenancy-elk-7-8/1916>\
**Category:** Search Guard\
**Created:** [August 6, 2020, 11:53am UTC](https://forum.search-guard.com/t/multitenancy-elk-7-8/1916 "2020-08-06T11:53:15Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![marwojt](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/marwojt/32/872_2.png) [@marwojt](https://forum.search-guard.com/u/marwojt)\
**Post date:** [August 6, 2020, 11:53am UTC](https://forum.search-guard.com/t/multitenancy-elk-7-8/1916/1 "2020-08-06T11:53:16Z")

</div>

**Elasticsearch version:**  
7.8 + sg plugin 43.0.0  
**Server OS version:**  
Centos 7  
**Kibana version (if relevant):**  
Kibana 7.8 + kibana sg plugin 43.0.0

There is some problem with creating tenants, no matter how. I try by tenants api, sgadmin and gui.  
When I create new tenant it’s always visible in Kibana but then sometimes i can’t switch to this tenant. Sometimes is working like expected sometimes not. When i can’t switch to tenant then i am move to Global.

```auto
sg_config:
  dynamic:
    filtered_alias_mode: "warn"
    do_not_fail_on_forbidden: true
    do_not_fail_on_forbidden_empty: false
    kibana:
      multitenancy_enabled: true
      server_username: "kibanaserver"
      index: ".kibana"
...

```

kibana.yml

```auto
searchguard.accountinfo.enabled: false
searchguard:
    #cookie:
        #password: "<some_string>"
        #secure: true
        #ttl: 0
    session:
        #ttl: 0
        keepalive: true
    multitenancy:
        enabled: true
        tenants:
            enable_global: true
            enable_private: false
           # preferred:
           # - "*"
           # - private
    basicauth:
        forbidden_usernames: ["kibanaro", "kibanaserver", "logstash", "readall", "remote_monitoring", "snapshotrestore"]
        #login:
            #brandimage: <some_string>

```

br,  
Mariusz

---

<div class="post-metadata">

**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\
**Post date:** [August 7, 2020, 10:14am UTC](https://forum.search-guard.com/t/multitenancy-elk-7-8/1916/2 "2020-08-07T10:14:42Z")

</div>

> Sometimes is working like expected sometimes not.

Did you see any error in the Elasticsearch or Kibana log when this happened? Any error in the browser console log? How many tenants do you have?

---

<div class="post-metadata">

**Author:** ![marwojt](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/marwojt/32/872_2.png) [@marwojt](https://forum.search-guard.com/u/marwojt)\
**Post date:** [August 10, 2020, 6:37am UTC](https://forum.search-guard.com/t/multitenancy-elk-7-8/1916/3 "2020-08-10T06:37:30Z")

</div>

Hi ,  
I have around 110 tenants. I didn’t find nothing special in logs but i will take a closer look and try send some logs. There is no errors in browser  
It seems that problem appears when I use tenant API from sgadmin or Devtools.  
Sometimes I saw in kibana logs that user even if don’t have privileges to Global try to switch to SGS\_GLOBAL\_TENANT.  
Try to create for example 50 tenants from sgadmin and switch to them from user with SGS\_ALL\_ACCESS role.  
br,  
MW

---

<div class="post-metadata">

**Author:** ![marwojt](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/marwojt/32/872_2.png) [@marwojt](https://forum.search-guard.com/u/marwojt)\
**Post date:** [August 10, 2020, 8:34am UTC](https://forum.search-guard.com/t/multitenancy-elk-7-8/1916/4 "2020-08-10T08:34:14Z")

</div>

I have another suspicion that is something wrong with switching between tenants from Kibana Gui.  
For example I create two new tenants test1 and test2 then i can’t switch between tenants.  
I am in tenant test1 and then try to switch to test2 and i am still in tenant test1. When i select tenant test2 and then logout/login then selected tenant is test2.  
br,  
MW

---

<div class="post-metadata">

**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\
**Post date:** [August 10, 2020, 10:57am UTC](https://forum.search-guard.com/t/multitenancy-elk-7-8/1916/5 "2020-08-10T10:57:23Z")

</div>

Hi. I tested more and saw a similar behaviour. We have to look more into it. I’ll get back to you soon. Thanks for reporting this.

---

<div class="post-metadata">

**Author:** ![marwojt](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/marwojt/32/872_2.png) [@marwojt](https://forum.search-guard.com/u/marwojt)\
**Post date:** [August 11, 2020, 7:25am UTC](https://forum.search-guard.com/t/multitenancy-elk-7-8/1916/6 "2020-08-11T07:25:25Z")

</div>

Ok thanks a lot.  
It’s really important future for me 🙂

---

<div class="post-metadata">

**Author:** ![Patryk](https://avatars.discourse-cdn.com/v4/letter/p/838e76/32.png) [@Patryk](https://forum.search-guard.com/u/Patryk)\
**Post date:** [August 17, 2020, 11:27am UTC](https://forum.search-guard.com/t/multitenancy-elk-7-8/1916/7 "2020-08-17T11:27:43Z")

</div>

Hi, any update with this issue? its a main blocker migration from 6 version to 7

---

<div class="post-metadata">

**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\
**Post date:** [August 18, 2020, 3:39pm UTC](https://forum.search-guard.com/t/multitenancy-elk-7-8/1916/8 "2020-08-18T15:39:14Z")

</div>

Hi @Patryk. It is in the high priority queue. I’ll text you when it is ready.

