# no permissions for \[cluster:monitor/main\] **URL:** \ **Category:** Search Guard\ **Created:** [March 18, 2019, 3:21pm UTC](https://forum.search-guard.com/t/no-permissions-for-cluster-monitor-main/1377 "2019-03-18T15:21:01Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![k.zhelyazkov](https://avatars.discourse-cdn.com/v4/letter/k/91b2a8/32.png) [@k.zhelyazkov](https://forum.search-guard.com/u/k.zhelyazkov)\ **Post date:** [March 18, 2019, 3:21pm UTC](https://forum.search-guard.com/t/no-permissions-for-cluster-monitor-main/1377/1 "2019-03-18T15:21:01Z")
- Search Guard and Elasticsearch version: search-guard-6:6.5.4-24.0 - JVM version and operating system version: 9 - Search Guard configuration files Hi. I would like to create custom user which will be able to read the logs only from 1 index. I tried a lot of permissions but when i run curl [http://localhost:9200](http://localhost:9200) --user user:, i got: { “error”: { “reason”: “no permissions for [cluster:monitor/main] and User [name=user, roles=[sg\_user], requestedTenant=null]”, “root\_cause”: [ { “reason”: “no permissions for [cluster:monitor/main] and User [name=user, roles=[sg\_user], requestedTenant=null]”, “type”: “security\_exception” } ], “type”: “security\_exception” }, “status”: 403 } Can you tell me what is wrong with my configuration, please. Here are my sg\_\*.yml files. The problem comes with the user “user” and the role “sg\_user” [sg\_action\_group.yml](https://forum.search-guard.com/uploads/short-url/w3jlacNm21NIntAYQW5Gx7M552f.yml) (2.31 KB) [sg\_config.yml](https://forum.search-guard.com/uploads/short-url/e1Z8oqAUgTptlHSP6SDCRj5wYPw.yml) (463 Bytes) [sg\_internal\_users.yml](https://forum.search-guard.com/uploads/short-url/evgr3L6k4E8tfcDi1xXDNPfKLqO.yml) (391 Bytes) [sg\_roles\_mapping.yml](https://forum.search-guard.com/uploads/short-url/xtexfivel9mzixjM6IOO6fBc5wZ.yml) (300 Bytes) [sg\_roles.yml](https://forum.search-guard.com/uploads/short-url/mdyfZtEV3vlEKLGVeBrOuEBgLM4.yml) (2.12 KB) ---
**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\ **Post date:** [March 18, 2019, 3:27pm UTC](https://forum.search-guard.com/t/no-permissions-for-cluster-monitor-main/1377/2 "2019-03-18T15:27:30Z")
In sg\_roles.yml try sg\_user:   cluster:   - CLUSTER\_MONITOR   - CLUSTER\_COMPOSITE\_OPS\_RO   indices:     '\*logstash-normal\*':       '\*':       - READ   readonly: true > **···** > > > Am 18.03.2019 um 16:21 schrieb k.zhelyazkov@sap.com: > > > > \* Search Guard and Elasticsearch version: search-guard-6:6.5.4-24.0 > > \* JVM version and operating system version: 9 > > \* Search Guard configuration files > > > > Hi. I would like to create custom user which will be able to read the logs only from 1 index. I tried a lot of permissions but when i run curl [http://localhost:9200](http://localhost:9200) --user user:\, i got: > > > > { > >   "error": { > >     "reason": "no permissions for [cluster:monitor/main] and User [name=user, roles=[sg\_user], requestedTenant=null]", > >     "root\_cause": [ > >       { > >         "reason": "no permissions for [cluster:monitor/main] and User [name=user, roles=[sg\_user], requestedTenant=null]", > >         "type": "security\_exception" > >       } > >     ], > >     "type": "security\_exception" > >   }, > >   "status": 403 > > } > > > > Can you tell me what is wrong with my configuration, please. Here are my sg\_\*.yml files. > > > > The problem comes with the user "user" and the role "sg\_user" > > > > -- > > You received this message because you are subscribed to the Google Groups "Search