# Why SG need cluster permissions indices:data/read/scroll when I try \_delete\_by\_query **URL:** \ **Category:** Search Guard\ **Created:** [October 26, 2017, 7:29am UTC](https://forum.search-guard.com/t/why-sg-need-cluster-permissions-indices-data-read-scroll-when-i-try-delete-by-query/653 "2017-10-26T07:29:27Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Alexey\_Chernyaev](https://avatars.discourse-cdn.com/v4/letter/a/9de053/32.png) [@Alexey\_Chernyaev](https://forum.search-guard.com/u/Alexey_Chernyaev)\ **Post date:** [October 26, 2017, 7:29am UTC](https://forum.search-guard.com/t/why-sg-need-cluster-permissions-indices-data-read-scroll-when-i-try-delete-by-query/653/1 "2017-10-26T07:29:27Z")
System information: - Operating System: CentOS 7.4 Software: - ElasticSearch version: 5.6.3-1 - SearchGuard version: 5.6.3-16 - JVM version: 8u144 I have user with all permission on indexes “index\*” and namely “index\_admin”. Configuration looks like this: sg\_roles.yml: index\_all: indices: ‘index\*’: ‘\*’: - INDICES\_ALL `` sg\_roles\_mapping.yml index\_all: users: - index\_admin `` I try execute next query: curl -XPOST -u spir\_admin ‘localhost:9200/index/material/\_delete\_by\_query’ -H ‘Content-Type: application/json’ -d’ { “query”: { “bool”: { “filter”: [ { “range”: { “create\_date”: { “gte”: 1451595600, “lte”: 1507582799 } } } ] } } } ’ `` On this query **ElasticSearch** returned me error: { “error”:{ “root\_cause”:[{ “type”:“security\_exception”, “reason”:“no permissions for indices:data/read/scroll” }], “type”:“security\_exception”, “reason”:“no permissions for indices:data/read/scroll”}, “status”:403 } `` I turned on debug in SearchGuard and I seen, SG try requested index ‘ **\_all** ’: [2017-10-25T18:19:42,446][DEBUG][c.f.s.c.PrivilegesEvaluator] evaluate permissions for User [name=index\_admin, roles=] [2017-10-25T18:19:42,446][DEBUG][c.f.s.c.PrivilegesEvaluator] requested indices:data/read/scroll/clear from 10.111.146.128:48922 [2017-10-25T18:19:42,446][DEBUG][c.f.s.c.PrivilegesEvaluator] class org.elasticsearch.action.search.ClearScrollRequest is not an IndicesRequest [2017-10-25T18:19:42,446][DEBUG][c.f.s.c.PrivilegesEvaluator] requested resolved indextypes: [IndexType [index=\_all, type=_]] [2017-10-25T18:19:42,446][DEBUG][c.f.s.c.PrivilegesEvaluator] mapped roles for index\_admin: [sg\_own\_index, sg\_public, spir\_all] [2017-10-25T18:19:42,446][DEBUG][c.f.s.c.PrivilegesEvaluator] ---------- evaluate sg\_role: sg\_own\_index [2017-10-25T18:19:42,446][DEBUG][c.f.s.c.PrivilegesEvaluator] resolved cluster actions:[indices:admin/aliases/exists_, indices:admin/aliases\*, indices:data/read/msearch, indices:data/read/coordinate-msearch\*, indices:data/write/bulk, indices:admin/aliases/get\*, indices:data/read/mget, indices:data/read/mtv] [2017-10-25T18:19:42,446][DEBUG][c.f.s.c.PrivilegesEvaluator] not match found a match for ‘sg\_own\_index’ and indices:data/read/scroll/clear, check next role [2017-10-25T18:19:42,446][DEBUG][c.f.s.c.PrivilegesEvaluator] ---------- evaluate sg\_role: sg\_public [2017-10-25T18:19:42,446][DEBUG][c.f.s.c.PrivilegesEvaluator] resolved cluster actions:[indices:admin/aliases/exists\*, indices:data/read/msearch, cluster:monitor/main, indices:data/read/coordinate-msearch\*, indices:admin/aliases/get\*, indices:data/read/mget, indices:data/read/mtv] [2017-10-25T18:19:42,446][DEBUG][c.f.s.c.PrivilegesEvaluator] not match found a match for ‘sg\_public’ and indices:data/read/scroll/clear, check next role [2017-10-25T18:19:42,446][DEBUG][c.f.s.c.PrivilegesEvaluator] ---------- evaluate sg\_role: index\_all [2017-10-25T18:19:42,446][DEBUG][c.f.s.c.PrivilegesEvaluator] resolved cluster actions:[cluster:monitor/_] [2017-10-25T18:19:42,446][DEBUG][c.f.s.c.PrivilegesEvaluator] not match found a match for ‘index\_all’ and indices:data/read/scroll/clear, check next role [2017-10-25T18:19:42,446][INFO][c.f.s.c.PrivilegesEvaluator] No cluster-level perm match for User [name=index\_admin, roles=[]] [IndexType [index=\_all, type=_]] [Action [indices:data/read/scroll/clear]] [RolesChecked [sg\_own\_index, sg\_public, index\_all]] [2017-10-25T18:19:42,446][INFO][c.f.s.c.PrivilegesEvaluator] No permissions for {} [2017-10-25T18:19:42,446][DEBUG][c.f.s.f.SearchGuardFilter] no permissions for indices:data/read/scroll/clear [2017-10-25T18:19:42,446][WARN][o.e.i.r.TransportDeleteByQueryAction] [elk] Failed to clear scroll [DnF1ZXJ5VGhlbkZldGNoBQAAAAAAAAFqFjBrcWt6cTlmUXAyT3llcGxjUGpmX0EAAAAAAAABaRYwa3FrenE5ZlFwMk95ZXBsY1BqZl9BAAAAAAAAAWsWMGtxa3pxOWZRcDJPeWVwbGNQamZfQQAAAAAAAAFsFjBrcWt6cTlmUXAyT3llcGxjUGpmX0EAAAAAAAABbRYwa3FrenE5ZlFwMk95ZXBsY1BqZl9B] `` When I added cluster permission indices:data/read/scroll - it works! Why? Why SG require cluster permission for \_delete\_by\_query? And what that permission does? ---
**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\ **Post date:** [October 28, 2017, 8:27pm UTC](https://forum.search-guard.com/t/why-sg-need-cluster-permissions-indices-data-read-scroll-when-i-try-delete-by-query/653/2 "2017-10-28T20:27:24Z")
see [https://github.com/floragunncom/search-guard/issues/377](https://github.com/floragunncom/search-guard/issues/377) > **···** > > > Am 26.10.2017 um 09:29 schrieb Alexey Chernyaev \: > > > > System information: > >   \* Operating System: CentOS 7.4 > >   Software: > >     \* ElasticSearch version: 5.6.3-1 > >     \* SearchGuard version: 5.6.3-16 > >     \* JVM version: 8u144 > > > > I have user with all permission on indexes "index\*" and namely "index\_admin". Configuration looks like this: > > > > sg\_roles.yml: > >   index\_all: > >     indices: > >       'index\*': > >         '\*': > >           - INDICES\_ALL > > > > sg\_roles\_mapping.yml > >   index\_all: > >     users: > >       - index\_admin > > > > I try execute next query: > > curl -XPOST -u spir\_admin 'localhost:9200/index/material/\_delete\_by\_query' -H 'Content-Type: application/json' -d' > > { > >   "query": { > >     "bool": { > >       "filter": [ > >         { > >           "range": { > >             "create\_date": { > >               "gte": 1451595600, > >               "lte": 1507582799 > >             } > >           } > >         } > >       ] > >     } > >   } > > } > > ' > > > > On this query ElasticSearch returned me error: > > { > >   "error":{ > >     "root\_cause":[{ > >       "type":"security\_exception", > >       "reason":"no permissions for indices:data/read/scroll" > >     }], > >     "type":"security\_exception", > >     "reason":"no permissions for indices:data/read/scroll"}, > >   "status":403 > > } > > > > I turned on debug in SearchGuard and I seen, SG try requested index '\_all': > > [2017-10-25T18:19:42,446][DEBUG][c.f.s.c.PrivilegesEvaluator] evaluate permissions for User [name=index\_admin, roles=] > > [2017-10-25T18:19:42,446][DEBUG][c.f.s.c.PrivilegesEvaluator] requested indices:data/read/scroll/clear from 10.111.146.128:48922 > > [2017-10-25T18:19:42,446][DEBUG][c.f.s.c.PrivilegesEvaluator] class