Tenant foo is not allowed to write (user: bob)
We just upgraded from 5.3.2 to 5.6.6 and now the users can’t access RO tenants anymore.
Take for instance user ‘bob’ who has the following credentials, as reported by kibana/elasticsearch/_searchguard/authinfo:
{
"user": "User [name=bob, roles=[]]",
"user_name": "bob",
"user_requested_tenant": "foo",
"remote_address": "192.168.230.13:59340",
"sg_roles": [
"sg_role_site",
"sg_role_bar",
"sg_role_baz"
],
"sg_tenants": {
"foo": false,
"bar": true,
"beer": false,
"sandbox": true,
"baz": true,
"deer": false,
"bob": true,
"fox": false
},
"principal": null,
"peer_certificates": "0"
}
Given the following roles:
sg_role_site:
tenants:
deer: RO
sandbox: RW
foo: RO
beer: RO
bar: RO
fox: RO
sg_role_bar:
tenants:
bar: RW
sg_role_baz:
tenants:
baz: RW
[...]
When the user ‘bob’ accesses kibana discovery using tenant ‘foo’ he gets the following error in the browser:
Error: no permissions for [indices:data/write/update] and User [name=bob, roles=[]]: [security_exception] no permissions for [indices:data/write/update] and User [name=bob, roles=[]]
exports.SavedObjectsClient</<.value/<@https://kibana.my.tld/bundles/kibana.bundle.js?v=15605:228:17056
processQueue@https://kibana.my.tld/bundles/commons.bundle.js?v=15605:38:23621
scheduleProcessQueue/<@https://kibana.my.tld/bundles/commons.bundle.js?v=15605:38:23888
$RootScopeProvider/this.$get</Scope.prototype.$eval@https://kibana.my.tld/bundles/commons.bundle.js?v=15605:39:4607
$RootScopeProvider/this.$get</Scope.prototype.$digest@https://kibana.my.tld/bundles/commons.bundle.js?v=15605:39:2343
$RootScopeProvider/this.$get</Scope.prototype.$apply@https://kibana.my.tld/bundles/commons.bundle.js?v=15605:39:5026
done@https://kibana.my.tld/bundles/commons.bundle.js?v=15605:37:25016
completeRequest@https://kibana.my.tld/bundles/commons.bundle.js?v=15605:37:28702
createHttpBackend/</xhr.onload@https://kibana.my.tld/bundles/commons.bundle.js?v=15605:37:29634
In Elasticsearch, I get merely the following in the logs:
[WARN ][c.f.s.c.PrivilegesInterceptorImpl] Tenant foo is not allowed to write (user: bob)
What are we doing wrong?
Why would doing a search require write access?
BTW, auth is using proxy module.