# Action \[indices:admin/delete\] is unauthorized for user

**URL:** <https://discuss.elastic.co/t/action-indices-admin-delete-is-unauthorized-for-user/85744>\
**Category:** Elasticsearch\
**Created:** [May 15, 2017, 11:05am UTC](https://discuss.elastic.co/t/action-indices-admin-delete-is-unauthorized-for-user/85744 "2017-05-15T11:05:23Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![vijayramachandran](https://avatars.discourse-cdn.com/v4/letter/v/858c86/32.png) [@vijayramachandran](https://discuss.elastic.co/u/vijayramachandran)\
**Post date:** [May 15, 2017, 11:05am UTC](https://discuss.elastic.co/t/action-indices-admin-delete-is-unauthorized-for-user/85744/1 "2017-05-15T11:05:23Z")

</div>

Hi Team,

I don't quite get this, what's causing this issue,

roles.yml

```
> hello:
> cluster:
> - all
> indices:
> - names: 'twitter'
> privileges:
> - all

```

x-pack]$./users list  
test : monitoring\_user  
hello : ingest\_admin  
sample : -

> ```
> x-pack]$curl --user hello:hello123 -XDELETE '10.245.30.45:9200/twitter?pretty'
> {
> "error" : {
> "root_cause" : [
> {
> "type" : "security_exception",
> "reason" : "action [indices:admin/delete] is unauthorized for user [hello]"
> }
> ],
> "type" : "security_exception",
> "reason" : "action [indices:admin/delete] is unauthorized for user [hello]"
> },
> "status" : 403
> }
> 
> ```

Could you explain me about cluster privileges, what needs to be given for the normal user in order to make it work? If you're going to say admin, then there wouldn't be any security here right? Anyone can fire anything isn't it?

What's the optimal combination of these below?

cluster privilege : ?  
x-pack user privilege : superuser or whichever appropriate for a normal user?  
indice privilege : ?

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [May 15, 2017, 12:03pm UTC](https://discuss.elastic.co/t/action-indices-admin-delete-is-unauthorized-for-user/85744/2 "2017-05-15T12:03:54Z")

</div>

> [@](#):
>
> roles.yml
> 
> ```
> hello:
> ...
> 
> ```

This shows that you have a role named `hello`.

But this:

> [@](#):
>
> x-pack]$./users list  
> test : monitoring\_user  
> hello : ingest\_admin  
> sample : -

shows that no user has the "hello" role. There is a user with the id "hello", but it only has the `ingest_admin` role.

> [@](#):
>
> `curl --user hello:hello123`

you are authenticating as the user "hello", but that mean you have the "ingest\_admin" role, not the "hello" role.

What you need to do is:

**First** , add the "hello" role to the "hello" user:

```
bin/x-pack/users roles hello -a hello

```

> **[File-based User Authentication | X-Pack for the Elastic Stack \[6.2\] | Elastic](https://www.elastic.co/guide/en/x-pack/current/file-realm.html#file-realm-manage-roles)**

**Then** , verify that everything is correct:

```
curl --user hello:hello123 '10.245.30.45:9200/_xpack/security/_authenticate?pretty'

```

> **[Authenticate API | Elasticsearch Guide \[8.11\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-authenticate.html)**

That should list that the `hello` user has the `hello` role.

---

<div class="post-metadata">

**Author:** ![vijayramachandran](https://avatars.discourse-cdn.com/v4/letter/v/858c86/32.png) [@vijayramachandran](https://discuss.elastic.co/u/vijayramachandran)\
**Post date:** [May 15, 2017, 1:47pm UTC](https://discuss.elastic.co/t/action-indices-admin-delete-is-unauthorized-for-user/85744/3 "2017-05-15T13:47:37Z")

</div>

I think I am missing something, can you have a look and advise on this?

```
> x-pack]$curl --user hello:hello123 -XGET '10.245.30.45:9200/_xpack/security/_authenticate?pretty'
> {
> "username" : "hello",
> "roles" : [
> "testing"
> ],
> "full_name" : null,
> "email" : null,
> "metadata" : { },
> "enabled" : true
> }

> testing:
> run_as: 'hello'
> cluster:
> - all
> indices:
> - names: 'twitter'
> privileges:
> - delete (all - works here, but not delete, or delete_index, wondering why?)

```

I get this error, is it because of the white space issue?

[2017-05-15T15:45:37,306][ERROR][o.e.x.s.a.s.FileRolesStore] [node-1] failed to parse role [testing]. skipping role...  
[2017-05-15T15:45:37,306][INFO][o.e.x.s.a.s.FileRolesStore] [node-1] updated roles (roles file [/opt/elastic/applications/elasticsearch-5.2.2\_bkp/config/x-pack/roles.yml] changed)

Even after the role added to that user account, it still barfs with user not authorized,

```
> x-pack]$curl --user hello:hello123 -XDELETE '10.245.30.45:9200/twitter?pretty'
> {
> "error" : {
> "root_cause" : [
> {
> "type" : "security_exception",
> "reason" : "action [indices:admin/delete] is unauthorized for user [hello]"
> }
> ],
> "type" : "security_exception",
> "reason" : "action [indices:admin/delete] is unauthorized for user [hello]"
> },
> "status" : 403
> }

```

P.S: even I have set the privileges as below, it didn't work.

> ```
> privileges:
> > - all
> 
> ```

And my bad in the previous thread, I had given hello as a role, but actually testing is a role and hello is the user.

---

<div class="post-metadata">

**Author:** ![vijayramachandran](https://avatars.discourse-cdn.com/v4/letter/v/858c86/32.png) [@vijayramachandran](https://discuss.elastic.co/u/vijayramachandran)\
**Post date:** [May 15, 2017, 2:11pm UTC](https://discuss.elastic.co/t/action-indices-admin-delete-is-unauthorized-for-user/85744/4 "2017-05-15T14:11:43Z")

</div>

Update:

I have corrected this roles.yml now,

```
> x-pack]$cat roles.yml
> # The default roles file is empty as the preferred method of defining roles is
> # through the API/UI. File based roles are useful in error scenarios when the
> # API based roles may not be available.
> testing:
> run_as: 'hello'
> cluster:
> - all
> indices:
> - names: 'twitter'
> privileges:
> -delete_index

```

Somehow, I get the same error,

```
 > x-pack]$curl --user hello:hello123 -XDELETE '10.245.30.45:9200/twitter?pretty'
> {
> "error" : {
> "root_cause" : [
> {
> "type" : "security_exception",
> "reason" : "action [indices:admin/delete] is unauthorized for user [hello]"
> }
> ],
> "type" : "security_exception",
> "reason" : "action [indices:admin/delete] is unauthorized for user [hello]"
> },
> "status" : 403
> }
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 12, 2017, 2:25pm UTC](https://discuss.elastic.co/t/action-indices-admin-delete-is-unauthorized-for-user/85744/5 "2017-06-12T14:25:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.