Guard Community Forum" group. > > To unsubscribe from this group and stop receiving emails from it, send an email to search-guard+unsubscribe@googlegroups.com. > > To post to this group, send email to search-guard@googlegroups.com. > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/80313767-322a-4fbd-976f-59e1b91e3f9c%40googlegroups.com\](https://groups.google.com/d/msgid/search-guard/80313767-322a-4fbd-976f-59e1b91e3f9c%40googlegroups.com%5C). > > For more options, visit [https://groups.google.com/d/optout\](https://groups.google.com/d/optout%5C). > > \\\\\ ---
**Author:** ![k.zhelyazkov](https://avatars.discourse-cdn.com/v4/letter/k/91b2a8/32.png) [@k.zhelyazkov](https://forum.search-guard.com/u/k.zhelyazkov)\ **Post date:** [March 18, 2019, 3:41pm UTC](https://forum.search-guard.com/t/no-permissions-for-cluster-monitor-main/1377/3 "2019-03-18T15:41:15Z")
Still the same message ---
**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\ **Post date:** [March 18, 2019, 3:42pm UTC](https://forum.search-guard.com/t/no-permissions-for-cluster-monitor-main/1377/4 "2019-03-18T15:42:12Z")
Did you run sgadmin after altering sg\_roles.yml? > **···** > > > Am 18.03.2019 um 16:40 schrieb k.zhelyazkov@sap.com: > > > > Still the same message > > > > On Monday, March 18, 2019 at 5:27:32 PM UTC+2, Search Guard wrote: > > In sg\_roles.yml try > > > > sg\_user: > >   cluster: > >   - CLUSTER\_MONITOR > >   - CLUSTER\_COMPOSITE\_OPS\_RO > >   indices: > >     '\*logstash-normal\*': > >       '\*': > >       - READ > >   readonly: true > > > > \> Am 18.03.2019 um 16:21 schrieb k.zhel...@sap.com: > > \> > > \> \* Search Guard and Elasticsearch version: search-guard-6:6.5.4-24.0 > > \> \* JVM version and operating system version: 9 > > \> \* Search Guard configuration files > > \> > > \> Hi. I would like to create custom user which will be able to read the logs only from 1 index. I tried a lot of permissions but when i run curl [http://localhost:9200](http://localhost:9200) --user user:\, i got: > > \> > > \> { > > \> "error": { > > \> "reason": "no permissions for [cluster:monitor/main] and User [name=user, roles=[sg\_user], requestedTenant=null]", > > \> "root\_cause": [ > > \> { > > \> "reason": "no permissions for [cluster:monitor/main] and User [name=user, roles=[sg\_user], requestedTenant=null]", > > \> "type": "security\_exception" > > \> } > > \> ], > > \> "type": "security\_exception" > > \> }, > > \> "status": 403 > > \> } > > \> > > \> Can you tell me what is wrong with my configuration, please. Here are my sg\_\*.yml files. > > \> > > \> The problem comes with the user "user" and the role "sg\_user" > > \> > > \> -- > > \> You received this message because you are subscribed to the Google Groups "Search Guard Community Forum" group. > > \> To unsubscribe from this group and stop receiving emails from it, send an email to search-guard...@googlegroups.com. > > \> To post to this group, send email to search...@googlegroups.com. > > \> To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/80313767-322a-4fbd-976f-59e1b91e3f9c%40googlegroups.com\](https://groups.google.com/d/msgid/search-guard/80313767-322a-4fbd-976f-59e1b91e3f9c%40googlegroups.com%5C). > > \> For more options, visit [https://groups.google.com/d/optout\](https://groups.google.com/d/optout%5C). > > \> \\\\\ > > > > -- > > You received this message because you are subscribed to the Google Groups "Search Guard Community Forum" group. > > To unsubscribe from this group and stop receiving emails from it, send an email to search-guard+unsubscribe@googlegroups.com. > > To post to this group, send email to search-guard@googlegroups.com. > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/066cdea2-0c68-4970-baa4-c3e4c7c4b166%40googlegroups.com\](https://groups.google.com/d/msgid/search-guard/066cdea2-0c68-4970-baa4-c3e4c7c4b166%40googlegroups.com%5C). > > For more options, visit [https://groups.google.com/d/optout\](https://groups.google.com/d/optout%5C). ---