org.elasticsearch.action.search.ClearScrollRequest is not an IndicesRequest > > [2017-10-25T18:19:42,446][DEBUG][c.f.s.c.PrivilegesEvaluator] requested resolved indextypes: [IndexType [index=\_all, type=\*]] > > [2017-10-25T18:19:42,446][DEBUG][c.f.s.c.PrivilegesEvaluator] mapped roles for index\_admin: [sg\_own\_index, sg\_public, spir\_all] > > [2017-10-25T18:19:42,446][DEBUG][c.f.s.c.PrivilegesEvaluator] ---------- evaluate sg\_role: sg\_own\_index > > [2017-10-25T18:19:42,446][DEBUG][c.f.s.c.PrivilegesEvaluator] resolved cluster actions:[indices:admin/aliases/exists\*, indices:admin/aliases\*, indices:data/read/msearch, indices:data/read/coordinate-msearch\*, indices:data/write/bulk, indices:admin/aliases/get\*, indices:data/read/mget, indices:data/read/mtv] > > [2017-10-25T18:19:42,446][DEBUG][c.f.s.c.PrivilegesEvaluator] not match found a match for 'sg\_own\_index' and indices:data/read/scroll/clear, check next role > > [2017-10-25T18:19:42,446][DEBUG][c.f.s.c.PrivilegesEvaluator] ---------- evaluate sg\_role: sg\_public > > [2017-10-25T18:19:42,446][DEBUG][c.f.s.c.PrivilegesEvaluator] resolved cluster actions:[indices:admin/aliases/exists\*, indices:data/read/msearch, cluster:monitor/main, indices:data/read/coordinate-msearch\*, indices:admin/aliases/get\*, indices:data/read/mget, indices:data/read/mtv] > > [2017-10-25T18:19:42,446][DEBUG][c.f.s.c.PrivilegesEvaluator] not match found a match for 'sg\_public' and indices:data/read/scroll/clear, check next role > > [2017-10-25T18:19:42,446][DEBUG][c.f.s.c.PrivilegesEvaluator] ---------- evaluate sg\_role: index\_all > > [2017-10-25T18:19:42,446][DEBUG][c.f.s.c.PrivilegesEvaluator] resolved cluster actions:[cluster:monitor/\*] > > [2017-10-25T18:19:42,446][DEBUG][c.f.s.c.PrivilegesEvaluator] not match found a match for 'index\_all' and indices:data/read/scroll/clear, check next role > > [2017-10-25T18:19:42,446][INFO][c.f.s.c.PrivilegesEvaluator] No cluster-level perm match for User [name=index\_admin, roles=] [IndexType [index=\_all, type=\*]] [Action [indices:data/read/scroll/clear]] [RolesChecked [sg\_own\_index, sg\_public, index\_all]] > > [2017-10-25T18:19:42,446][INFO][c.f.s.c.PrivilegesEvaluator] No permissions for {} > > [2017-10-25T18:19:42,446][DEBUG][c.f.s.f.SearchGuardFilter] no permissions for indices:data/read/scroll/clear > > [2017-10-25T18:19:42,446][WARN][o.e.i.r.TransportDeleteByQueryAction] [elk] Failed to clear scroll [DnF1ZXJ5VGhlbkZldGNoBQAAAAAAAAFqFjBrcWt6cTlmUXAyT3llcGxjUGpmX0EAAAAAAAABaRYwa3FrenE5ZlFwMk95ZXBsY1BqZl9BAAAAAAAAAWsWMGtxa3pxOWZRcDJPeWVwbGNQamZfQQAAAAAAAAFsFjBrcWt6cTlmUXAyT3llcGxjUGpmX0EAAAAAAAABbRYwa3FrenE5ZlFwMk95ZXBsY1BqZl9B] > > > > When I added cluster permission indices:data/read/scroll - it works! > > > > Why? Why SG require cluster permission for \_delete\_by\_query? And what that permission does? > > > > -- > > You received this message because you are subscribed to the Google Groups "Search Guard Community Forum" group. > > To unsubscribe from this group and stop receiving emails from it, send an email to search-guard+unsubscribe@googlegroups.com. > > To post to this group, send email to search-guard@googlegroups.com. > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/baeee5b4-f650-4bf4-8e12-e88e1041c7b6%40googlegroups.com\](https://groups.google.com/d/msgid/search-guard/baeee5b4-f650-4bf4-8e12-e88e1041c7b6%40googlegroups.com%5C). > > For more options, visit [https://groups.google.com/d/optout\](https://groups.google.com/d/optout%5C).