# User ldap have no permission on Kibana (after authentication)

**URL:** <https://forum.search-guard.com/t/user-ldap-have-no-permission-on-kibana-after-authentication/1894>\
**Category:** Search Guard\
**Created:** [July 9, 2020, 1:07pm UTC](https://forum.search-guard.com/t/user-ldap-have-no-permission-on-kibana-after-authentication/1894 "2020-07-09T13:07:20Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![RomainM27](https://avatars.discourse-cdn.com/v4/letter/r/8baadc/32.png) [@RomainM27](https://forum.search-guard.com/u/RomainM27)\
**Post date:** [July 9, 2020, 1:07pm UTC](https://forum.search-guard.com/t/user-ldap-have-no-permission-on-kibana-after-authentication/1894/1 "2020-07-09T13:07:21Z")

</div>

\*\*Elasticsearch version: 7.5  
\*\*Server OS version: Red Hat 7.6

\*\*Describe the issue:

Hello,

I installed Elasticsearch Stack with Search Guard. (With LDAP Authent)

I have mapped admin to my admin group in LDAP (cn=ldap\_admins).  
=\> It works. My ldap user with ldap\_admins group can perform full action on cluster. It can go to Kibana too.

Then, i created role called R\_APP\_TEST\_ES\_WRITER for ldap group “test\_es”.  
I have user called a\_app\_test in ldap group test\_es. So, it retrieve role when i check with auth info :

So, i check auth info and all is ok for now :  
…authinfo?pretty -u 'a\_app\_test

“sg\_roles” : [  
“R\_APP\_TEST\_ES\_SOCLE\_WRITER”,  
“SGS\_OWN\_INDEX”  
],  
“sg\_tenants” : {  
“apptest” : true,  
“a\_app\_test” : true

This user can use curl on Elasticsearch.  
But on Kibana, after authentifcation i have :  
{“statusCode”:403,“error”:“Forbidden”,“message”:"no permissions for [indices:data/read/search]

I have put this right under sg\_roles for R\_APP\_TEST\_ES\_WRITER, but always this error.

Thanks for hepl.

---

<div class="post-metadata">

**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\
**Post date:** [July 10, 2020, 2:52pm UTC](https://forum.search-guard.com/t/user-ldap-have-no-permission-on-kibana-after-authentication/1894/2 "2020-07-10T14:52:53Z")

</div>

```auto
{“statusCode”:403,“error”:“Forbidden”,“message”:"no permissions for [indices:data/read/search]

```

To execute a search, add SGS\_SEARCH index-level action group to the role.

> **[Permissions and action groups](https://docs.search-guard.com/latest/action-groups#permissions-and-action-groups)**
>
> How to define and use Search Guard action groups for easy configuration of index-level permissions

---

<div class="post-metadata">

**Author:** ![system](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/system/32/1870_2.png) [@system](https://forum.search-guard.com/u/system)\
**Post date:** [July 31, 2020, 2:53pm UTC](https://forum.search-guard.com/t/user-ldap-have-no-permission-on-kibana-after-authentication/1894/3 "2020-07-31T14:53:01Z")

</div>

Closed on July 31, 2020, 2:53pm UTC

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.