# Action unauthorized for user

**URL:** <https://discuss.elastic.co/t/action-unauthorized-for-user/255065>\
**Category:** Kibana\
**Created:** [November 11, 2020, 1:15pm UTC](https://discuss.elastic.co/t/action-unauthorized-for-user/255065 "2020-11-11T13:15:37Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Samir\_Said](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/samir_said/32/77430_2.png) [@Samir\_Said](https://discuss.elastic.co/u/Samir_Said)\
**Post date:** [November 11, 2020, 1:15pm UTC](https://discuss.elastic.co/t/action-unauthorized-for-user/255065/1 "2020-11-11T13:15:37Z")

</div>

I have created a user using:  
Stack Management / Users  
and added roles: **kibana\_admin, kibana\_system**  
however, the user got error when tried to run queury:

```auto
{
  "error" : {
    "root_cause" : [
      {
        "type" : "security_exception",
        "reason" : "action [indices:data/read/search] is unauthorized for user [ekhlass]"
      }
    ],
    "type" : "security_exception",
    "reason" : "action [indices:data/read/search] is unauthorized for user [ekhlass]"
  },
  "status" : 403
}

```

Kindly advice.

---

<div class="post-metadata">

**Author:** ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\
**Post date:** [November 11, 2020, 1:23pm UTC](https://discuss.elastic.co/t/action-unauthorized-for-user/255065/2 "2020-11-11T13:23:58Z")

</div>

@Samir_Said Welcome!

You need to create a role that gives that user access to that functionality. Then assign that new role to the user.

Kibana Admin - Has no read/write/search on any index privileges.  
Kibana System - Has access to system indexes but if you see below it doesn't give read/write/search to `*`.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/d/ed0a83bf9b7ec47f0ed3d65b70a2d71988f11345.png)

The role you probably want is below. But you can restrict access to certain indicies and privileges.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/0/a05cacc3a776ae8394cc845c81550a2a025610ae.png)

---

<div class="post-metadata">

**Author:** ![Samir\_Said](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/samir_said/32/77430_2.png) [@Samir\_Said](https://discuss.elastic.co/u/Samir_Said)\
**Post date:** [November 11, 2020, 1:50pm UTC](https://discuss.elastic.co/t/action-unauthorized-for-user/255065/3 "2020-11-11T13:50:41Z")

</div>

Thank you for help, I have fixed the issue.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 9, 2020, 1:50pm UTC](https://discuss.elastic.co/t/action-unauthorized-for-user/255065/4 "2020-12-09T13:50:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.