# Action indices:data/read/mget is unauthorized but privilege listed
**URL:** https://discuss.elastic.co/t/action-indices-data-read-mget-is-unauthorized-but-privilege-listed/37774
**Category:** Elasticsearch
**Tags:** elastic-stack-security
**Created:** [December 22, 2015, 4:39pm UTC](https://discuss.elastic.co/t/action-indices-data-read-mget-is-unauthorized-but-privilege-listed/37774 "2015-12-22T16:39:30Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)
#### Post date: [December 22, 2015, 4:39pm UTC](https://discuss.elastic.co/t/action-indices-data-read-mget-is-unauthorized-but-privilege-listed/37774/1 "2015-12-22T16:39:31Z")
Hi I have a user who's been given the privilege "indices:data/read/mget" but is receiving the error "ElasticSearchSecurityException[action [indices:data/read/mget] is unauthorized for user ..." What am I doing wrong?
```
username:
cluster:
- cluster:monitor/nodes/info
- cluster:monitor/health
indices:
'logstash-systemname-*':
privileges:indices:admin/mappings/fields/get, indices:admin/validate/query, indices:admin/get,indices:data/read/mget,indices:data/read/get, read, search, indices:data/read/msearch
```
---
### Author:  [@jaymode](https://discuss.elastic.co/u/jaymode)
#### Post date: [December 22, 2015, 6:32pm UTC](https://discuss.elastic.co/t/action-indices-data-read-mget-is-unauthorized-but-privilege-listed/37774/2 "2015-12-22T18:32:35Z")
Hi,
I wonder if maybe the formatting of the role is an issue? Do you see any log messages when you start up about an invalid role?
Maybe try this:
```
username:
cluster:
- cluster:monitor/nodes/info
- cluster:monitor/health
indices:
'logstash-systemname-*':
privileges:
- indices:admin/mappings/fields/get
- indices:admin/validate/query
- indices:admin/get
- read
```
Just a note, I removed `search` and individual data read actions as they should already be covered by the `read` privilege. If this doesn't work, can you share the request that is failing along with the log message? Also, what type of user authentication and role assignment are you using?
---
### Author:  [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)
#### Post date: [December 23, 2015, 2:15pm UTC](https://discuss.elastic.co/t/action-indices-data-read-mget-is-unauthorized-but-privilege-listed/37774/3 "2015-12-23T14:15:50Z")
So I think that reformatting got me further. I gave the user a link to a dashboard I created for him and he logged in but there was an error reported at the screen top. I've seen it before where an error can prevent the dashboard from rendering. He saw the layout but there was no data. The error was an index\_not\_found\_exception for an index he doesn't have access to.
Someone else set up the LDAP authorization realm and I'm not sure why he's granting admin privileges. What would you recommend for cluster and indices privileges for a user who needs to view an index pattern I create, and view and create visualizations and dashboards based on that pattern?
---
### Author:  [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)
#### Post date: [December 23, 2015, 2:58pm UTC](https://discuss.elastic.co/t/action-indices-data-read-mget-is-unauthorized-but-privilege-listed/37774/4 "2015-12-23T14:58:41Z")
I've removed one of my colleagues from our admin security group and am trying to grant him access to an index. I have in roles.yml:
```
username:
indices:
'logstash-systemname-*'
privileges:
- read
```
I sent him the URL to the dashboard and he's getting this error:
> Visualize: [security\_exception] action [indices:data/read/msearch] is unauthorized for user ...
What am I missing?
---
### Author:  [@skearns](https://discuss.elastic.co/u/skearns)
#### Post date: [December 23, 2015, 3:09pm UTC](https://discuss.elastic.co/t/action-indices-data-read-mget-is-unauthorized-but-privilege-listed/37774/5 "2015-12-23T15:09:50Z")
Hey Craig,
I suggest starting with the built-in Kibana4 user role, and creating new role based on it. Instead of granting the privileges to "\*", you can grant it to a specific subset of indexes:
```auto
# The required permissions for kibana 4 users.
kibana4:
cluster:
- cluster:monitor/nodes/info
- cluster:monitor/health
indices:
'*':
privileges:
- indices:admin/mappings/fields/get
- indices:admin/validate/query
- indices:data/read/search
- indices:data/read/msearch
- indices:data/read/field_stats
- indices:admin/get
'.kibana':
privileges: indices:admin/exists, indices:admin/mapping/put, indices:admin/mappings/fields/get, indices:admin/refresh, indices:admin/validate/query, indices:data/read/get, indices:data/read/mget, indices:data/read/search, indices:data/write/delete, indices:data/write/index, indices:data/write/update
```
---
### Author:  [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)
#### Post date: [December 23, 2015, 3:48pm UTC](https://discuss.elastic.co/t/action-indices-data-read-mget-is-unauthorized-but-privilege-listed/37774/6 "2015-12-23T15:48:44Z")
Hi Steve. I created a roles.yml entry just like you listed for cdfoote role with `'logstash-systemname-*'` instead of `'*'` as you suggested. I cleared my browser cache and went to the dashboard with visualizations created on that index pattern but I'm still getting the error:
> Visualize: [security\_exception] action [indices:data/read/msearch] is unauthorized for user [cdfoote]
Any ideas?