**Author:** ![k.zhelyazkov](https://avatars.discourse-cdn.com/v4/letter/k/91b2a8/32.png) [@k.zhelyazkov](https://forum.search-guard.com/u/k.zhelyazkov)\ **Post date:** [March 18, 2019, 3:42pm UTC](https://forum.search-guard.com/t/no-permissions-for-cluster-monitor-main/1377/5 "2019-03-18T15:42:59Z")
Search Guard Admin v6 Will connect to master-svc:9300 … done Elasticsearch Version: 6.5.4 Search Guard Version: 6.5.4-24.0 Connected as CN=master-svc Contacting elasticsearch cluster ‘elasticsearch’ and wait for YELLOW clusterstate … Clustername: shoot–i355448–shoot-elasticsearch-logging Clusterstate: GREEN Number of nodes: 1 Number of data nodes: 1 searchguard index already exists, so we do not need to create one. Populate config from /root/sgconfig/ Will update ‘sg/config’ with /root/sgconfig/sg\_config.yml SUCC: Configuration for ‘config’ created or updated Will update ‘sg/roles’ with /root/sgconfig/sg\_roles.yml SUCC: Configuration for ‘roles’ created or updated Will update ‘sg/rolesmapping’ with /root/sgconfig/sg\_roles\_mapping.yml SUCC: Configuration for ‘rolesmapping’ created or updated Will update ‘sg/internalusers’ with /root/sgconfig/sg\_internal\_users.yml SUCC: Configuration for ‘internalusers’ created or updated Will update ‘sg/actiongroups’ with /root/sgconfig/sg\_action\_groups.yml SUCC: Configuration for ‘actiongroups’ created or updated Done with success > **···** > > On Monday, March 18, 2019 at 5:42:16 PM UTC+2, Search Guard wrote: > > > Did you run sgadmin after altering sg\_roles.yml? > > > > > Am 18.03.2019 um 16:40 schrieb [k.zhel...@sap.com](mailto:k.zhel...@sap.com): > > > > > Still the same message > > > > > On Monday, March 18, 2019 at 5:27:32 PM UTC+2, Search Guard wrote: > > > > > In sg\_roles.yml try > > > > > > sg\_user: > > > cluster: > > > > > > - CLUSTER\_MONITOR > > > - CLUSTER\_COMPOSITE\_OPS\_RO > > > indices: > > > ‘_logstash-normal_’: > > > ‘\*’: > > > - READ > > > readonly: true > > > > > > > Am 18.03.2019 um 16:21 schrieb [k.zhel...@sap.com](mailto:k.zhel...@sap.com): > > > > > > > > - Search Guard and Elasticsearch version: search-guard-6:6.5.4-24.0 > > > > - JVM version and operating system version: 9 > > > > - Search Guard configuration files > > > > > > > > Hi. I would like to create custom user which will be able to read the logs only from 1 index. I tried a lot of permissions but when i run curl [http://localhost:9200](http://localhost:9200) --user user:, i got: > > > > > > > > { > > > > “error”: { > > > > “reason”: “no permissions for [cluster:monitor/main] and User [name=user, roles=[sg\_user], requestedTenant=null]”, > > > > “root\_cause”: [ > > > > { > > > > “reason”: “no permissions for [cluster:monitor/main] and User [name=user, roles=[sg\_user], requestedTenant=null]”, > > > > “type”: “security\_exception” > > > > } > > > > ], > > > > “type”: “security\_exception” > > > > }, > > > > “status”: 403 > > > > } > > > > > > > > Can you tell me what is wrong with my configuration, please. Here are my sg\_\*.yml files. > > > > > > > > The problem comes with the user “user” and the role “sg\_user” > > > > > > > > – > > > > You received this message because you are subscribed to the Google Groups “Search Guard Community Forum” group. > > > > To unsubscribe from this group and stop receiving emails from it, send an email to [search-guard...