# Roles and permissions for custom REST endpoints? **URL:** \ **Category:** Search Guard\ **Created:** [September 14, 2017, 3:11pm UTC](https://forum.search-guard.com/t/roles-and-permissions-for-custom-rest-endpoints/598 "2017-09-14T15:11:33Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Lukas\_Vlcek](https://avatars.discourse-cdn.com/v4/letter/l/dfb087/32.png) [@Lukas\_Vlcek](https://forum.search-guard.com/u/Lukas_Vlcek)\ **Post date:** [September 14, 2017, 3:11pm UTC](https://forum.search-guard.com/t/roles-and-permissions-for-custom-rest-endpoints/598/1 "2017-09-14T15:11:33Z")
Hi, is it possible to configure SG to control access to custom REST endpoints? I was not able to find any examples or documentation for this. For example, there is ES Prometheus exporter plugin that introduces new REST API [1] to the node. Can I use SearchGuard to control access to such endpoint? Can I assume that the sg\_roles.yml will contain config like this?: > **···** > > * * * > > sg\_role\_prometheus: > > cluster: > > - cluster:monitor/\_prometheus/metrics > > * * * > > [1] [GitHub - vvanholl/elasticsearch-prometheus-exporter: Prometheus exporter plugin for Elasticsearch](https://github.com/vvanholl/elasticsearch-prometheus-exporter#usage) > > Regards, > > Lukáš ---
**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\ **Post date:** [September 14, 2017, 3:57pm UTC](https://forum.search-guard.com/t/roles-and-permissions-for-custom-rest-endpoints/598/2 "2017-09-14T15:57:28Z")
It depends on the other plugin. What is the current behavior you see when installing the prometheus explorer alongside with Search Guard? Do you can access the endpoint without authentication and a result? > **···** > > On Thursday, 14 September 2017 17:11:33 UTC+2, Lukáš Vlček wrote: > > > Hi, > > > is it possible to configure SG to control access to custom REST endpoints? I was not able to find any examples or documentation for this. > > > > > > For example, there is ES Prometheus exporter plugin that introduces new REST API [1] to the node. Can I use SearchGuard to control access to such endpoint? > > > > > > Can I assume that the sg\_roles.yml will contain config like this?: > > > > > > * * * > > > sg\_role\_prometheus: > > > cluster: > > > - cluster:monitor/\_prometheus/metrics > > > * * * > > > > > > [1] [https://github.com/vvanholl/elasticsearch-prometheus-exporter#usage](https://github.com/vvanholl/elasticsearch-prometheus-exporter#usage) > > > > > > Regards, > > > Lukáš ---
**Author:** ![Lukas\_Vlcek](https://avatars.discourse-cdn.com/v4/letter/l/dfb087/32.png) [@Lukas\_Vlcek](https://forum.search-guard.com/u/Lukas_Vlcek)\ **Post date:** [September 14, 2017, 4:14pm UTC](https://forum.search-guard.com/t/roles-and-permissions-for-custom-rest-endpoints/598/3 "2017-09-14T16:14:48Z")
When Searchguard is installed se well then I can use ‘kirk’ certs to access prometheus exporter REST API. Kirk is an admin. Anonymous access is not possible. So I think SG is in place and acting correctly. But I want to create a new user that can access (read-only) just that new API. How can I configure the new user role then? Thanks, Lukáš Dne 14.9.2017 17:57 “Search Guard” [info@search-guard.com](mailto:info@search-guard.com) napsal(a): > **···** > > > It depends on the other plugin. > > > What is the current behavior you see when installing the prometheus explorer alongside with Search Guard? Do you can access the endpoint without authentication and a result? > > > On Thursday, 14 September 2017 17:11:33 UTC+2, Lukáš Vlček wrote: > > > > > Hi, > > > > is it possible to configure SG to control access to custom REST endpoints? I was not able to find any examples or documentation for this. > > > > > > > > For example, there is ES Prometheus exporter plugin that introduces new REST API [1] to the node. Can I use SearchGuard to control access to such endpoint? > > > > > > > > Can I assume that the sg\_roles.yml will contain config like this?: > > > > > > > > * * * > > > > sg\_role\_prometheus: > > > > cluster: > > > > - cluster:monitor/\_prometheus/metrics > > > > * * * > > > > > > > > [1] [https://github.com/vvanholl/elasticsearch-prometheus-exporter#usage](https://github.com/vvanholl/elasticsearch-prometheus-exporter#usage) > > > > > > > > Regards, > > > > Lukáš > > > – > > > > You received this message because you are subscribed to a topic in the Google Groups “Search Guard Community Forum” group. > > > > To unsubscribe from this topic, visit [https://groups.google.com/d/topic/search-guard/MlNVNkuFZzI/unsubscribe](https://groups.google.com/d/topic/search-guard/MlNVNkuFZzI/unsubscribe). > > > > To unsubscribe from this group and all its topics, send an email to [search-guard+unsubscribe@googlegroups.com](mailto:search-guard+unsubscribe@googlegroups.com). > > > > To post to this group, send email to [search-guard@googlegroups.com](mailto:search-guard@googlegroups.com). > > > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/cd92d2f5-3817-4831-869b-39e38b8dc8ae%40googlegroups.com](https://groups.google.com/d/msgid/search-guard/cd92d2f5-3817-4831-869b-39e38b8dc8ae%40googlegroups.com?utm_medium=email&utm_source=footer). > > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![Lukas\_Vlcek](https://avatars.discourse-cdn.com/v4/letter/l/dfb087/32.png) [@Lukas\_Vlcek](https://forum.search-guard.com/u/Lukas_Vlcek)\ **Post date:** [September 29, 2017, 3:40pm UTC](https://forum.search-guard.com/t/roles-and-permissions-for-custom-rest-endpoints/598/4 "2017-09-29T15:40:27Z")
FYI, started new thread here: [https://groups.google.com/forum/#!topic/search-guard/6iGwoBQ\_W0A](https://groups.google.com/forum/#!topic/search-guard/6iGwoBQ_W0A) > **···** > > On Thu, Sep 14, 2017 at 6:14 PM, Lukáš Vlček [lukas.vlcek@gmail.com](mailto:lukas.vlcek@gmail.com) wrote: > > > When Searchguard is installed se well then I can use ‘kirk’ certs to access prometheus exporter REST API. Kirk is an admin. Anonymous access is not possible. So I think SG is in place and acting correctly. But I want to create a new user that can access (read-only) just that new API. How can I configure the new user role then? > > > Thanks, > > > > Lukáš > > > Dne 14.9.2017 17:57 “Search Guard” [info@search-guard.com](mailto:info@search-guard.com) napsal(a): > > > > > It depends on the other plugin. > > > > What is the current behavior you see when installing the prometheus explorer alongside with Search Guard? Do you can access the endpoint without authentication and a result? > > > > On Thursday, 14 September 2017 17:11:33 UTC+2, Lukáš Vlček wrote: > > > > > > > Hi, > > > > > is it possible to configure SG to control access to custom REST endpoints? I was not able to find any examples or documentation for this. > > > > > > > > > > For example, there is ES Prometheus exporter plugin that introduces new REST API [1] to the node. Can I use SearchGuard to control access to such endpoint? > > > > > > > > > > Can I assume that the sg\_roles.yml will contain config like this?: > > > > > > > > > > * * * > > > > > sg\_role\_prometheus: > > > > > cluster: > > > > > - cluster:monitor/\_prometheus/metrics > > > > > * * * > > > > > > > > > > [1] [https://github.com/vvanholl/elasticsearch-prometheus-exporter#usage](https://github.com/vvanholl/elasticsearch-prometheus-exporter#usage) > > > > > > > > > > Regards, > > > > > Lukáš > > > > – > > > > > > You received this message because you are subscribed to a topic in the Google Groups “Search Guard Community Forum” group. > > > > > > To unsubscribe from this topic, visit [https://groups.google.com/d/topic/search-guard/MlNVNkuFZzI/unsubscribe](https://groups.google.com/d/topic/search-guard/MlNVNkuFZzI/unsubscribe). > > > > > > To unsubscribe from this group and all its topics, send an email to [search-guard+unsubscribe@googlegroups.com](mailto:search-guard+unsubscribe@googlegroups.com). > > > > > > To post to this group, send email to [search-guard@googlegroups.com](mailto:search-guard@googlegroups.com). > > > > > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/cd92d2f5-3817-4831-869b-39e38b8dc8ae%40googlegroups.com](https://groups.google.com/d/msgid/search-guard/cd92d2f5-3817-4831-869b-39e38b8dc8ae%40googlegroups.com?utm_medium=email&utm_source=footer). > > > > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout).