Hello,
I’ve been trying to restrict the indexes that a user can see from Kibana.
It seems like anything that I define in the role is not applied to the user. I can put anything on sg_roles.yml that the result is the same. Currently:
···
=====================================================
On sg_roles.yml:
rolex1:
cluster:
-
“CLUSTER_COMPOSITE_OPS_RO”
-
“MONITOR”
indices:
sg6-auditlog-2018?04?17:
'*':
- "DATA_ACCESS"
- "READ"
- "INDEX"
=====================================================
On sg_roles_mapping.yml
rolex1:
backendroles:
-
kibanauser
-
admin
users:
-
userx1
-
userx2
=====================================================
On sg_internal_users.yml
userx1:
password: “”
hash: “$2y$12$GgjPLywj27v7SHdYd61y6.2PfRdy8pkD/QLEwdkrj6RyuBp/AVyIK”
roles:
- kibanauser
userx2:
password: “”
hash: “$2y$12$GgjPLywj27v7SHdYd61y6.2PfRdy8pkD/QLEwdkrj6RyuBp/AVyIK”
roles:
- kibanauser
=====================================================
Settings successfully updated using sgadmin
Search Guard Admin v6
Will connect to localhost:9300 … done
Elasticsearch Version: 6.2.3
Search Guard Version: 6.2.3-22.0
Connected as CN=kirk,OU=client,O=client,L=Test,C=DE
Contacting elasticsearch cluster ‘elasticsearch’ and wait for YELLOW clusterstate …
Clustername: searchguard_demo
Clusterstate: YELLOW
Number of nodes: 1
Number of data nodes: 1
searchguard index already exists, so we do not need to create one.
Populate config from /usr/share/elasticsearch/plugins/search-guard-6/sgconfig
Will update ‘sg/config’ with …/sgconfig/sg_config.yml
SUCC: Configuration for ‘config’ created or updated
Will update ‘sg/roles’ with …/sgconfig/sg_roles.yml
SUCC: Configuration for ‘roles’ created or updated
Will update ‘sg/rolesmapping’ with …/sgconfig/sg_roles_mapping.yml
SUCC: Configuration for ‘rolesmapping’ created or updated
Will update ‘sg/internalusers’ with …/sgconfig/sg_internal_users.yml
SUCC: Configuration for ‘internalusers’ created or updated
Will update ‘sg/actiongroups’ with …/sgconfig/sg_action_groups.yml
SUCC: Configuration for ‘actiongroups’ created or updated
Done with success
=====================================================
When I log into Kibana with anh of the users, I get the error:
Discover: no permissions for [indices:data/read/search] and User [name=userx1, roles=[kibanauser], requestedTenant=null]
=====================================================
curl https://localhost:9200/_searchguard/_mapping?pretty -u userx1 -k
{
“error” : {
"root_cause" : [
{
"type" : "security_exception",
"reason" : "Unexpected exception indices:admin/mappings/get"
}
],
"type" : "security_exception",
"reason" : "Unexpected exception indices:admin/mappings/get"
},
“status” : 500
}
=====================================================
curl -XGET ‘https://localhost:9200/_searchguard/authinfo’ -u userx1 -k
{“user”:“User [name=userx1, roles=[kibanauser], requestedTenant=null]”,“user_name”:“userx1”,“user_requested_tenant”:null,“remote_address”:“[::1]:46968”,“backend_roles”:[“kibanauser”],“custom_attribute_names”:,“sg_roles”:[“rolex1”,“sg_kibana_user”,“sg_own_index”],"sg_te
nants":{“userx1”:true},“principal”:null,“peer_certificates”:“0”}[root@localhost sgconfig]#
=====================================================
Elasticsearch Version: 6.2.3
Search Guard Version: 6.2.3-22.0
No enterprise modules
Kibana 6.2.3
Can anyone spot something wrong or missing ? Why doesn’t the user apply the permissions on the role when logged in ?
Thank you very much,
Luís Jeremias
Filtering indices in Kibana where the user has no access permissions for is currently in development. We hope we can ship it within this month. Until then, unfortunately, there is no workaround for this.