@googlegroups.com](mailto:search-guard...@googlegroups.com). > > > > To post to this group, send email to [search...@googlegroups.com](mailto:search...@googlegroups.com). > > > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/80313767-322a-4fbd-976f-59e1b91e3f9c%40googlegroups.com](https://groups.google.com/d/msgid/search-guard/80313767-322a-4fbd-976f-59e1b91e3f9c%40googlegroups.com). > > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). > > > > \\\\\ > > > > > > – > > > You received this message because you are subscribed to the Google Groups “Search Guard Community Forum” group. > > > > > To unsubscribe from this group and stop receiving emails from it, send an email to [search-guard...@googlegroups.com](mailto:search-guard...@googlegroups.com). > > > > > To post to this group, send email to [search...@googlegroups.com](mailto:search...@googlegroups.com). > > > > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/066cdea2-0c68-4970-baa4-c3e4c7c4b166%40googlegroups.com](https://groups.google.com/d/msgid/search-guard/066cdea2-0c68-4970-baa4-c3e4c7c4b166%40googlegroups.com). > > > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\ **Post date:** [March 18, 2019, 3:51pm UTC](https://forum.search-guard.com/t/no-permissions-for-cluster-monitor-main/1377/6 "2019-03-18T15:51:43Z")
in internal users yml: user:   hash: $2a$12$Sg4DNnD44579g8D.RJPQtuBacbLH817eVVlOPmHuYx5MS4Heay8TK aynd in roles mapping yml sg\_user:   users:   - user   readall: true Mind the additional indirection between "backendroles" and "Search Guard roles" as explained here: - [Mapping users to Search Guard roles | Security for Elasticsearch | Search Guard](https://docs.search-guard.com/latest/mapping-users-roles) - [Role mapping modes | Security for Elasticsearch | Search Guard](https://docs.search-guard.com/latest/role-mapping-modes) > **···** > > > Am 18.03.2019 um 16:42 schrieb k.zhelyazkov@sap.com: > > > > Search Guard Admin v6 > > Will connect to master-svc:9300 ... done > > Elasticsearch Version: 6.5.4 > > Search Guard Version: 6.5.4-24.0 > > Connected as CN=master-svc > > Contacting elasticsearch cluster 'elasticsearch' and wait for YELLOW clusterstate ... > > Clustername: shoot--i355448--shoot-elasticsearch-logging > > Clusterstate: GREEN > > Number of nodes: 1 > > Number of data nodes: 1 > > searchguard index already exists, so we do not need to create one. > > Populate config from /root/sgconfig/ > > Will update 'sg/config' with /root/sgconfig/sg\_config.yml > >    SUCC: Configuration for 'config' created or updated > > Will update 'sg/roles' with /root/sgconfig/sg\_roles.yml > >    SUCC: Configuration for 'roles' created or updated > > Will update 'sg/rolesmapping' with /root/sgconfig/sg\_roles\_mapping.yml > >    SUCC: Configuration for 'rolesmapping' created or updated > > Will update 'sg/internalusers' with /root/sgconfig/sg\_internal\_users.yml > >    SUCC: Configuration for 'internalusers' created or updated > > Will update 'sg/actiongroups' with /root/sgconfig/sg\_action\_groups.yml > >    SUCC: Configuration for 'actiongroups' created or updated > > Done with success > > > > On Monday, March 18, 2019 at 5:42:16 PM UTC+2, Search Guard wrote: > > Did you run sgadmin after altering sg\_roles.yml? > > > > \> Am 18.03.2019 um 16:40 schrieb k.zhel...