# Users accessing kibana without any roles

**URL:** <https://forum.search-guard.com/t/users-accessing-kibana-without-any-roles/1860>\
**Category:** Search Guard\
**Created:** [June 12, 2020, 2:12pm UTC](https://forum.search-guard.com/t/users-accessing-kibana-without-any-roles/1860 "2020-06-12T14:12:28Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![oliverbth05](https://avatars.discourse-cdn.com/v4/letter/o/e68b1a/32.png) [@oliverbth05](https://forum.search-guard.com/u/oliverbth05)\
**Post date:** [June 12, 2020, 2:12pm UTC](https://forum.search-guard.com/t/users-accessing-kibana-without-any-roles/1860/1 "2020-06-12T14:12:29Z")

</div>

We have searchguard configured to perform authentication and authorization with our ldap, but only have roles assigned to a select few users. When users without roles are able to authenticate in kibana, they are shown the normal UI, except that the main content is blank for every link in the toolbar. Is there a user whitelist feature yet? If not, is there some way to display a message to the user explaining that they have insufficient permissions? We are currently using v6.4.3 of ELK but have plans to upgrade to v7.7.0.

---

<div class="post-metadata">

**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\
**Post date:** [June 15, 2020, 8:04am UTC](https://forum.search-guard.com/t/users-accessing-kibana-without-any-roles/1860/2 "2020-06-15T08:04:36Z")

</div>

> [@oliverbth05](#):
>
> Is there a user whitelist feature yet?

Yes, you can configure either whitelist or blacklist, but only starting from Search Guard v7.0.0, for example

Blacklist  
**sg\_blocks.yml**

```auto
demo_user_blocked:
  type: "name"
  value: ["John Doe"] # you can also use regular expressions and wildcards, e.g. '* Doe'
  verdict: "disallow"

```

Whitelist  
**sg\_blocks.yml**

```auto
demo_user_blocked:
  type: "name"
  value: ["John Doe"] # you can also use regular expressions and wildcards, e.g. '* Doe'
  verdict: "allow"

```

> **[Main concepts](https://docs.search-guard.com/latest/main-concepts#block-user--ip-addressnet-mask)**
>
> How Search Guard extracts credentials from a request and how they are mapped to users, roles and permissions.

---

<div class="post-metadata">

**Author:** ![srgbnd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/srgbnd/32/506_2.png) [@srgbnd](https://forum.search-guard.com/u/srgbnd)\
**Post date:** [June 15, 2020, 8:31am UTC](https://forum.search-guard.com/t/users-accessing-kibana-without-any-roles/1860/3 "2020-06-15T08:31:17Z")

</div>

> [@oliverbth05](#):
>
> If not, is there some way to display a message to the user explaining that they have insufficient permissions?

No, there is no way to have such warning by default before a user executes any action. But there is error if the user tries to execute an action when he doesn’t have enough permissions, for example

 ![Screenshot 2020-06-15 at 10.24.38](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/1X/d428dedb1396752a50e6800e888abfcda7eb1b29.png)  
or  
 ![Screenshot 2020-06-15 at 10.26.21](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/1X/e3b9e9a1cac1782c23d24f94ae98d7e2211e41cc.png)

etc.

Also, the user can always see the roles assigned to him in the Account app, for example

 ![Screenshot 2020-06-15 at 10.30.18](https://us1.discourse-cdn.com/flex019/uploads/search_guard/original/1X/18d229affb0012464f593dc72a9018d045935664.png)

**kibana.yml**

```auto
searchguard.accountinfo.enabled: true

```

---

<div class="post-metadata">

**Author:** ![system](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/system/32/1870_2.png) [@system](https://forum.search-guard.com/u/system)\
**Post date:** [July 6, 2020, 8:31am UTC](https://forum.search-guard.com/t/users-accessing-kibana-without-any-roles/1860/4 "2020-07-06T08:31:19Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.