Permissions error after configuring DLS query

Search Guard
1

Elasticsearch version:
sg-elasticsearch:7.16.3-52.6.0

Server OS version:
Ubuntu 20.04

Kibana version (if relevant):
sg-kibana:7.16.3-52.2.0

Describe the issue:
After configuring a Document-Level Security query in a Role, I’m getting the following error: Unexpected exception indices:data/read/async_search/submit.

I’ve played with formulating different types of queries (bool, term) and get the same results. I’ve tried locating the specific indices:data/read/async_search/submit permission in SearchGuard and it doesn’t seem to exist. After removing the DLS query, things work fine again without changing any of the index patterns or permissions applied to them, so it leads me to believe this is specific to the DLS query being the issue.

2

@shaun Could you share your role config?
Where do you see that error?

3 
restricted_access:
  description: "Restricted access to indices"
  cluster_permissions:
  index_permissions:
    - index_patterns:
        - "index-*"
      allowed_actions:
        - "SGS_UNLIMITED"
      dls: '{ "query": { "term": { "target": "webservers"} } }'
  tenant_permissions:

The error appears in Kibana when attempting to load the index-* index in Discover.

4

I just figured this out. Including query: {} in the DLS search syntax is the cause, apparently that’s implied.

5

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.