@sap.com: > > \> > > \> Still the same message > > \> > > \> On Monday, March 18, 2019 at 5:27:32 PM UTC+2, Search Guard wrote: > > \> In sg\_roles.yml try > > \> > > \> sg\_user: > > \> cluster: > > \> - CLUSTER\_MONITOR > > \> - CLUSTER\_COMPOSITE\_OPS\_RO > > \> indices: > > \> '\*logstash-normal\*': > > \> '\*': > > \> - READ > > \> readonly: true > > \> > > \> \> Am 18.03.2019 um 16:21 schrieb k.zhel...@sap.com: > > \> \> > > \> \> \* Search Guard and Elasticsearch version: search-guard-6:6.5.4-24.0 > > \> \> \* JVM version and operating system version: 9 > > \> \> \* Search Guard configuration files > > \> \> > > \> \> Hi. I would like to create custom user which will be able to read the logs only from 1 index. I tried a lot of permissions but when i run curl [http://localhost:9200](http://localhost:9200) --user user:\, i got: > > \> \> > > \> \> { > > \> \> "error": { > > \> \> "reason": "no permissions for [cluster:monitor/main] and User [name=user, roles=[sg\_user], requestedTenant=null]", > > \> \> "root\_cause": [ > > \> \> { > > \> \> "reason": "no permissions for [cluster:monitor/main] and User [name=user, roles=[sg\_user], requestedTenant=null]", > > \> \> "type": "security\_exception" > > \> \> } > > \> \> ], > > \> \> "type": "security\_exception" > > \> \> }, > > \> \> "status": 403 > > \> \> } > > \> \> > > \> \> Can you tell me what is wrong with my configuration, please. Here are my sg\_\*.yml files. > > \> \> > > \> \> The problem comes with the user "user" and the role "sg\_user" > > \> \> > > \> \> -- > > \> \> You received this message because you are subscribed to the Google Groups "Search Guard Community Forum" group. > > \> \> To unsubscribe from this group and stop receiving emails from it, send an email to search-guard...@googlegroups.com. > > \> \> To post to this group, send email to search...@googlegroups.com. > > \> \> To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/80313767-322a-4fbd-976f-59e1b91e3f9c%40googlegroups.com\](https://groups.google.com/d/msgid/search-guard/80313767-322a-4fbd-976f-59e1b91e3f9c%40googlegroups.com%5C). > > \> \> For more options, visit [https://groups.google.com/d/optout\](https://groups.google.com/d/optout%5C). > > \> \> \\\\\ > > \> > > \> > > \> -- > > \> You received this message because you are subscribed to the Google Groups "Search Guard Community Forum" group. > > \> To unsubscribe from this group and stop receiving emails from it, send an email to search-guard...@googlegroups.com. > > \> To post to this group, send email to search...@googlegroups.com. > > \> To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/066cdea2-0c68-4970-baa4-c3e4c7c4b166%40googlegroups.com\](https://groups.google.com/d/msgid/search-guard/066cdea2-0c68-4970-baa4-c3e4c7c4b166%40googlegroups.com%5C). > > \> For more options, visit [https://groups.google.com/d/optout\](https://groups.google.com/d/optout%5C). > > > > -- > > You received this message because you are subscribed to the Google Groups "Search Guard Community Forum" group. > > To unsubscribe from this group and stop receiving emails from it, send an email to search-guard+unsubscribe@googlegroups.com. > > To post to this group, send email to search-guard@googlegroups.com. > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/4334b2ae-14d9-495b-bf76-a6c803730f10%40googlegroups.com\](https://groups.google.com/d/msgid/search-guard/4334b2ae-14d9-495b-bf76-a6c803730f10%40googlegroups.com%5C). > > For more options, visit [https://groups.google.com/d/optout\](https://groups.google.com/d/optout%5C). ---
