# \[7.15.1\] Allow GET \_security/user avoiding permission bloat
**URL:** https://discuss.elastic.co/t/7-15-1-allow-get-security-user-avoiding-permission-bloat/289064
**Category:** Elasticsearch
**Tags:** elastic-stack-security
**Created:** [November 12, 2021, 12:05pm UTC](https://discuss.elastic.co/t/7-15-1-allow-get-security-user-avoiding-permission-bloat/289064 "2021-11-12T12:05:22Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)
#### Post date: [November 12, 2021, 12:05pm UTC](https://discuss.elastic.co/t/7-15-1-allow-get-security-user-avoiding-permission-bloat/289064/1 "2021-11-12T12:05:22Z")
Hi there,
I'd need to create a role which allows a user to make the following call
`GET _security/user`
in order to list all the users of a cluster.
Unfortunately, according to the [API doc](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-get-user.html) it seems to need the `manage_security` or `all` cluster privilege.
However, giving a specific user one of those privileges would allow him to do a bunch of other VERY IMPORTANT things, such as create/delete/edit other users/roles.
Is there any other way to accomplish what I need without giving such permissions?
I tried allowing specific privileges (like read/write) only to the `.security*` indices but it won't work, returning the usual security error
> action [cluster:admin/xpack/security/user/get] is unauthorized for user [my\_user] wit
> h roles [my\_role], this action is granted by the cluster privileges [manage\_security,all]
Is it possible I can't allow a user to list other users without preventing him the whole access to the security layer?
Thanks!
---
### Author:  [@fdartayre](https://discuss.elastic.co/u/fdartayre)
#### Post date: [November 18, 2021, 10:02am UTC](https://discuss.elastic.co/t/7-15-1-allow-get-security-user-avoiding-permission-bloat/289064/2 "2021-11-18T10:02:04Z")
Hi Fabio,
You should be able to define the role like this and give it to your user:
```auto
POST /_security/role/get_user_role
{
"cluster": ["cluster:admin/xpack/security/user/get"]
}
```
A cluster privilege can be either one of the predefined cluster privilege names (`manage_security`, etc) or a pattern over one of the available cluster actions.
---
### Author:  [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)
#### Post date: [December 7, 2021, 1:57pm UTC](https://discuss.elastic.co/t/7-15-1-allow-get-security-user-avoiding-permission-bloat/289064/3 "2021-12-07T13:57:25Z")
Hi Fred,
sorry for the late reply to your answer.
It worked flawlessly!
Thank you so much!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 4, 2022, 1:57pm UTC](https://discuss.elastic.co/t/7-15-1-allow-get-security-user-avoiding-permission-bloat/289064/4 "2022-01-04T13:57:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.