---

<div class="post-metadata">

**Author:** ![marwojt](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/marwojt/32/872_2.png) [@marwojt](https://forum.search-guard.com/u/marwojt)\
**Post date:** [August 31, 2020, 2:55pm UTC](https://forum.search-guard.com/t/multitenancy-elk-7-8/1916/9 "2020-08-31T14:55:51Z")

</div>

Hi @srgbnd,  
any update with this issue?  
br

---

<div class="post-metadata">

**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\
**Post date:** [September 1, 2020, 8:02am UTC](https://forum.search-guard.com/t/multitenancy-elk-7-8/1916/10 "2020-09-01T08:02:00Z")

</div>

Hi @marwojt. It is in the next release (October) queue. If the fix will be ready sooner, we do a build for you before the release.

---

<div class="post-metadata">

**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\
**Post date:** [September 1, 2020, 8:02am UTC](https://forum.search-guard.com/t/multitenancy-elk-7-8/1916/11 "2020-09-01T08:02:42Z")

</div>

What minor version do you use, 7.8.1?

---

<div class="post-metadata">

**Author:** ![marwojt](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/marwojt/32/872_2.png) [@marwojt](https://forum.search-guard.com/u/marwojt)\
**Post date:** [September 1, 2020, 9:23am UTC](https://forum.search-guard.com/t/multitenancy-elk-7-8/1916/12 "2020-09-01T09:23:47Z")

</div>

We use version 7.8.0. Thanks a lot @srgbnd  
br

---

<div class="post-metadata">

**Author:** ![Mike](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/mike/32/458_2.png) [@Mike](https://forum.search-guard.com/u/Mike)\
**Post date:** [September 7, 2020, 12:11pm UTC](https://forum.search-guard.com/t/multitenancy-elk-7-8/1916/13 "2020-09-07T12:11:45Z")

</div>

Hi @marwojt,

Would it be possible for you to test with the following setting in `kibana.yml`?

`searchguard.auth.disable_authinfo_cache: true`

Does that make any difference?

Best Regards  
Mike

---

<div class="post-metadata">

**Author:** ![marwojt](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/marwojt/32/872_2.png) [@marwojt](https://forum.search-guard.com/u/marwojt)\
**Post date:** [September 16, 2020, 10:09am UTC](https://forum.search-guard.com/t/multitenancy-elk-7-8/1916/14 "2020-09-16T10:09:48Z")

</div>

Hi @Mike,  
i have tested this settings and it works. I can change tenants now. Thanks a lot  
br,  
Mariusz

---

<div class="post-metadata">

**Author:** ![Patryk](https://avatars.discourse-cdn.com/v4/letter/p/838e76/32.png) [@Patryk](https://forum.search-guard.com/u/Patryk)\
**Post date:** [September 30, 2020, 3:10pm UTC](https://forum.search-guard.com/t/multitenancy-elk-7-8/1916/15 "2020-09-30T15:10:28Z")

</div>

But i think it’s only temp solution. Any info about date of this release ?

---

<div class="post-metadata">

**Author:** ![marwojt](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/marwojt/32/872_2.png) [@marwojt](https://forum.search-guard.com/u/marwojt)\
**Post date:** [October 19, 2020, 6:40am UTC](https://forum.search-guard.com/t/multitenancy-elk-7-8/1916/16 "2020-10-19T06:40:19Z")

</div>

Hi @Mike, @srgbnd,  
i’ve seen that you release new SG version for elastic 7.9.x.  
Will You make a new package for elastic 7.8.x?  
br,  
Mariusz

---

<div class="post-metadata">

**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\
**Post date:** [October 19, 2020, 8:14am UTC](https://forum.search-guard.com/t/multitenancy-elk-7-8/1916/17 "2020-10-19T08:14:17Z")

</div>

@marwojt Hi. This is a different minor version. Kibana usually introduces breaking changes in the new minor versions. Thus porting back the patch might not be straightforward.

Why do you want to port the cache fix back? Didn’t the option `searchguard.auth.disable_authinfo_cache: true` work for you?

---

<div class="post-metadata">

**Author:** ![marwojt](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/marwojt/32/872_2.png) [@marwojt](https://forum.search-guard.com/u/marwojt)\
**Post date:** [October 19, 2020, 8:34am UTC](https://forum.search-guard.com/t/multitenancy-elk-7-8/1916/18 "2020-10-19T08:34:37Z")

</div>

Hi @srgbnd,  
it works but i am worry about performance. We have a lot off users.  
br,  
Mariusz

---

<div class="post-metadata">

**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\
**Post date:** [October 19, 2020, 8:57am UTC](https://forum.search-guard.com/t/multitenancy-elk-7-8/1916/19 "2020-10-19T08:57:40Z")

</div>

Do you experience any performance issues now?

---

<div class="post-metadata">

**Author:** ![Mike](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/mike/32/458_2.png) [@Mike](https://forum.search-guard.com/u/Mike)\
**Post date:** [October 19, 2020, 9:56am UTC](https://forum.search-guard.com/t/multitenancy-elk-7-8/1916/20 "2020-10-19T09:56:04Z")

</div>

Hi @Patryk and @marwojt,

Actually this will be the default and only behaviour from now (i.e. the latest release) on. We removed the caching on the Kibana side completely, so the setting you used will be deprecated.

The caching didn’t really make much sense at this point, and it led to a bunch of negative side effects.  
In short: no need to worry about this being a temporary solution, it is permanent.

But as @srgbnd mentioned - please let us know if this somehow results in performance issues!

Best regards,  
Mike

[Next page](https://forum.search-guard.com/t/multitenancy-elk-7-8/1916.md?page=2)