**Author:** ![k.zhelyazkov](https://avatars.discourse-cdn.com/v4/letter/k/91b2a8/32.png) [@k.zhelyazkov](https://forum.search-guard.com/u/k.zhelyazkov)\ **Post date:** [March 18, 2019, 4:05pm UTC](https://forum.search-guard.com/t/no-permissions-for-cluster-monitor-main/1377/7 "2019-03-18T16:05:16Z")
Thanks a lot, it works. Can you assist me with one more thing. My index is called “logstash-normal-2019.03.18” Why i do not get any logs when my role is: roles: sg\_user: readonly: true cluster: - CLUSTER\_MONITOR - CLUSTER\_COMPOSITE\_OPS\_RO indices: ‘_logstash-normal_’: ‘\*’: - READ ---
**Author:** ![k.zhelyazkov](https://avatars.discourse-cdn.com/v4/letter/k/91b2a8/32.png) [@k.zhelyazkov](https://forum.search-guard.com/u/k.zhelyazkov)\ **Post date:** [March 18, 2019, 4:18pm UTC](https://forum.search-guard.com/t/no-permissions-for-cluster-monitor-main/1377/8 "2019-03-18T16:18:26Z")
Maybe i do not have enough permissions to read logs from the Index? Im trying to read them from Kibana ---
**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\ **Post date:** [March 18, 2019, 4:20pm UTC](https://forum.search-guard.com/t/no-permissions-for-cluster-monitor-main/1377/9 "2019-03-18T16:20:48Z")
Your role definition looks good so far. Any error message? What do you mean with “Why i do not get any logs …” > **···** > > On Monday, 18 March 2019 17:16:04 UTC+1, k.zhe…@…com wrote: > > > Maybe i do not have enough permissions to read logs from the Index? > > > > > > Im trying to read them from Kibana > > > ---
**Author:** ![k.zhelyazkov](https://avatars.discourse-cdn.com/v4/letter/k/91b2a8/32.png) [@k.zhelyazkov](https://forum.search-guard.com/u/k.zhelyazkov)\ **Post date:** [March 18, 2019, 4:23pm UTC](https://forum.search-guard.com/t/no-permissions-for-cluster-monitor-main/1377/10 "2019-03-18T16:23:36Z")
When i log in in Kibana with this User, I do not see any logs. ---
**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\ **Post date:** [March 18, 2019, 4:26pm UTC](https://forum.search-guard.com/t/no-permissions-for-cluster-monitor-main/1377/11 "2019-03-18T16:26:39Z")
Maybe you need to adjust the time filter on the right upper corner. And make sure you have the correct index pattern selected. And be sure that there are really log entries exists in the index. > **···** > > > Am 18.03.2019 um 17:23 schrieb k.zhelyazkov@sap.com: > > > > When i log in in Kibana with this User, I do not see any logs. > > > > -- > > You received this message because you are subscribed to the Google Groups "Search Guard Community Forum" group. > > To unsubscribe from this group and stop receiving emails from it, send an email to search-guard+unsubscribe@googlegroups.com. > > To post to this group, send email to search-guard@googlegroups.com. > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/e8175527-cbb4-41e5-94ab-ecabffeb2445%40googlegroups.com\](https://groups.google.com/d/msgid/search-guard/e8175527-cbb4-41e5-94ab-ecabffeb2445%40googlegroups.com%5C). > > For more options, visit [https://groups.google.com/d/optout\](https://groups.google.com/d/optout%5C). ---
**Author:** ![k.zhelyazkov](https://avatars.discourse-cdn.com/v4/letter/k/91b2a8/32.png) [@k.zhelyazkov](https://forum.search-guard.com/u/k.zhelyazkov)\ **Post date:** [March 18, 2019, 4:30pm UTC](https://forum.search-guard.com/t/no-permissions-for-cluster-monitor-main/1377/12 "2019-03-18T16:30:54Z")
![Screen Shot 2019-03-18 at 18.30.20.png](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/1X/35eb1df4880ea224098f9115e7b54a6e24e55962.png) ---
