The elasticsearch log, as opposed to the access log, is showing what I believe is proper authentication:
[timestamp][DEBUG][shield.authc.support][servername][the roles[[cdfoote_role]], are mapped from the user [ldap] for realm [uid=cdfoote,.../ldap]
[timestamp][DEBUG][shield.authc.ldap ][servername][authenticated user [cdfoote, with roles [[cdfoote_role]]
ElasticsearchSecurityException[action [indices:data/read/msearch] is unauthorized for user [cdfoote]]
Can someone confirm this for me please?
I still don't know why the authorization error occurrs, I've granted cdfoote_role "indices:data/read/msearch".