# Roles not assumed on Kibana with SearchGuard **URL:** \ **Category:** Search Guard\ **Created:** [April 18, 2018, 2:26pm UTC](https://forum.search-guard.com/t/roles-not-assumed-on-kibana-with-searchguard/880 "2018-04-18T14:26:56Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Luis\_Jeremias](https://avatars.discourse-cdn.com/v4/letter/l/cdc98d/32.png) [@Luis\_Jeremias](https://forum.search-guard.com/u/Luis_Jeremias)\ **Post date:** [April 18, 2018, 2:26pm UTC](https://forum.search-guard.com/t/roles-not-assumed-on-kibana-with-searchguard/880/1 "2018-04-18T14:26:56Z")
Hello, I’ve been trying to restrict the indexes that a user can see from Kibana. **It seems like anything that I define in the role is not applied to the user. I can put anything on sg\_roles.yml that the result is the same. Currently:** > **···** > > ===================================================== > > On **sg\_roles.yml:** > > rolex1: > > cluster: > > - “CLUSTER\_COMPOSITE\_OPS\_RO” > > - “MONITOR” > > indices: > > ``` > sg6-auditlog-2018?04?17: > > '*': > > - "DATA_ACCESS" > > - "READ" > > - "INDEX" > > ``` > > ===================================================== > > On **sg\_roles\_mapping.yml** > > rolex1: > > backendroles: > > - kibanauser > > - admin > > users: > > - userx1 > > - userx2 > > ===================================================== > > On **sg\_internal\_users.yml** > > userx1: > > password: “” > > hash: “$2y$12$GgjPLywj27v7SHdYd61y6.2PfRdy8pkD/QLEwdkrj6RyuBp/AVyIK” > > roles: > > ``` > - kibanauser > > ``` > > userx2: > > password: “” > > hash: “$2y$12$GgjPLywj27v7SHdYd61y6.2PfRdy8pkD/QLEwdkrj6RyuBp/AVyIK” > > roles: > > ``` > - kibanauser > > ``` > > ===================================================== > > **Settings successfully updated using sgadmin** > > Search Guard Admin v6 > > Will connect to localhost:9300 … done > > Elasticsearch Version: 6.2.3 > > Search Guard Version: 6.2.3-22.0 > > Connected as CN=kirk,OU=client,O=client,L=Test,C=DE > > Contacting elasticsearch cluster ‘elasticsearch’ and wait for YELLOW clusterstate … > > Clustername: searchguard\_demo > > Clusterstate: YELLOW > > Number of nodes: 1 > > Number of data nodes: 1 > > searchguard index already exists, so we do not need to create one. > > Populate config from /usr/share/elasticsearch/plugins/search-guard-6/sgconfig > > Will update ‘sg/config’ with …/sgconfig/sg\_config.yml > > SUCC: Configuration for ‘config’ created or updated > > Will update ‘sg/roles’ with …/sgconfig/sg\_roles.yml > > SUCC: Configuration for ‘roles’ created or updated > > Will update ‘sg/rolesmapping’ with …/sgconfig/sg\_roles\_mapping.yml > > SUCC: Configuration for ‘rolesmapping’ created or updated > > Will update ‘sg/internalusers’ with …/sgconfig/sg\_internal\_users.yml > > SUCC: Configuration for ‘internalusers’ created or updated > > Will update ‘sg/actiongroups’ with …/sgconfig/sg\_action\_groups.yml > > SUCC: Configuration for ‘actiongroups’ created or updated > > Done with success > > ===================================================== > > When I log into Kibana with anh of the users, I get the error: > > _**Discover: no permissions for [indices:data/read/search] and User [name=userx1, roles=[kibanauser], requestedTenant=null]**_ > > ===================================================== > > **curl [https://localhost:9200/\_searchguard/\_mapping?pretty](https://localhost:9200/_searchguard/_mapping?pretty) -u userx1 -k** > > { > > “error” : { > > ``` > "root_cause" : [ > > { > > "type" : "security_exception", > > "reason" : "Unexpected exception indices:admin/mappings/get" > > } > > ], > > "type" : "security_exception", > > "reason" : "Unexpected exception indices:admin/mappings/get" > > ``` > > }, > > “status” : 500 > > } > > ===================================================== > > **curl -XGET ‘[https://localhost:9200/\_searchguard/authinfo](https://localhost:9200/_searchguard/authinfo)’ -u userx1 -k** > > {“user”:“User [name=userx1, roles=[kibanauser], requestedTenant=null]”,“user\_name”:“userx1”,“user\_requested\_tenant”:null,“remote\_address”:“[::1]:46968”,“backend\_roles”:[“kibanauser”],“custom\_attribute\_names”:,“sg\_roles”:[“rolex1”,“sg\_kibana\_user”,“sg\_own\_index”],"sg\_te > > nants":{“userx1”:true},“principal”:null,“peer\_certificates”:“0”}[root@localhost sgconfig]# > > ===================================================== > > Elasticsearch Version: 6.2.3 > > Search Guard Version: 6.2.3-22.0 > > No enterprise modules > > Kibana 6.2.3 > > Can anyone spot something wrong or missing ? Why doesn’t the user apply the permissions on the role when logged in ? > > Thank you very much, > > Luís Jeremias ---
**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\ **Post date:** [April 19, 2018, 4:26pm UTC](https://forum.search-guard.com/t/roles-not-assumed-on-kibana-with-searchguard/880/2 "2018-04-19T16:26:18Z")
pls post your complete sg\_\*.yml files as well as elasticsearch.yml and kibana.yml. Which version of the kibana plugin do you have installed? > **···** > > > Am 18.04.2018 um 16:26 schrieb Luis Jeremias \: > > > > Hello, > > > > I've been trying to restrict the indexes that a user can see from Kibana. > > It seems like anything that I define in the role is not applied to the user. I can put anything on sg\_roles.yml that the result is the same. Currently: > > > > ===================================================== > > On sg\_roles.yml: > > > > rolex1: > >   cluster: > >   - "CLUSTER\_COMPOSITE\_OPS\_RO" > >   - "MONITOR" > >   indices: > >     sg6-auditlog-2018?04?17: > >       '\*': > >       - "DATA\_ACCESS" > >       - "READ" > >       - "INDEX" > > > > ===================================================== > > On sg\_roles\_mapping.yml > > > > rolex1: > >   backendroles: > >   - kibanauser > >   - admin > >   users: > >   - userx1 > >   - userx2 > > > > ===================================================== > > On sg\_internal\_users.yml > > > > userx1: > >   password: "" > >   hash: "$2y$12$GgjPLywj27v7SHdYd61y6.2PfRdy8pkD/QLEwdkrj6RyuBp/AVyIK" > >   roles: > >     - kibanauser > > > > userx2: > >   password: "" > >   hash: "$2y$12$GgjPLywj27v7SHdYd61y6.2PfRdy8pkD/QLEwdkrj6RyuBp/AVyIK" > >   roles: > >     - kibanauser > > > > ===================================================== > > Settings successfully updated using sgadmin > > > > Search Guard Admin v6 > > Will connect to localhost:9300 ... done > > Elasticsearch Version: 6.2.3 > > Search Guard Version: 6.2.3-22.0 > > Connected as CN=kirk,OU=client,O=client,L=Test,C=DE > > Contacting elasticsearch cluster 'elasticsearch' and wait for YELLOW clusterstate ... > > Clustername: searchguard\_demo > > Clusterstate: YELLOW > > Number of nodes: 1 > > Number of data nodes: 1 > > searchguard index already exists, so we do not need to create one. > > Populate config from /usr/share/elasticsearch/plugins/search-guard-6/sgconfig > > Will update 'sg/config' with ../sgconfig/sg\_config.yml > >    SUCC: Configuration for 'config' created or updated > > Will update 'sg/roles' with ../sgconfig/sg\_roles.yml > >    SUCC: Configuration for 'roles' created or updated > > Will update 'sg/rolesmapping' with ../sgconfig/sg\_roles\_mapping.yml > >    SUCC: Configuration for 'rolesmapping' created or updated > > Will update 'sg/internalusers' with ../sgconfig/sg\_internal\_users.yml > >    SUCC: Configuration for 'internalusers' created or updated > > Will update 'sg/actiongroups' with ../sgconfig/sg\_action\_groups.yml > >    SUCC: Configuration for 'actiongroups' created or updated > > Done with success > > > > ===================================================== > > When I log into Kibana with anh of the users, I get the error: > > Discover: no permissions for [indices:data/read/search] and User [name=userx1, roles=[kibanauser], requestedTenant=null] > > > > ===================================================== > > curl [https://localhost:9200/\_searchguard/\_mapping?pretty](https://localhost:9200/_searchguard/_mapping?pretty) -u userx1 -k > > > > { > >   "error" : { > >     "root\_cause" : [ > >       { > >         "type" : "security\_exception", > >         "reason" : "Unexpected exception indices:admin/mappings/get" > >       } > >     ], > >     "type" : "security\_exception", > >     "reason" : "Unexpected exception indices:admin/mappings/get" > >   }, > >   "status" : 500 > > } > > > > ===================================================== > > curl -XGET '[https://localhost:9200/\_searchguard/authinfo'](https://localhost:9200/_searchguard/authinfo'); -u userx1 -k > > > > {"user":"User [name=userx1, roles=[kibanauser], requestedTenant=null]","user\_name":"userx1","user\_requested\_tenant":null,"remote\_address":"[::1]:46968","backend\_roles":["kibanauser"],"custom\_attribute\_names":,"sg\_roles":["rolex1","sg\_kibana\_user","sg\_own\_index"],"sg\_te > > nants":{"userx1":true},"principal":null,"peer\_certificates":"0"}[root@localhost sgconfig]# > > > > ===================================================== > > Elasticsearch Version: 6.2.3 > > Search Guard Version: 6.2.3-22.0 > > No enterprise modules > > Kibana 6.2.3 > > > > Can anyone spot something wrong or missing ? Why doesn't the user apply the permissions on the role when logged in ? > > > > Thank you very much, > > > > Luís Jeremias > > > > -- > > You received this message because you are subscribed to the Google Groups "Search Guard Community Forum" group. > > To unsubscribe from this group and stop receiving emails from it, send an email to search-guard+unsubscribe@googlegroups.com. > > To post to this group, send email to search-guard@googlegroups.com. > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/eff71ef5-aa72-42b5-8a68-400b634b9995%40googlegroups.com\](https://groups.google.com/d/msgid/search-guard/eff71ef5-aa72-42b5-8a68-400b634b9995%40googlegroups.com%5C). > > For more options, visit [https://groups.google.com/d/optout\](https://groups.google.com/d/optout%5C). ---
**Author:** ![Luis\_Jeremias1](https://avatars.discourse-cdn.com/v4/letter/l/ecccb3/32.png) [@Luis\_Jeremias1](https://forum.search-guard.com/u/Luis_Jeremias1)\ **Post date:** [April 23, 2018, 8:57am UTC](https://forum.search-guard.com/t/roles-not-assumed-on-kibana-with-searchguard/880/3 "2018-04-23T08:57:05Z")
Hi, I attach the complete files. Thanks for your time and help! quarta-feira, 18 de Abril de 2018 às 15:26:56 UTC+1, Luis Jeremias escreveu: [yml\_files.zip](https://forum.search-guard.com/uploads/short-url/xUKTlanDeewrgtcJgFeRpQ0bRWE.zip) (10.3 KB) > **···** > > > Hello, > > > > > > I’ve been trying to restrict the indexes that a user can see from Kibana. > > > **It seems like anything that I define in the role is not applied to the user. I can put anything on sg\_roles.yml that the result is the same. Currently:** > > > > > > > > > ===================================================== > > > On **sg\_roles.yml:** > > > > > > rolex1: > > > cluster: > > > - “CLUSTER\_COMPOSITE\_OPS\_RO” > > > - “MONITOR” > > > indices: > > > ``` > > sg6-auditlog-2018?04?17: > > > > ``` > > > ``` > > '*': > > > > ``` > > > ``` > > - "DATA_ACCESS" > > > > ``` > > > ``` > > - "READ" > > > > ``` > > > ``` > > - "INDEX" > > > > ``` > > > > > > > > > ===================================================== > > > On **sg\_roles\_mapping.yml** > > > > > > rolex1: > > > backendroles: > > > - kibanauser > > > - admin > > > users: > > > - userx1 > > > - userx2 > > > > > > > > > ===================================================== > > > On **sg\_internal\_users.yml** > > > > > > userx1: > > > password: “” > > > hash: “$2y$12$GgjPLywj27v7SHdYd61y6.2PfRdy8pkD/QLEwdkrj6RyuBp/AVyIK” > > > roles: > > > ``` > > - kibanauser > > > > ``` > > > > > > userx2: > > > password: “” > > > hash: “$2y$12$GgjPLywj27v7SHdYd61y6.2PfRdy8pkD/QLEwdkrj6RyuBp/AVyIK” > > > roles: > > > ``` > > - kibanauser > > > > ``` > > > > > > > > > ===================================================== > > > **Settings successfully updated using sgadmin** > > > > > > Search Guard Admin v6 > > > Will connect to localhost:9300 … done > > > Elasticsearch Version: 6.2.3 > > > Search Guard Version: 6.2.3-22.0 > > > Connected as CN=kirk,OU=client,O=client,L=Test,C=DE > > > Contacting elasticsearch cluster ‘elasticsearch’ and wait for YELLOW clusterstate … > > > Clustername: searchguard\_demo > > > Clusterstate: YELLOW > > > Number of nodes: 1 > > > Number of data nodes: 1 > > > searchguard index already exists, so we do not need to create one. > > > Populate config from /usr/share/elasticsearch/plugins/search-guard-6/sgconfig > > > Will update ‘sg/config’ with …/sgconfig/sg\_config.yml > > > SUCC: Configuration for ‘config’ created or updated > > > Will update ‘sg/roles’ with …/sgconfig/sg\_roles.yml > > > SUCC: Configuration for ‘roles’ created or updated > > > Will update ‘sg/rolesmapping’ with …/sgconfig/sg\_roles\_mapping.yml > > > SUCC: Configuration for ‘rolesmapping’ created or updated > > > Will update ‘sg/internalusers’ with …/sgconfig/sg\_internal\_users.yml > > > SUCC: Configuration for ‘internalusers’ created or updated > > > Will update ‘sg/actiongroups’ with …/sgconfig/sg\_action\_groups.yml > > > SUCC: Configuration for ‘actiongroups’ created or updated > > > Done with success > > > > > > > > > > > > ===================================================== > > > When I log into Kibana with anh of the users, I get the error: > > > _**Discover: no permissions for [indices:data/read/search] and User [name=userx1, roles=[kibanauser], requestedTenant=null]**_ > > > > > > > > > ===================================================== > > > **curl [https://localhost:9200/\_searchguard/\_mapping?pretty](https://localhost:9200/_searchguard/_mapping?pretty) -u userx1 -k** > > > > > > { > > > “error” : { > > > ``` > > "root_cause" : [ > > > > ``` > > > ``` > > { > > > > ``` > > > ``` > > "type" : "security_exception", > > > > ``` > > > ``` > > "reason" : "Unexpected exception indices:admin/mappings/get" > > > > ``` > > > ``` > > } > > > > ``` > > > ``` > > ], > > > > ``` > > > ``` > > "type" : "security_exception", > > > > ``` > > > ``` > > "reason" : "Unexpected exception indices:admin/mappings/get" > > > > ``` > > > }, > > > “status” : 500 > > > } > > > > > > > > > ===================================================== > > > **curl -XGET ‘[https://localhost:9200/\_searchguard/authinfo](https://localhost:9200/_searchguard/authinfo)’ -u userx1 -k** > > > > > > {“user”:“User [name=userx1, roles=[kibanauser], requestedTenant=null]”,“user\_name”:“userx1”,“user\_requested\_tenant”:null,“remote\_address”:“[::1]:46968”,“backend\_roles”:[“kibanauser”],“custom\_attribute\_names”:,“sg\_roles”:[“rolex1”,“sg\_kibana\_user”,“sg\_own\_index”],"sg\_te > > > nants":{“userx1”:true},“principal”:null,“peer\_certificates”:“0”}[root@localhost sgconfig]# > > > > > > > > > > > > ===================================================== > > > Elasticsearch Version: 6.2.3 > > > Search Guard Version: 6.2.3-22.0 > > > No enterprise modules > > > Kibana 6.2.3 > > > > > > > > > Can anyone spot something wrong or missing ? Why doesn’t the user apply the permissions on the role when logged in ? > > > > > > Thank you very much, > > > > > > Luís Jeremias ---
**Author:** ![Pablo\_Perza](https://avatars.discourse-cdn.com/v4/letter/p/ba8739/32.png) [@Pablo\_Perza](https://forum.search-guard.com/u/Pablo_Perza)\ **Post date:** [April 23, 2018, 10:55am UTC](https://forum.search-guard.com/t/roles-not-assumed-on-kibana-with-searchguard/880/4 "2018-04-23T10:55:32Z")
Hi, Not sure why you add users userx1 and userx2 to your rolex1 Search Guard role in sg\_roles\_mappings.yml. I think it is not necessary as you are including the kibanauser backend role and assigning that backend role to your users. Anyway, user1 and user2 have the kibanauser backend role so they should have the permissions of the sg\_kibana\_user + rolex1 Search Guard roles, that is: sg\_kibana\_user: readonly: true cluster: - MONITOR - CLUSTER\_COMPOSITE\_OPS\_RO indices: ‘?kibana’: ‘\*’: - MANAGE - INDEX - READ - DELETE ‘\*’: ‘\*’: - indices:data/read/field\_caps\* rolex1: cluster: - “CLUSTER\_COMPOSITE\_OPS\_RO” - “MONITOR” - “indices:data/read/search\*” indices: ``` sg6-auditlog-2018?04?17: '*': - "DATA_ACCESS" - "READ" - "INDEX" ``` `` I think that is not enough permissions to access \_searchguard/\_mapping > **···** > > El miércoles, 18 de abril de 2018, 16:26:56 (UTC+2), Luis Jeremias escribió: > > > Hello, > > > > > > I’ve been trying to restrict the indexes that a user can see from Kibana. > > > **It seems like anything that I define in the role is not applied to the user. I can put anything on sg\_roles.yml that the result is the same. Currently:** > > > > > > > > > ===================================================== > > > On **sg\_roles.yml:** > > > > > > rolex1: > > > cluster: > > > - “CLUSTER\_COMPOSITE\_OPS\_RO” > > > - “MONITOR” > > > indices: > > > ``` > > sg6-auditlog-2018?04?17: > > > > ``` > > > ``` > > '*': > > > > ``` > > > ``` > > - "DATA_ACCESS" > > > > ``` > > > ``` > > - "READ" > > > > ``` > > > ``` > > - "INDEX" > > > > ``` > > > > > > > > > ===================================================== > > > On **sg\_roles\_mapping.yml** > > > > > > rolex1: > > > backendroles: > > > - kibanauser > > > - admin > > > users: > > > - userx1 > > > - userx2 > > > > > > > > > ===================================================== > > > On **sg\_internal\_users.yml** > > > > > > userx1: > > > password: “” > > > hash: “$2y$12$GgjPLywj27v7SHdYd61y6.2PfRdy8pkD/QLEwdkrj6RyuBp/AVyIK” > > > roles: > > > ``` > > - kibanauser > > > > ``` > > > > > > userx2: > > > password: “” > > > hash: “$2y$12$GgjPLywj27v7SHdYd61y6.2PfRdy8pkD/QLEwdkrj6RyuBp/AVyIK” > > > roles: > > > ``` > > - kibanauser > > > > ``` > > > > > > > > > ===================================================== > > > **Settings successfully updated using sgadmin** > > > > > > Search Guard Admin v6 > > > Will connect to localhost:9300 … done > > > Elasticsearch Version: 6.2.3 > > > Search Guard Version: 6.2.3-22.0 > > > Connected as CN=kirk,OU=client,O=client,L=Test,C=DE > > > Contacting elasticsearch cluster ‘elasticsearch’ and wait for YELLOW clusterstate … > > > Clustername: searchguard\_demo > > > Clusterstate: YELLOW > > > Number of nodes: 1 > > > Number of data nodes: 1 > > > searchguard index already exists, so we do not need to create one. > > > Populate config from /usr/share/elasticsearch/plugins/search-guard-6/sgconfig > > > Will update ‘sg/config’ with …/sgconfig/sg\_config.yml > > > SUCC: Configuration for ‘config’ created or updated > > > Will update ‘sg/roles’ with …/sgconfig/sg\_roles.yml > > > SUCC: Configuration for ‘roles’ created or updated > > > Will update ‘sg/rolesmapping’ with …/sgconfig/sg\_roles\_mapping.yml > > > SUCC: Configuration for ‘rolesmapping’ created or updated > > > Will update ‘sg/internalusers’ with …/sgconfig/sg\_internal\_users.yml > > > SUCC: Configuration for ‘internalusers’ created or