**Author:** ![k.zhelyazkov](https://avatars.discourse-cdn.com/v4/letter/k/91b2a8/32.png) [@k.zhelyazkov](https://forum.search-guard.com/u/k.zhelyazkov)\ **Post date:** [March 18, 2019, 4:33pm UTC](https://forum.search-guard.com/t/no-permissions-for-cluster-monitor-main/1377/13 "2019-03-18T16:33:14Z")
I do not have any checkbox, filters and so on in Kibana. So maybe Kibana requires additional permissions i think ---
**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\ **Post date:** [March 18, 2019, 4:34pm UTC](https://forum.search-guard.com/t/no-permissions-for-cluster-monitor-main/1377/14 "2019-03-18T16:34:44Z")
Add the sg\_kibana\_user role to all users which should be able to use Kibana. See [Installing the Search Guard Kibana Plugin | Security for Elasticsearch | Search Guard](https://docs.search-guard.com/latest/kibana-plugin-installation#configuring-elasticsearch-adding-kibana-users) > **···** > > On Monday, 18 March 2019 17:30:54 UTC+1, k…@…com… wrote: > > > ![Screen Shot 2019-03-18 at 18.30.20.png](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/1X/35eb1df4880ea224098f9115e7b54a6e24e55962.png) ---
**Author:** ![k.zhelyazkov](https://avatars.discourse-cdn.com/v4/letter/k/91b2a8/32.png) [@k.zhelyazkov](https://forum.search-guard.com/u/k.zhelyazkov)\ **Post date:** [March 18, 2019, 5:00pm UTC](https://forum.search-guard.com/t/no-permissions-for-cluster-monitor-main/1377/15 "2019-03-18T17:00:03Z")
With this update i got the following error in Kibana: Discover: no permissions for [indices:data/read/search] and user [name=user, roles, requestedTenant=null] ---
**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\ **Post date:** [March 18, 2019, 8:02pm UTC](https://forum.search-guard.com/t/no-permissions-for-cluster-monitor-main/1377/16 "2019-03-18T20:02:23Z")
Make sure you have access to all indices matching your index pattern. Can you attach a screenshot? > **···** > > > Am 18.03.2019 um 18:00 schrieb k.zhelyazkov@sap.com: > > > > With this update i got the following error in Kibana: > > > > Discover: no permissions for [indices:data/read/search] and user [name=user, roles, requestedTenant=null] > > > > -- > > You received this message because you are subscribed to the Google Groups "Search Guard Community Forum" group. > > To unsubscribe from this group and stop receiving emails from it, send an email to search-guard+unsubscribe@googlegroups.com. > > To post to this group, send email to search-guard@googlegroups.com. > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/db8c3ca1-69c1-4dba-a3db-425e63c8b992%40googlegroups.com\](https://groups.google.com/d/msgid/search-guard/db8c3ca1-69c1-4dba-a3db-425e63c8b992%40googlegroups.com%5C). > > For more options, visit [https://groups.google.com/d/optout\](https://groups.google.com/d/optout%5C). ---
**Author:** ![k.zhelyazkov](https://avatars.discourse-cdn.com/v4/letter/k/91b2a8/32.png) [@k.zhelyazkov](https://forum.search-guard.com/u/k.zhelyazkov)\ **Post date:** [March 18, 2019, 8:04pm UTC](https://forum.search-guard.com/t/no-permissions-for-cluster-monitor-main/1377/17 "2019-03-18T20:04:00Z")
I found that it works by adding "- indices:data/read/scroll " in the clusters permissions. Thanks for the help 🙂 ---
