No permissions for [indices:data/read/search]

Search Guard
1

No index-level perm match for User sg_anonymous [backend_roles=[sg_anonymous_backendrole]] Resolved [aliases=[.kibana_7.17.7], indices=, allIndices=[.kibana_7.17.7_001], types=[*], originalRequested=[.kibana_7.17.7], remoteIndices=, localAll=false, indicesOptions=IndicesOptions[ignore_unavailable=false, allow_no_indices=true, expand_wildcards_open=true, expand_wildcards_closed=false, expand_wildcards_hidden=false, allow_aliases_to_multiple_indices=true, forbid_closed_indices=false, ignore_aliases=false, ignore_throttled=false]] [Action [indices:data/read/search]] [RolesChecked [sg_anonymous, SGS_OWN_INDEX]]
[2022-12-09T17:38:02,396][INFO ][c.f.s.p.PrivilegesEvaluator] [bldafinsgt-stg-es1] No permissions for [indices:data/read/search]

2

sg_roles.yml:
sg_anonymous:
cluster_permissions:
- “SGS_CLUSTER_COMPOSITE_OPS_RO”
- “cluster:monitor/health”
tenant_permissions:
- tenant_patterns:
- “global_tenant”

3

Hello,

it would be kinda helpful if you would include the version of Search Guard and ask a question.

4

Hi,

Search guard : 53.5.0
Not able to login to elasticsearch or Kibana using browser. getting below error

{“error”:{“root_cause”:[{“type”:“security_exception”,“reason”:“no permissions for [cluster:monitor/main] and User sg_anonymous [backend_roles=[sg_anonymous_backendrole]]”}],“type”:“security_exception”,“reason”:“no permissions for [cluster:monitor/main] and User sg_anonymous [backend_roles=[sg_anonymous_backendrole]]”},“status”:403}
Tried all options not to able resolve.
Below are my roles.yml & roles_mapping.yml

Role mapping
sg_anonymous:
backend_roles:

  • “admin”
  • “sg_anonymous_backendrole”
  • “SGS_ALL_ACCESS”

Roles.yml
sg_anonymous:
cluster_permissions:
- “SGS_CLUSTER_COMPOSITE_OPS_RO”
- “cluster:monitor/health”
- “cluster:monitor/state”
- “SGS_ALL_ACCESS”
index_permissions:
- index_patterns:
- “*”
allowed_actions:
- “READ”
- “WRITE”
- SGS_INDICES_MONITOR
tenant_permissions:
- tenant_patterns:
- “global_tenant”

5

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.