---
### Author:  [@skearns](https://discuss.elastic.co/u/skearns)
#### Post date: [December 23, 2015, 4:51pm UTC](https://discuss.elastic.co/t/action-indices-data-read-mget-is-unauthorized-but-privilege-listed/37774/7 "2015-12-23T16:51:17Z")
Did you add the role to the user?
If cdfoote is part of the esusers, you can run:
`bin/shield/esusers roles cdfoote`
to see what roles are assigned to that user, and make sure that your new role is properly assigned.
---
### Author:  [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)
#### Post date: [December 23, 2015, 4:58pm UTC](https://discuss.elastic.co/t/action-indices-data-read-mget-is-unauthorized-but-privilege-listed/37774/8 "2015-12-23T16:58:02Z")
We're connected to LDAP so I have an entry in role\_mapping.yml:
```
cdfoote: [
"uid=cdfoote,ou=People,ou=..."
]
```
I've touched both files and see them updated in the log so I'm pretty sure they're being read. What I'm not sure of is the rest of the files' content. Someone else configured them and I'm wondering if a white-space problem is causing my section to not be read.
---
### Author:  [@jaymode](https://discuss.elastic.co/u/jaymode)
#### Post date: [December 23, 2015, 7:45pm UTC](https://discuss.elastic.co/t/action-indices-data-read-mget-is-unauthorized-but-privilege-listed/37774/9 "2015-12-23T19:45:15Z")
Hi Craig,
Are you sure the role is being mapped properly? If you grant access to `*` does the role work? If not, the role may not be mapped properly. You can also turn the log level up to `TRACE` and see what roles are being mapped.
---
### Author:  [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)
#### Post date: [December 23, 2015, 8:13pm UTC](https://discuss.elastic.co/t/action-indices-data-read-mget-is-unauthorized-but-privilege-listed/37774/10 "2015-12-23T20:13:43Z")
Hi Jay, I change the index pattern filter to \* and I could see everything. I then changed it back again and I'm getting the same error:
> Visualize: [security\_exception] action [indices:data/read/msearch] is unauthorized for user [cdfoote]
What exactly would I change to turn on TRACE logging?
---
### Author:  [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)
#### Post date: [December 23, 2015, 8:29pm UTC](https://discuss.elastic.co/t/action-indices-data-read-mget-is-unauthorized-but-privilege-listed/37774/11 "2015-12-23T20:29:53Z")
I modified the logging.yml, sibling to roles.yml, changing INFO to TRACE and monitored the logs but saw no trace entries. Do I need to restart elasticsearch? The access log was very busy and had numerous entries with my name: a bunch of granted for all the privileges except for the one in question which was denied.
---
### Author:  [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)
#### Post date: [January 4, 2016, 5:05pm UTC](https://discuss.elastic.co/t/action-indices-data-read-mget-is-unauthorized-but-privilege-listed/37774/12 "2016-01-04T17:05:12Z")
> You can also turn the log level up to TRACE and see what roles are being mapped.
What exactly do I need to do to see what roles are being mapped?
---
### Author:  [@jaymode](https://discuss.elastic.co/u/jaymode)
#### Post date: [January 4, 2016, 5:38pm UTC](https://discuss.elastic.co/t/action-indices-data-read-mget-is-unauthorized-but-privilege-listed/37774/13 "2016-01-04T17:38:14Z")
Hi Craig,
Sorry for the delay. In your CONFIG\_DIR/logging.yml, add `shield: TRACE` under the `logger:` section. The logging.yml file you mentioned in a previous post is only for the audit logs.
---
### Author:  [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)
#### Post date: [January 4, 2016, 6:02pm UTC](https://discuss.elastic.co/t/action-indices-data-read-mget-is-unauthorized-but-privilege-listed/37774/14 "2016-01-04T18:02:01Z")
Ok, got it thanks.
Now when I log in I get:
```
[timestamp][DEBUG][shield.authc.support] [servername] the roles [[cdfoote]], are mapped from the user [ldap] for realm [uid=cdfoote,...]