**Author:** ![viveksinghggits](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/viveksinghggits/32/538_2.png) [@viveksinghggits](https://forum.search-guard.com/u/viveksinghggits)\ **Post date:** [June 28, 2019, 6:49pm UTC](https://forum.search-guard.com/t/no-permissions-for-cluster-monitor-main/1377/18 "2019-06-28T18:49:38Z")
so, I am using elastic’s official elastic search image to run elastcsearch version `6.7.2` and installing search guard plugin version `com.floragunn:search-guard-6:6.7.2-25.1` in the `Dockerfile`. Now the very same thing works when I tried it all with elasticsearch version `7.0.1` but getting below error If I run that docker image which runs the version `6.7.2` Dockerfile can be found at > **[GitHub - viveksinghggits/dockerfiles: Dockerfiles for the official Elastic...](https://github.com/viveksinghggits/dockerfiles)** > > Dockerfiles for the official Elastic Stack images and secured through basic authentication. - GitHub - viveksinghggits/dockerfiles: Dockerfiles for the official Elastic Stack images and secured thr... ```auto { "error": { "root_cause": [ { "type": "security_exception", "reason": "no permissions for [cluster:monitor/main] and User [name=admin, roles=[], requestedTenant=null]" } ], "type": "security_exception", "reason": "no permissions for [cluster:monitor/main] and User [name=admin, roles=[], requestedTenant=null]" }, "status": 403 } ``` I tried to change the `sg_roles_mapping.yml` with mentioned values but agadmin failed with below error `sg_roles_mapping.yml` ```auto sg_user: users: - admin: readall: true ``` `sgadmin.sh` error ```auto Will update 'sg/rolesmapping' with ../sgconfig/sg_roles_mapping.yml FAIL: Configuration for 'rolesmapping' failed because of com.fasterxml.jackson.dataformat.yaml.snakeyaml.error.MarkedYAMLException: while parsing a block collection in 'reader', line 37, column 5: - admin: ^ expected , but found Key in 'reader', line 38, column 5: readall: true ^ ``` It looks like an issue with the format in which I am making the the entry , but I was not able to resolve that. Once more thing, do I actually need to do this, because I dont get any error if try to do the same thing and install it on my ubuntu machine and not in docker. Any help is appreciated. ---
**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\ **Post date:** [June 29, 2019, 7:19pm UTC](https://forum.search-guard.com/t/no-permissions-for-cluster-monitor-main/1377/19 "2019-06-29T19:19:18Z")
The indentation of your roles\_mapping.yml is not correct. Keep in mind that the yaml format is picky about the correct indentation: ``` sg_user: users: - admin: readall: true ``` The `readall` config key is is not allowed in the roles mapping, only `users`, `backendroles` and `hosts`. So either remove this entry and also the colon after `admin`: ``` sg_user: users: - admin ``` Or if you want to make the role mapping _readonly_, then it should read: ``` sg_user: readonly: true users: - admin ``` ---
**Author:** ![viveksinghggits](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/viveksinghggits/32/538_2.png) [@viveksinghggits](https://forum.search-guard.com/u/viveksinghggits)\ **Post date:** [June 30, 2019, 9:36am UTC](https://forum.search-guard.com/t/no-permissions-for-cluster-monitor-main/1377/20 "2019-06-30T09:36:07Z")
So, I used the first format that is ```auto sg_user: users: - admin ``` and ran `sgadmin.bat` but getting the same error even after that I mean while accessing the elasitc seatch cluster. Again, I have the same question things are working exactly as expected if I do the same thing with elastic search version `7.0.2`. So is there something wrong that I am doing and because of that I have to change the role\_mapping manually. I am doing everything inside a docker container so I am changing the configuration file and then running the `sgadmin.bat` file from inside the container only. [Next page](https://forum.search-guard.com/t/no-permissions-for-cluster-monitor-main/1377.md?page=2)