# Search Guard Roles/Permission Issue **URL:** \ **Category:** Search Guard\ **Created:** [July 16, 2018, 8:21am UTC](https://forum.search-guard.com/t/search-guard-roles-permission-issue/1016 "2018-07-16T08:21:40Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![Richard\_Caunt](https://avatars.discourse-cdn.com/v4/letter/r/d07c76/32.png) [@Richard\_Caunt](https://forum.search-guard.com/u/Richard_Caunt)\ **Post date:** [July 16, 2018, 8:21am UTC](https://forum.search-guard.com/t/search-guard-roles-permission-issue/1016/1 "2018-07-16T08:21:40Z")
Hello, I’ve got an issue getting my roles/permission setup working and I’m wondering if you can provide some pointers as to the cause: We’ve setup JWT backendroles mapped to SG roles, each role grants permissions to a set of indices, the idea being that the more roles the user is assigned to the more indices they can access data wise. When executing a query against Elasticsearch we are not seeing the results we’d expect. When I issue the following query using the Kibana Dev Tools for a user with JWT roles kibana, public, data-authoriser and data-search I’d expect to see the provenance index listed: Query: POST /\_search { “size”: 0, “aggs”: { “suggestions”: { “terms”: { “field”: “\_index”, “include”: “.\*” } } } } `` Results: { “took”: 16, “timed\_out”: false, “\_shards”: { “total”: 20, “successful”: 20, “skipped”: 0, “failed”: 0 }, “hits”: { “total”: 60, “max\_score”: 0, “hits”: }, “aggregations”: { “suggestions”: { “doc\_count\_error\_upper\_bound”: 0, “sum\_other\_doc\_count”: 0, “buckets”: [ { “key”: “notification-tracking”, “doc\_count”: 34 }, { “key”: “ingest\_tracking”, “doc\_count”: 22 }, { “key”: “investigation”, “doc\_count”: 3 }, { “key”: “operations”, “doc\_count”: 1 } ] } } } `` However, if I modify the sg\_cdp\_public role to also include the provenance index then it is returned in the above results. Second to that, if I run the following query: Get /provenance/\_search `` I can access the data in the provenance index. I’ve attached a tail of the Elasticsearch logs for further information. Versions / Logs: - Search Guard and Elasticsearch version - ES / Kibana: 6.3.0, Search Guard: 6.3.0-22.3 - Installed and used enterprise modules, if any - JWT - JVM version and operating system version - OpenJDK build 1.8.0\_171-b10 - Search Guard configuration files sg\_roles\_mapping.yml sg\_all\_access: users: ``` - admin - lambdaingester ``` backendroles: ``` - 'sg_all_access' ``` sg\_logstash: users: ``` - logstash ``` sg\_kibana\_server: users: ``` - kibanaserver ``` sg\_kibana\_user: backendroles: ``` - kibanarole - kibana ``` sg\_monitor: backendroles: ``` - kibanarole ``` sg\_alerting: backendroles: ``` - kibanarole ``` sg\_public: users: ``` - '*' ``` sg\_readall: users: ``` - readall ``` sg\_own\_index: users: ``` - '*' ``` sg\_data\_authoriser: backendroles: ``` - data-authoriser - kibana ``` sg\_data\_search: backendroles: ``` - data-search ``` sg\_cdp\_public: backendroles: ``` - public ``` `` sg\_roles.yml sg\_all\_access: readonly: true cluster: ``` - UNLIMITED ``` indices: ``` '*': '*': - UNLIMITED ``` tenants: ``` admin_tenant: RW ``` # Read all, but no write permissions sg\_readall: readonly: true cluster: ``` - CLUSTER_COMPOSITE_OPS_RO ``` indices: ``` '*': '*': - READ ``` # Read all and monitor, but no write permissions sg\_readall\_and\_monitor: cluster: ``` - CLUSTER_MONITOR - CLUSTER_COMPOSITE_OPS_RO ``` indices: ``` '*': '*': - READ ``` # For users which use kibana, access to indices must be granted separately sg\_kibana\_user: readonly: true cluster: ``` - INDICES_MONITOR - CLUSTER_COMPOSITE_OPS ``` indices: ``` '?kibana': '*': - MANAGE - INDEX - READ - DELETE '?kibana-6': '*': - MANAGE - INDEX - READ - DELETE '*': '*': - indices:data/read/field_caps* ``` # For the kibana server sg\_kibana\_server: readonly: true cluster: ``` - CLUSTER_MONITOR - CLUSTER_COMPOSITE_OPS - cluster:admin/xpack/monitoring* - indices:admin/template* ``` indices: ``` '?kibana': '*': - INDICES_ALL '?kibana-6': '*': - INDICES_ALL '?reporting*': '*': - INDICES_ALL '?monitoring*': '*': - INDICES_ALL ``` # For logstash and beats sg\_logstash: cluster: ``` - CLUSTER_MONITOR - CLUSTER_COMPOSITE_OPS - indices:admin/template/get - indices:admin/template/put ``` indices: ``` 'logstash-*': '*': - CRUD - CREATE_INDEX '*beat*': '*': - CRUD - CREATE_INDEX ``` # Allows adding and modifying repositories and creating and restoring snapshots sg\_manage\_snapshots: cluster: ``` - MANAGE_SNAPSHOTS ``` indices: ``` '*': '*': - "indices:data/write/index" - "indices:admin/create" ``` # Allows each user to access own named index sg\_own\_index: cluster: ``` - CLUSTER_COMPOSITE_OPS ``` indices: ``` '${user_name}': '*': - INDICES_ALL ``` ### X-Pack COMPATIBILITY sg\_xp\_monitoring: readonly: true indices: ``` '?monitor*': '*': - INDICES_ALL ``` sg\_xp\_alerting: readonly: true cluster: ``` - indices:data/read/scroll - cluster:admin/xpack/watcher* - cluster:monitor/xpack/watcher* ``` indices: ``` '?watches*': '*': - INDICES_ALL '?watcher-history-*': '*': - INDICES_ALL '?triggered_watches': '*': - INDICES_ALL '*': '*': - READ - indices:admin/aliases/get ``` sg\_xp\_machine\_learning: readonly: true cluster: ``` - cluster:admin/persistent* - cluster:internal/xpack/ml* - indices:data/read/scroll* - cluster:admin/xpack/ml* - cluster:monitor/xpack/ml* ``` indices: ``` '*': '*': - READ - indices:admin/get* '?ml-*': '*': - "*" ``` sg\_data\_authoriser: cluster: ``` - CLUSTER_ALL - UNLIMITED - CLUSTER_COMPOSITE_OPS - indices:admin/mappings/get - indices:admin/get ``` indices: ``` provenance: '*': - INDICES_ALL operations: '*': - INDICES_ALL ingest_authorise: '*': - INDICES_ALL ``` sg\_data\_search: cluster: ``` - CLUSTER_COMPOSITE_OPS ``` indices: ``` 'raw_*': '*': - INDICES_ALL 'obj_*': '*': - INDICES_ALL ``` sg\_cdp\_public: cluster: ``` - CLUSTER_ALL ``` indices: ``` '*': '*': - indices:admin/get - indices:admin/mappings/get - indices:admin/validate/query operations: '*': - READ 'investigation*': '*': - INDICES_ALL notification-tracking: '*': - INDICES_ALL disclosure: '*': - INDICES_ALL ingest_tracking: '*': - INDICES_ALL ``` `` [log.txt](https://forum.search-guard.com/uploads/short-url/dV43hRWov9mbQxrqBEp1eb3hEfF.txt) (162 KB)