updated > > > Will update ‘sg/actiongroups’ with …/sgconfig/sg\_action\_groups.yml > > > SUCC: Configuration for ‘actiongroups’ created or updated > > > Done with success > > > > > > > > > > > > ===================================================== > > > When I log into Kibana with anh of the users, I get the error: > > > _**Discover: no permissions for [indices:data/read/search] and User [name=userx1, roles=[kibanauser], requestedTenant=null]**_ > > > > > > > > > ===================================================== > > > **curl [https://localhost:9200/\_searchguard/\_mapping?pretty](https://localhost:9200/_searchguard/_mapping?pretty) -u userx1 -k** > > > > > > { > > > “error” : { > > > ``` > > "root_cause" : [ > > > > ``` > > > ``` > > { > > > > ``` > > > ``` > > "type" : "security_exception", > > > > ``` > > > ``` > > "reason" : "Unexpected exception indices:admin/mappings/get" > > > > ``` > > > ``` > > } > > > > ``` > > > ``` > > ], > > > > ``` > > > ``` > > "type" : "security_exception", > > > > ``` > > > ``` > > "reason" : "Unexpected exception indices:admin/mappings/get" > > > > ``` > > > }, > > > “status” : 500 > > > } > > > > > > > > > ===================================================== > > > **curl -XGET ‘[https://localhost:9200/\_searchguard/authinfo](https://localhost:9200/_searchguard/authinfo)’ -u userx1 -k** > > > > > > {“user”:“User [name=userx1, roles=[kibanauser], requestedTenant=null]”,“user\_name”:“userx1”,“user\_requested\_tenant”:null,“remote\_address”:“[::1]:46968”,“backend\_roles”:[“kibanauser”],“custom\_attribute\_names”:,“sg\_roles”:[“rolex1”,“sg\_kibana\_user”,“sg\_own\_index”],"sg\_te > > > nants":{“userx1”:true},“principal”:null,“peer\_certificates”:“0”}[root@localhost sgconfig]# > > > > > > > > > > > > ===================================================== > > > Elasticsearch Version: 6.2.3 > > > Search Guard Version: 6.2.3-22.0 > > > No enterprise modules > > > Kibana 6.2.3 > > > > > > > > > Can anyone spot something wrong or missing ? Why doesn’t the user apply the permissions on the role when logged in ? > > > > > > Thank you very much, > > > > > > Luís Jeremias ---
**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\ **Post date:** [April 23, 2018, 6:53pm UTC](https://forum.search-guard.com/t/roles-not-assumed-on-kibana-with-searchguard/880/5 "2018-04-23T18:53:30Z")
First question is - do you start with an empty .kibana index, or do you already have some contents in it? If you have already contents in it, could you please post it here? You write: "When I log into Kibana with anh of the users, I get the error: _**Discover: no permissions for [indices:data/read/search] and User [name=userx1, roles=[kibanauser], requestedTenant=null]"**_ When this error occurs, you should also see a corresponding message in the Elasticsearch log files, with some more information in which index the security exception happened. Can you please post this log entry? Should look something like: [2018-04-23T11:50:41,509][INFO][c.f.s.c.PrivilegesEvaluator] No index-level perm match for User [name=userx1, roles=[kibanauser], requestedTenant=null] [IndexType [index=sg6-auditlog-2018.04.23, type=\*]] [Action [[indices:data/read/search]]] [RolesChecked [rolex1, sg\_kibana\_user, sg\_own\_index]] [2018-04-23T11:50:41,509][INFO][c.f.s.c.PrivilegesEvaluator] No permissions for {sg\_own\_index=[IndexType [index=sg6-auditlog-2018.04.23, type=_]], rolex1=[IndexType [index=sg6-auditlog-2018.04.23, type=_]], sg\_kibana\_user=[IndexType [index=sg6-auditlog-2018.04.23, type=\*]]} `` I have tested it here with your configuration, and everything works fine. I just had to change the date in the index name in the role definition to today’s date: rolex1: cluster: - “CLUSTER\_COMPOSITE\_OPS\_RO” - “MONITOR” indices: sg6-auditlog-2018?04?24: ‘\*’: - “DATA\_ACCESS” - “READ” - “INDEX” `` Then I’m confused about this curl: **curl [https://localhost:9200/\_searchguard/\_mapping?pretty](https://localhost:9200/_searchguard/_mapping?pretty)** “\_searchguard” is not an index, but the prefix for the SG endpoints like “authinfo”. What did you try to achieve by requesting the \_mapping here? I’m also surprised that when doing this curl you get back a security\_exception. You should rather see an invalid\_index\_name\_exception. Did you by chance create an index called \_searchguard? > **···** > > On Monday, April 23, 2018 at 3:55:32 AM UTC-7, Pablo Perza wrote: > > > Hi, > > > Not sure why you add users userx1 and userx2 to your rolex1 Search Guard role in sg\_roles\_mappings.yml. I think it is not necessary as you are including the kibanauser backend role and assigning that backend role to your users. Anyway, user1 and user2 have the kibanauser backend role so they should have the permissions of the sg\_kibana\_user + rolex1 Search Guard roles, that is: > > > > > > sg\_kibana\_user: > > > readonly: true > > > cluster: > > > - MONITOR > > > - CLUSTER\_COMPOSITE\_OPS\_RO > > > indices: > > > ‘?kibana’: > > > ‘\*’: > > > - MANAGE > > > - INDEX > > > - READ > > > - DELETE > > > ‘\*’: > > > ‘\*’: > > > - indices:data/read/field\_caps\* > > > rolex1: > > > cluster: > > > - “CLUSTER\_COMPOSITE\_OPS\_RO” > > > - “MONITOR” > > > - “indices:data/read/search\*” > > > indices: > > > ``` > > sg6-auditlog-2018?04?17: > > > > ``` > > > ``` > > '*': > > > > ``` > > > ``` > > - "DATA_ACCESS" > > > > ``` > > > ``` > > - "READ" > > > > ``` > > > ``` > > - "INDEX" > > > > ``` > > > `` > > > I think that is not enough permissions to access \_searchguard/\_mapping > > > > > > > > > El miércoles, 18 de abril de 2018, 16:26:56 (UTC+2), Luis Jeremias escribió: > > > > > Hello, > > > > > > > > I’ve been trying to restrict the indexes that a user can see from Kibana. > > > > **It seems like anything that I define in the role is not applied to the user. I can put anything on sg\_roles.yml that the result is the same. Currently:** > > > > > > > > > > > > ===================================================== > > > > On **sg\_roles.yml:** > > > > > > > > rolex1: > > > > cluster: > > > > - “CLUSTER\_COMPOSITE\_OPS\_RO” > > > > - “MONITOR” > > > > indices: > > > > ``` > > > sg6-auditlog-2018?04?17: > > > > > > ``` > > > > ``` > > > '*': > > > > > > ``` > > > > ``` > > > - "DATA_ACCESS" > > > > > > ``` > > > > ``` > > > - "READ" > > > > > > ``` > > > > ``` > > > - "INDEX" > > > > > > ``` > > > > > > > > > > > > ===================================================== > > > > On **sg\_roles\_mapping.yml** > > > > > > > > rolex1: > > > > backendroles: > > > > - kibanauser > > > > - admin > > > > users: > > > > - userx1 > > > > - userx2 > > > > > > > > > > > > ===================================================== > > > > On **sg\_internal\_users.yml** > > > > > > > > userx1: > > > > password: “” > > > > hash: “$2y$12$GgjPLywj27v7SHdYd61y6.2PfRdy8pkD/QLEwdkrj6RyuBp/AVyIK” > > > > roles: > > > > ``` > > > - kibanauser > > > > > > ``` > > > > > > > > userx2: > > > > password: “” > > > > hash: “$2y$12$GgjPLywj27v7SHdYd61y6.2PfRdy8pkD/QLEwdkrj6RyuBp/AVyIK” > > > > roles: > > > > ``` > > > - kibanauser > > > > > > ``` > > > > > > > > > > > > ===================================================== > > > > **Settings successfully updated using sgadmin** > > > > > > > > Search Guard Admin v6 > > > > Will connect to localhost:9300 … done > > > > Elasticsearch Version: 6.2.3 > > > > Search Guard Version: 6.2.3-22.0 > > > > Connected as CN=kirk,OU=client,O=client,L=Test,C=DE > > > > Contacting elasticsearch cluster ‘elasticsearch’ and wait for YELLOW clusterstate … > > > > Clustername: searchguard\_demo > > > > Clusterstate: YELLOW > > > > Number of nodes: 1 > > > > Number of data nodes: 1 > > > > searchguard index already exists, so we do not need to create one. > > > > Populate config from /usr/share/elasticsearch/plugins/search-guard-6/sgconfig > > > > Will update ‘sg/config’ with …/sgconfig/sg\_config.yml > > > > SUCC: Configuration for ‘config’ created or updated > > > > Will update ‘sg/roles’ with …/sgconfig/sg\_roles.yml > > > > SUCC: Configuration for ‘roles’ created or updated > > > > Will update ‘sg/rolesmapping’ with …/sgconfig/sg\_roles\_mapping.yml > > > > SUCC: Configuration for ‘rolesmapping’ created or updated > > > > Will update ‘sg/internalusers’ with …/sgconfig/sg\_internal\_users.yml > > > > SUCC: Configuration for ‘internalusers’ created or updated > > > > Will update ‘sg/actiongroups’ with …/sgconfig/sg\_action\_groups.yml > > > > SUCC: Configuration for ‘actiongroups’ created or updated > > > > Done with success > > > > > > > > > > > > > > > > ===================================================== > > > > When I log into Kibana with anh of the users, I get the error: > > > > _**Discover: no permissions for [indices:data/read/search] and User [name=userx1, roles=[kibanauser], requestedTenant=null]**_ > > > > > > > > > > > > ===================================================== > > > > **curl [https://localhost:9200/\_searchguard/\_mapping?pretty](https://localhost:9200/_searchguard/_mapping?pretty) -u userx1 -k** > > > > > > > > { > > > > “error” : { > > > > ``` > > > "root_cause" : [ > > > > > > ``` > > > > ``` > > > { > > > > > > ``` > > > > ``` > > > "type" : "security_exception", > > > > > > ``` > > > > ``` > > > "reason" : "Unexpected exception indices:admin/mappings/get" > > > > > > ``` > > > > ``` > > > } > > > > > > ``` > > > > ``` > > > ], > > > > > > ``` > > > > ``` > > > "type" : "security_exception", > > > > > > ``` > > > > ``` > > > "reason" : "Unexpected exception indices:admin/mappings/get" > > > > > > ``` > > > > }, > > > > “status” : 500 > > > > } > > > > > > > > > > > > ===================================================== > > > > **curl -XGET ‘[https://localhost:9200/\_searchguard/authinfo](https://localhost:9200/_searchguard/authinfo)’ -u userx1 -k** > > > > > > > > {“user”:“User [name=userx1, roles=[kibanauser], requestedTenant=null]”,“user\_name”:“userx1”,“user\_requested\_tenant”:null,“remote\_address”:“[::1]:46968”,“backend\_roles”:[“kibanauser”],“custom\_attribute\_names”:,“sg\_roles”:[“rolex1”,“sg\_kibana\_user”,“sg\_own\_index”],"sg\_te > > > > nants":{“userx1”:true},“principal”:null,“peer\_certificates”:“0”}[root@localhost sgconfig]# > > > > > > > > > > > > > > > > ===================================================== > > > > Elasticsearch Version: 6.2.3 > > > > Search Guard Version: 6.2.3-22.0 > > > > No enterprise modules > > > > Kibana 6.2.3 > > > > > > > > > > > > Can anyone spot something wrong or missing ? Why doesn’t the user apply the permissions on the role when logged in ? > > > > > > > > Thank you very much, > > > > > > > > Luís Jeremias ---
**Author:** ![Luis\_Jeremias](https://avatars.discourse-cdn.com/v4/letter/l/cdc98d/32.png) [@Luis\_Jeremias](https://forum.search-guard.com/u/Luis_Jeremias)\ **Post date:** [April 30, 2018, 4:46pm UTC](https://forum.search-guard.com/t/roles-not-assumed-on-kibana-with-searchguard/880/6 "2018-04-30T16:46:17Z")
Hi Jochen, Thank you for your answer, and forgive my delay in replying to you. I attach the contents of the .kibana index. The confusing curl is something that I came across in the web, but probably took it out of context. I never created a “\_searchguard” index. Right now, I can see only the " sg6-auditlog-2018.04.17" data, which is what I wanted. But all the other indexes are listed, which causes the error on Kibana as soon as I click the “Discover” tab. Discover: no permissions for [indices:data/read/search] and User [name=userx1, roles=[kibanauser], requestedTenant=null] Is there any way to filter the index patterns available, according to the logged user ? [kibana\_contents.json](https://forum.search-guard.com/uploads/short-url/sV8OTbhy5Rp9wj1QZCWowgI3md3.json) (45.6 KB) > **···** > > On Monday, April 23, 2018 at 7:53:31 PM UTC+1, Jochen Kressin wrote: > > > First question is - do you start with an empty .kibana index, or do you already have some contents in it? If you have already contents in it, could you please post it here? > > > You write: > > > "When I log into Kibana with anh of the users, I get the error: > > > _**Discover: no permissions for [indices:data/read/search] and User [name=userx1, roles=[kibanauser], requestedTenant=null]"**_ > > > When this error occurs, you should also see a corresponding message in the Elasticsearch log files, with some more information in which index the security exception happened. Can you please post this log entry? Should look something like: > > > > > > [2018-04-23T11:50:41,509][INFO][c.f.s.c.PrivilegesEvaluator] No index-level perm match for User [name=userx1, roles=[kibanauser], requestedTenant=null] [IndexType [index=sg6-auditlog-2018.04.23, type=\*]] [Action [[indices:data/read/search]]] [RolesChecked [rolex1, sg\_kibana\_user, sg\_own\_index]] > > > [2018-04-23T11:50:41,509][INFO][c.f.s.c.PrivilegesEvaluator] No permissions for {sg\_own\_index=[IndexType [index=sg6-auditlog-2018.04.23, type=_]], rolex1=[IndexType [index=sg6-auditlog-2018.04.23, type=_]], sg\_kibana\_user=[IndexType [index=sg6-auditlog-2018.04.23, type=\*]]} > > > > > > `` > > > > > > I have tested it here with your configuration, and everything works fine. I just had to change the date in the index name in the role definition to today’s date: > > > > > > rolex1: > > > cluster: > > > - “CLUSTER\_COMPOSITE\_OPS\_RO” > > > - “MONITOR” > > > indices: > > > sg6-auditlog-2018?04?24: > > > ‘\*’: > > > - “DATA\_ACCESS” > > > - “READ” > > > - “INDEX” > > > `` > > > > > > > > > > > > > > > Then I’m confused about this curl: > > > > > > **curl [https://localhost:9200/\_searchguard/\_mapping?pretty](https://localhost:9200/_searchguard/_mapping?pretty)** > > > > > > “\_searchguard” is not an index, but the prefix for the SG endpoints like “authinfo”. What did you try to achieve by requesting the \_mapping here? > > > > > > I’m also surprised that when doing this curl you get back a security\_exception. You should rather see an invalid\_index\_name\_exception. Did you by chance create an index called \_searchguard? > > > > > > > > > > > > On Monday, April 23, 2018 at 3:55:32 AM UTC-7, Pablo Perza wrote: > > > > > Hi, > > > > Not sure why you add users userx1 and userx2 to your rolex1 Search Guard role in sg\_roles\_mappings.yml. I think it is not necessary as you are including the kibanauser backend role and assigning that backend role to your users. Anyway, user1 and user2 have the kibanauser backend role so they should have the permissions of the sg\_kibana\_user + rolex1 Search Guard roles, that is: > > > > > > > > sg\_kibana\_user: > > > > readonly: true > > > > cluster: > > > > - MONITOR > > > > - CLUSTER\_COMPOSITE\_OPS\_RO > > > > indices: > > > > ‘?kibana’: > > > > ‘\*’: > > > > - MANAGE > > > > - INDEX > > > > - READ > > > > - DELETE > > > > ‘\*’: > > > > ‘\*’: > > > > - indices:data/read/field\_caps\* > > > > rolex1: > > > > cluster: > > > > - “CLUSTER\_COMPOSITE\_OPS\_RO” > > > > - “MONITOR” > > > > - “indices:data/read/search\*” > > > > indices: > > > > ``` > > > sg6-auditlog-2018?04?17: > > > > > > ``` > > > > ``` > > > '*': > > > > > > ``` > > > > ``` > > > - "DATA_ACCESS" > > > > > > ``` > > > > ``` > > > - "READ" > > > > > > ``` > > > > ``` > > > - "INDEX" > > > > > > ``` > > > > `` > > > > I think that is not enough permissions to access \_searchguard/\_mapping > > > > > > > > > > > > El miércoles, 18 de abril de 2018, 16:26:56 (UTC+2), Luis Jeremias escribió: > > > > > > > Hello, > > > > > > > > > > I’ve been trying to restrict the indexes that a user can see from Kibana. > > > > > **It seems like anything that I define in the role is not applied to the user. I can put anything on sg\_roles.yml that the result is the same. Currently:** > > > > > > > > > > > > > > > ===================================================== > > > > > On **sg\_roles.yml:** > > > > > > > > > > rolex1: > > > > > cluster: > > > > > - “CLUSTER\_COMPOSITE\_OPS\_RO” > > > > > - “MONITOR” > > > > > indices: > > > > > ``` > > > > sg6-auditlog-2018?04?17: > > > > > > > > ``` > > > > > ``` > > > > '*': > > > > > > > > ``` > > > > > ``` > > > > - "DATA_ACCESS" > > > > > > > > ``` > > > > > ``` > > > > - "READ" > > > > > > > > ``` > > > > > ``` > > > > - "INDEX" > > > > > > > > ``` > > > > > > > > > > > > > > > ===================================================== > > > > > On **sg\_roles\_mapping.yml** > > > > > > > > > > rolex1: > > > > > backendroles: > > > > > - kibanauser > > > > > - admin > > > > > users: > > > > > - userx1 > > > > > - userx2 > > > > > > > > > > > > > > > ===================================================== > > > > > On **sg\_internal\_users.yml** > > > > > > > > > > userx1: > > > > > password: “” > > > > > hash: “$2y$12$GgjPLywj27v7SHdYd61y6.2PfRdy8pkD/QLEwdkrj6RyuBp/AVyIK” > > > > > roles: > > > > > ``` > > > > - kibanauser > > > > > > > > ``` > > > > > > > > > > userx2: > > > > > password: “” > > > > > hash: “$2y$12$GgjPLywj27v7SHdYd61y6.2PfRdy8pkD/QLEwdkrj6RyuBp/AVyIK” > > > > > roles: > > > > > ``` > > > > - kibanauser > > > > > > > > ``` > > > > > > > > > > > > > > > ===================================================== > > > > > **Settings successfully updated using sgadmin** > > > > > > > > > > Search Guard Admin v6 > > > > > Will connect to localhost:9300 … done > > > > > Elasticsearch Version: 6.2.3 > > > > > Search Guard Version: 6.2.3-22.0 > > > > > Connected as CN=kirk,OU=client,O=client,L=Test,C=DE > > > > > Contacting elasticsearch cluster ‘elasticsearch’ and wait for YELLOW clusterstate … > > > > > Clustername: searchguard\_demo > > > > > Clusterstate: YELLOW > > > > > Number of nodes: 1 > > > > > Number of data nodes: 1 > > > > > searchguard index already exists, so we do not need to create one. > > > > > Populate config from /usr/share/elasticsearch/plugins/search-guard-6/sgconfig > > > > > Will update ‘sg/config’ with …/sgconfig/sg\_config.yml > > > > > SUCC: Configuration for ‘config’ created or updated > > > > > Will update ‘sg/roles’ with …/sgconfig/sg\_roles.yml > > > > > SUCC: Configuration for ‘roles’ created or updated > > > > > Will update ‘sg/rolesmapping’ with …/sgconfig/sg\_roles\_mapping.yml > > > > > SUCC: Configuration for ‘rolesmapping’ created or updated > > > > > Will update ‘sg/internalusers’ with …/sgconfig/sg\_internal\_users.yml > > > > > SUCC: Configuration for ‘internalusers’ created or updated > > > > > Will update ‘sg/actiongroups’ with …/sgconfig/sg\_action\_groups.yml > > > > > SUCC: Configuration for ‘actiongroups’ created or updated > > > > > Done with success > > > > > > > > > > > > > > > > > > > > ===================================================== > > > > > When I log into Kibana with anh of the users, I get the error: > > > > > _**Discover: no permissions for [indices:data/read/search] and User [name=userx1, roles=[kibanauser], requestedTenant=null]**_ > > > > > > > > > > > > > > > ===================================================== > > > > > **curl [https://localhost:9200/\_searchguard/\_mapping?pretty](https://localhost:9200/_searchguard/_mapping?pretty) -u userx1 -k** > > > > > > > > > > { > > > > > “error” : { > > > > > ``` > > > > "root_cause" : [ > > > > > > > > ``` > > > > > ``` > > > > { > > > > > > > > ``` > > > > > ``` > > > > "type" : "security_exception", > > > > > > > > ``` > > > > > ``` > > > > "reason" : "Unexpected exception indices:admin/mappings/get" > > > > > > > > ``` > > > > > ``` > > > > } > > > > > > > > ``` > > > > > ``` > > > > ], > > > > > > > > ``` > > > > > ``` > > > > "type" : "security_exception", > > > > > > > > ``` > > > > > ``` > > > > "reason" : "Unexpected exception indices:admin/mappings/get" > > > > > > > > ``` > > > > > }, > > > > > “status” : 500 > > > > > } > > > > > > > > > > > > > > > ===================================================== > > > > > **curl -XGET ‘[https://localhost:9200/\_searchguard/authinfo](https://localhost:9200/_searchguard/authinfo)’ -u userx1 -k** > > > > > > > > > > {“user”:“User [name=userx1, roles=[kibanauser], requestedTenant=null]”,“user\_name”:“userx1”,“user\_requested\_tenant”:null,“remote\_address”:“[::1]:46968”,“backend\_roles”:[“kibanauser”],“custom\_attribute\_names”:,“sg\_roles”:[“rolex1”,“sg\_kibana\_user”,“sg\_own\_index”],"sg\_te > > > > > nants":{“userx1”:true},“principal”:null,“peer\_certificates”:“0”}[root@localhost sgconfig]# > > > > > > > > > > > > > > > > > > > > ===================================================== > > > > > Elasticsearch Version: 6.2.3 > > > > > Search Guard Version: 6.2.3-22.0 > > > > > No enterprise modules > > > > > Kibana 6.2.3 > > > > > > > > > > > > > > > Can anyone spot something wrong or missing ? Why doesn’t the user apply the permissions on the role when logged in ? > > > > > > > > > > Thank you very much, > > > > > > > > > > Luís Jeremias ---
**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\ **Post date:** [May 3, 2018, 2:49pm UTC](https://forum.search-guard.com/t/roles-not-assumed-on-kibana-with-searchguard/880/7 "2018-05-03T14:49:13Z")
Ah, now I understand what you mean 🙂 Filtering indices in Kibana where the user has no access permissions for is currently in development. We hope we can ship it within this month. Until then, unfortunately, there is no workaround for this. > **···** > > On Monday, April 30, 2018 at 6:46:17 PM UTC+2, Luis Jeremias wrote: > > > Hi Jochen, > > > Thank you for your answer, and forgive my delay in replying to you. > > > > > > I attach the contents of the .kibana index. > > > > > > The confusing curl is something that I came across in the web, but probably took it out of context. I never created a “\_searchguard” index. > > > > > > Right now, I can see only the " sg6-auditlog-2018.04.17" data, which is what I wanted. > > > > > > But all the other indexes are listed, which causes the error on Kibana as soon as I click the “Discover” tab. > > > Discover: no permissions for [indices:data/read/search] and User [name=userx1, roles=[kibanauser], requestedTenant=null] > > > > > > Is there any way to filter the index patterns available, according to the logged user ? > > > > > > On Monday, April 23, 2018 at 7:53:31 PM UTC+1, Jochen Kressin wrote: > > > > > First question is - do you start with an empty .kibana index, or do you already have some contents in it? If you have already contents in it, could you please post it here? > > > > You write: > > > > "When I log into Kibana with anh of the users, I get the error: > > > > _**Discover: no permissions for [indices:data/read/search] and User [name=userx1, roles=[kibanauser], requestedTenant=null]"**_ > > > > When this error occurs, you should also see a corresponding message in the Elasticsearch log files, with some more information in which index the security exception happened. Can you please post this log entry? Should look something like: > > > > > > > > [2018-04-23T11:50:41,509][INFO][c.f.s.c.PrivilegesEvaluator] No index-level perm match for User [name=userx1, roles=[kibanauser], requestedTenant=null] [IndexType [index=sg6-auditlog-2018.04.23, type=\*]] [Action [[indices:data/read/search]]] [RolesChecked [rolex1, sg\_kibana\_user, sg\_own\_index]] > > > > [2018-04-23T11:50:41,509][INFO][c.f.s.c.PrivilegesEvaluator] No permissions for {sg\_own\_index=[IndexType [index=sg6-auditlog-2018.04.23, type=_]], rolex1=[IndexType [index=sg6-auditlog-2018.04.23, type=_]], sg\_kibana\_user=[IndexType [index=sg6-auditlog-2018.04.23, type=\*]]} > > > > > > > > `` > > > > > > > > I have tested it here with your configuration, and everything works fine. I just had to change the date in the index name in the role definition to today’s date: > > > > > > > > rolex1: > > > > cluster: > > > > - “CLUSTER\_COMPOSITE\_OPS\_RO” > > > > - “MONITOR” > > > > indices: > > > > sg6-auditlog-2018?04?24: > > > > ‘\*’: > > > > - “DATA\_ACCESS” > > > > - “READ” > > > > - “INDEX” > > > > `` > > > > > > > > > > > > > > > > > > > > Then I’m confused about this curl: > > > > > > > > **curl [https://localhost:9200/\_searchguard/\_mapping?pretty](https://localhost:9200/_searchguard/_mapping?pretty)** > > > > > > > > “\_searchguard” is not an index, but the prefix for the SG endpoints like “authinfo”. What did you try to achieve by requesting the \_mapping here? > > > > > > > > I’m also surprised that when doing this curl you get back a security\_exception. You should rather see an invalid\_index\_name\_exception. Did you by chance create an index called \_searchguard? > > > > > > > > > > > > > > > > On Monday, April 23, 2018 at 3:55:32 AM UTC-7, Pablo Perza wrote: > > > > > > > Hi, > > > > > Not sure why you add users userx1 and userx2 to your rolex1 Search Guard role in sg\_roles\_mappings.yml. I think it is not necessary as you are including the kibanauser backend role and assigning that backend role to your users. Anyway, user1 and user2 have the kibanauser backend role so they should have the permissions of the sg\_kibana\_user + rolex1 Search Guard roles, that is: > > > > > > > > > > sg\_kibana\_user: > > > > > readonly: true > > > > > cluster: > > > > > - MONITOR > > > > > - CLUSTER\_COMPOSITE\_OPS\_RO > > > > > indices: > > > > > ‘?kibana’: > > > > > ‘\*’: > > > > > - MANAGE > > > > > - INDEX > > > > > - READ > > > > > - DELETE > > > > > ‘\*’: > > > > > ‘\*’: > > > > > - indices:data/read/field\_caps\* > > > > > rolex1: > > > > > cluster: > > > > > - “CLUSTER\_COMPOSITE\_OPS\_RO” > > > > > - “MONITOR” > > > > > - “indices:data/read/search\*” > > > > > indices: > > > > > ``` > > > > sg6-auditlog-2018?04?17: > > > > > > > > ``` > > > > > ``` > > > > '*': > > > > > > > > ``` > > > > > ``` > > > > - "DATA_ACCESS" > > > > > > > > ``` > > > > > ``` > > > > - "READ" > > > > > > > > ``` > > > > > ``` > > > > - "INDEX" > > > > > > > > ``` > > > > > `` > > > > > I think that is not enough permissions to access \_searchguard/\_mapping > > > > > > > > > > > > > > > El miércoles, 18 de abril de 2018, 16:26:56 (UTC+2), Luis Jeremias escribió: > > > > > > > > > Hello, > > > > > > > > > > > > I’ve been trying to restrict the indexes that a user can see from Kibana. > > > > > > **It seems like anything that I define in the role is not applied to the user. I can put anything on sg\_roles.yml that the result is the same. Currently:** > > > > > > > > > > > > > > > > > > ===================================================== > > > > > > On **sg\_roles.yml:** > > > > > > > > > > > > rolex1: > > > > > > cluster: > > > > > > - “CLUSTER\_COMPOSITE\_OPS\_RO” > > > > > > - “MONITOR” > > > > > > indices: > > > > > > ``` > > > > > sg6-auditlog-2018?04?17: > > > > > > > > > > ``` > > > > > > ``` > > > > > '*': > > > > > > > > > > ``` > > > > > > ``` > > > > > - "DATA_ACCESS" > > > > > > > > > > ``` > > > > > > ``` > > > > > - "READ" > > > > > > > > > > ``` > > > > > > ``` > > > > > - "INDEX" > > > > > > > > > > ``` > > > > > > > > > > > > > > > > > > ===================================================== > > > > > > On **sg\_roles\_mapping.yml** > > > > > > > > > > > > rolex1: > > > > > > backendroles: > > > > > > - kibanauser > > > > > > - admin > > > > > > users: > > > > > > - userx1 > > > > > > - userx2 > > > > > > > > > > > > > > > > > > ===================================================== > > > > > > On **sg\_internal\_users.yml** > > > > > > > > > > > > userx1: > > > > > > password: “” > > > > > > hash: “$2y$12$GgjPLywj27v7SHdYd61y6.2PfRdy8pkD/QLEwdkrj6RyuBp/AVyIK” > > > > > > roles: > > > > > > ``` > > > > > - kibanauser > > > > > > > > > > ``` > > > > > > > > > > > > userx2: > > > > > > password: “” > > > > > > hash: “$2y$12$GgjPLywj27v7SHdYd61y6.2PfRdy8pkD/QLEwdkrj6RyuBp/AVyIK” > > > > > > roles: > > > > > > ``` > > > > > - kibanauser > > > > > > > > > > ``` > > > > > > > > > > > > > > > > > > ===================================================== > > > > > > **Settings successfully updated using sgadmin** > > > > > > > > > > > > Search Guard Admin v6 > > > > > > Will connect to localhost:9300 … done > > > > > > Elasticsearch Version: 6.2.3 > > > > > > Search Guard Version: 6.2.3-22.0 > > > > > > Connected as CN=kirk,OU=client,O=client,L=Test,C=DE > > > > > > Contacting elasticsearch cluster ‘elasticsearch’ and wait for YELLOW clusterstate … > > > > > > Clustername: searchguard\_demo > > > > > > Clusterstate: YELLOW > > > > > > Number of nodes: 1 > > > > > > Number of data nodes: 1 > > > > > > searchguard index already exists, so we do not need to create one. > > > > > > Populate config from /usr/share/elasticsearch/plugins/search-guard-6/sgconfig > > > > > > Will update ‘sg/config’ with …/sgconfig/sg\_config.yml > > > > > > SUCC: Configuration for ‘config’ created or updated > > > > > > Will update ‘sg/roles’ with …/sgconfig/sg\_roles.yml > > > > > > SUCC: Configuration for ‘roles’ created or updated > > > > > > Will update ‘sg/rolesmapping’ with …/sgconfig/sg\_roles\_mapping.yml > > > > > > SUCC: Configuration for ‘rolesmapping’ created or updated > > > > > > Will update ‘sg/internalusers’ with …/sgconfig/sg\_internal\_users.yml > > > > > > SUCC: Configuration for ‘internalusers’ created or updated > > > > > > Will update ‘sg/actiongroups’ with …/sgconfig/sg\_action\_groups.yml > > > > > > SUCC: Configuration for ‘actiongroups’ created or updated > > > > > > Done with success > > > > > > > > > > > > > > > > > > > > > > > > ===================================================== > > > > > > When I log into Kibana with anh of the users, I get the error: > > > > > > _**Discover: no permissions for [indices:data/read/search] and User [name=userx1, roles=[kibanauser], requestedTenant=null]**_ > > > > > > > > > > > > > > > > > > ===================================================== > > > > > > **curl [https://localhost:9200/\_searchguard/\_mapping?pretty](https://localhost:9200/_searchguard/_mapping?pretty) -u userx1 -k** > > > > > > > > > > > > { > > > > > > “error” : { > > > > > > ``` > > > > > "root_cause" : [ > > > > > > > > > > ``` > > > > > > ``` > > > > > { > > > > > > > > > > ``` > > > > > > ``` > > > > > "type" : "security_exception", > > > > > > > > > > ``` > > > > > > ``` > > > > > "reason" : "Unexpected exception indices:admin/mappings/get" > > > > > > > > > > ``` > > > > > > ``` > > > > > } > > > > > > > > > > ``` > > > > > > ``` > > > > > ], > > > > > > > > > > ``` > > > > > > ``` > > > > > "type" : "security_exception", > > > > > > > > > > ``` > > > > > > ``` > > > > > "reason" : "Unexpected exception indices:admin/mappings/get" > > > > > > > > > > ``` > > > > > > }, > > > > > > “status” : 500 > > > > > > } > > > > > > > > > > > > > > > > > > ===================================================== > > > > > > **curl -XGET ‘[https://localhost:9200/\_searchguard/authinfo](https://localhost:9200/_searchguard/authinfo)’ -u userx1 -k** > > > > > > > > > > > > {“user”:“User [name=userx1, roles=[kibanauser], requestedTenant=null]”,“user\_name”:“userx1”,“user\_requested\_tenant”:null,“remote\_address”:“[::1]:46968”,“backend\_roles”:[“kibanauser”],“custom\_attribute\_names”:,“sg\_roles”:[“rolex1”,“sg\_kibana\_user”,“sg\_own\_index”],"sg\_te > > > > > > nants":{“userx1”:true},“principal”:null,“peer\_certificates”:“0”}[root@localhost sgconfig]# > > > > > > > > > > > > > > > > > > > > > > > > ===================================================== > > > > > > Elasticsearch Version: 6.2.3 > > > > > > Search Guard Version: 6.2.3-22.0 > > > > > > No enterprise modules > > > > > > Kibana 6.2.3 > > > > > > > > > > > > > > > > > > Can anyone spot something wrong or missing ? Why doesn’t the user apply the permissions on the role when logged in ? > > > > > > > > > > > > Thank you very much, > > > > > > > > > > > > Luís Jeremias