[timestamp][DEBUG][shield.authc.esusers] [servername] user not found in cache, proceeding with normal authentication
[timestamp][DEBUG][shield.authc.ldap] [servername] authenticated user [cdfoote], with roles [[cdfoote]]
[timestamp][INFO]rest.suppressed ] /_msearch Params: {ignore unavailable=true, preference=#, timeout=0}
ElasticsearchSecurityException[action [indices:data/read/msearch] is unauthorized for user [cdfoote]]
```
Additionally I've moved my blocks from the bottoms to the tops of both role\_mapping.yml and roles.yml.
It looks to me like the role mapping is working correctly, assigning my user account to the cdfoote role to which I've given the same privileges as the kibana4 role, including "indices:data/read/msearch". If I set the indices filter to \*, everything works, but when I set it to the desired systemname, I'm consistently getting this error. I'm at a loss, any ideas?
---
### Author:  [@jaymode](https://discuss.elastic.co/u/jaymode)
#### Post date: [January 4, 2016, 6:16pm UTC](https://discuss.elastic.co/t/action-indices-data-read-mget-is-unauthorized-but-privilege-listed/37774/15 "2016-01-04T18:16:27Z")
I believe you mentioned that you have audit logging enabled, is that correct? If so when you make a request that causes the exception can you grab the `access_denied` audit entry?
---
### Author:  [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)
#### Post date: [January 4, 2016, 6:19pm UTC](https://discuss.elastic.co/t/action-indices-data-read-mget-is-unauthorized-but-privilege-listed/37774/16 "2016-01-04T18:19:38Z")
Questions about editing shield's config files.
- In role\_mapping.yml, it seems you can use two syntaxes:
> ```
> cdfoote:
> - "uid=cdfoote,..."
>
> ```
or:
```
cdfoote: [
"uid=cdfoote,..."
]
```
Are they compatible within the one file or do you need to use one or the other?
- In roles.yml, similarly you can set privileges two ways:
`privileges: indices:admin/mappings/fields/get, admin/get, ...`
or:
```
privileges:
- indices:admin/mappings/fields/get
- admin/get
- ...
```
Are they compatible within the same file or do you have to choose one or the other?
- Does the number of spaces indenting child lines need to be consistent? Is two spaces OK?
- Does the order of the entries make a difference? Can a formatting error somewhere in a file cause earlier entries to work but later entries to fail?
---
### Author:  [@jaymode](https://discuss.elastic.co/u/jaymode)
#### Post date: [January 4, 2016, 6:22pm UTC](https://discuss.elastic.co/t/action-indices-data-read-mget-is-unauthorized-but-privilege-listed/37774/17 "2016-01-04T18:22:56Z")
> [@CraigFoote](#):
>
> Are they compatible within the one file or do you need to use one or the other?
You can use a mix of the two in the same file for both.
> [@CraigFoote](#):
>
> Does the number of spaces indenting child lines need to be consistent? Is two spaces OK?
I would go with consistent and 2 spaces are good.
> [@CraigFoote](#):
>
> Does the order of the entries make a difference?
Ordering should not matter.
> [@CraigFoote](#):
>
> Can a formatting error somewhere in a file cause earlier entries to work but later entries to fail?
The incorrectly formatted entries should be skipped with a log message warning of this and processing of other roles should continue.
---
### Author:  [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)
#### Post date: [January 4, 2016, 6:27pm UTC](https://discuss.elastic.co/t/action-indices-data-read-mget-is-unauthorized-but-privilege-listed/37774/18 "2016-01-04T18:27:30Z")
There are a lot and I cannot copy and paste (non-internet-connected machine). Is there something I should be looking for?
---
### Author:  [@jaymode](https://discuss.elastic.co/u/jaymode)
#### Post date: [January 4, 2016, 6:28pm UTC](https://discuss.elastic.co/t/action-indices-data-read-mget-is-unauthorized-but-privilege-listed/37774/19 "2016-01-04T18:28:59Z")
What indices are listed that access is being denied to?
---
### Author:  [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)
#### Post date: [January 4, 2016, 6:36pm UTC](https://discuss.elastic.co/t/action-indices-data-read-mget-is-unauthorized-but-privilege-listed/37774/20 "2016-01-04T18:36:43Z")
Actually there weren't that many, poor use of grep was all.
I see 4 access-denied messages for cdfoote, all from transport. Only one shows an index: ".marvel\_es-2016.01.04". The action in that message was "indices:data/read/search[phase/query+fetch]".
The others just state the action: "indices:data/read/msearch".
Oh yeah, I am currently getting no parsing errors when I touch both the files.
[Next page](https://discuss.elastic.co/t/action-indices-data-read-mget-is-unauthorized-but-privilege-listed/37774.md?page=2)