Tenant selection not maintained for user

Search Guard
1

Elasticsearch version: - 7.10.1

Kibana version (if relevant): - 7.10.1

Searchguard Version - search-guard-suite-plugin-7.10.1-48.0.0.zip

Describe the issue: - We have recently upgraded the Elasticsearch cluster from version 7.2.1 to 7.10.1.
After the upgrade, we have noticed that the tenant selection is lost after new session and the Global tenant is selected for the user.

Steps to reproduce:

  1. Login to Kibana, select the tenant “TEANT_1” from the multitenancy section.
  2. Logout or close the browser session, and try to access kibana.
  3. The Global tenant is selected instead of the tenant “TENANT_1”

Expected behavior: - The tenant selection for a user should be maintained even when user accesses kibana in a new session

2

Hi. Please show your kibana.yml. Don’t forget to obfuscate the credentials.

3

Please find below the kibana.yml

# Default Kibana configuration for docker target
server.name: ${HOSTNAME}
server.host: "0"
server.basePath: "/kibana"
server.rewriteBasePath: true
xpack.monitoring.ui.container.elasticsearch.enabled: true
xpack.security.enabled: false
xpack.ml.enabled: true

# Use HTTPS instead of HTTP
elasticsearch.hosts:
      - https://<server1>:9200
      - https://<server2>:9200
      - https://<server3>:9200

# Configure the Kibana internal server user
elasticsearch.ssl.certificate: /tech/cert/kibanaserver.pem
elasticsearch.ssl.key: /tech/cert/kibanaserver.key
elasticsearch.ssl.certificateAuthorities: /tech/cert/root.ca

elasticsearch.ssl.verificationMode: full
elasticsearch.username: "kibanaserver"
searchguard.allow_client_certificates: true
elasticsearch.ssl.alwaysPresentCertificate: true

# To handle the timeouts in Kibana
elasticsearch.requestTimeout: 120000

# Whitelist the Search Guard Multi Tenancy Header
elasticsearch.requestHeadersWhitelist: [ "Authorization", "sgtenant", "x-forwarded-for", "x-proxy-user", "x-proxy-roles" ]
searchguard.multitenancy.enabled: true

searchguard.auth.type: "proxy"

We are using the remote cluster search functionality and the above configuration is from the kibana connected to the federation ES cluster

4

It is a bug, here is the issue for it: The tenant selection is not preserved between the sessions (#341) · Issues · search-guard / Search Guard Kibana Plugin · GitLab
I’ll ping you when it is fixed.

5

Thank you for checking. I will wait for an update on this.