# Action \[indices:data/read/search\[phase/query\]\] is unauthorized for user \[kibana4\_server\]
**URL:** https://discuss.elastic.co/t/action-indices-data-read-search-phase-query-is-unauthorized-for-user-kibana4-server/61880
**Category:** Elasticsearch
**Tags:** elastic-stack-security
**Created:** [September 29, 2016, 11:15pm UTC](https://discuss.elastic.co/t/action-indices-data-read-search-phase-query-is-unauthorized-for-user-kibana4-server/61880 "2016-09-29T23:15:49Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@suanmeiguo](https://discuss.elastic.co/u/suanmeiguo)
#### Post date: [September 29, 2016, 11:15pm UTC](https://discuss.elastic.co/t/action-indices-data-read-search-phase-query-is-unauthorized-for-user-kibana4-server/61880/1 "2016-09-29T23:15:49Z")
I've installed shield on elasticsearch but not on kibana. And I configured kibana to use kibana4\_server user when talking to elasticsearch.
However when I go to kibana it still asks me username and password with a prompt window. When I login with kibana4\_server I got this error:
action [indices:data/read/search[phase/query]] is unauthorized for user [kibana4\_server]
Any help appreciated.
Here's my users\_role.yml file:
```auto
admin:admin
kibana4_server:kibana4_server,anonymous
user:user
```
Here's my roles.yml file:
```auto
# All cluster rights
# All operations on all indices
admin:
cluster:
- all
indices:
- names: '*'
privileges:
- all
# monitoring cluster privileges
# All operations on all indices
power_user:
cluster:
- monitor
indices:
- names: '*'
privileges:
- all
# Read-only operations on indices
user:
indices:
- names: '*'
privileges:
- read
# Defines the required permissions for transport clients
transport_client:
cluster:
- transport_client
# The required permissions for the kibana 4 server
kibana4_server:
cluster:
- monitor
indices:
- names: '*'
privileges:
- monitor
- view_index_metadata
- read
- indices:admin/mappings/fields/get
- indices:data/read/search[phase/query]
- indices:admin/validate/query
- indices:data/read/search
- indices:data/read/msearch
- indices:data/read/field_stats
- indices:admin/get
- names: '.kibana*'
privileges:
- all
- names: '.reporting-*'
privileges:
- all
# The required role for logstash users
logstash:
cluster:
- manage_index_templates
indices:
- names: 'logstash-*'
privileges:
- write
- read
- create_index
# Marvel user role. Assign to marvel users.
marvel_user:
indices:
- names: '.marvel-es-*'
privileges: ["read"]
- names: '.kibana'
privileges:
- view_index_metadata
- read
# Marvel remote agent role. Assign to the agent user on the remote marvel cluster
# to which the marvel agent will export all its data
remote_marvel_agent:
cluster: ["manage_index_templates"]
indices:
- names: '.marvel-es-*'
privileges: ["all"]
anonymous:
cluster:
- cluster:monitor/nodes/info
- cluster:monitor/health
indices:
'*':
- indices:admin/mappings/fields/get
- indices:admin/validate/query
- indices:data/read/search
- indices:data/read/msearch
- indices:admin/get
'.kibana':
- indices:admin/exists
- indices:admin/mappings/fields/get
- indices:admin/refresh
- indices:admin/validate/query
- indices:data/read/get
- indices:data/read/mget
- indices:data/read/search
```
---
### Author:  [@jaymode](https://discuss.elastic.co/u/jaymode)
#### Post date: [October 3, 2016, 1:28pm UTC](https://discuss.elastic.co/t/action-indices-data-read-search-phase-query-is-unauthorized-for-user-kibana4-server/61880/2 "2016-10-03T13:28:17Z")
The `kibana4_server` role is only for the kibana server to communicate with elasticsearch. You will still need to use a role that grants access to data in order to use Kibana, see [https://www.elastic.co/guide/en/shield/current/kibana.html#kibana](https://www.elastic.co/guide/en/shield/current/kibana.html#kibana)
---
### Author:  [@suanmeiguo](https://discuss.elastic.co/u/suanmeiguo)
#### Post date: [October 4, 2016, 5:46am UTC](https://discuss.elastic.co/t/action-indices-data-read-search-phase-query-is-unauthorized-for-user-kibana4-server/61880/3 "2016-10-04T05:46:44Z")
Ahh that makes more sense. Thank you.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 1:41pm UTC](https://discuss.elastic.co/t/action-indices-data-read-search-phase-query-is-unauthorized-for-user-kibana4-server/61880/4 "2017-07-06T13:41:45Z")