# Authenticated user inherits anonymous users roles?

**URL:** <https://discuss.elastic.co/t/authenticated-user-inherits-anonymous-users-roles/100613>\
**Category:** Elasticsearch\
**Created:** [September 14, 2017, 10:01pm UTC](https://discuss.elastic.co/t/authenticated-user-inherits-anonymous-users-roles/100613 "2017-09-14T22:01:32Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Andy\_Hamilton](https://avatars.discourse-cdn.com/v4/letter/a/35a633/32.png) [@Andy\_Hamilton](https://discuss.elastic.co/u/Andy_Hamilton)\
**Post date:** [September 14, 2017, 10:01pm UTC](https://discuss.elastic.co/t/authenticated-user-inherits-anonymous-users-roles/100613/1 "2017-09-14T22:01:33Z")

</div>

We rolled out X-Pack to our Elasticsearch cluster after users were already actively using it. In order to lessen the burden on our end users, we approached the introduction of X-Pack as follows:

1. Enable the anonymous user with heightened privileges in the lower environments, which would allow the end users to continue to use the app without requiring any changes on their side.
2. Configure Authentication and RBAC
3. Work with end users to utilize credentials with potentially fewer privileges than the heightened anonymous user
4. Verify access controls with new user credentials
5. Disable anonymous access

However in testing out this approach, we discovered that authenticated user privileges are a union of the authenticated user and the anonymous user. This prevents us from discovering any privilege issues until we disable the anonymous user.

is this the expected behavior of combining anonymous and authenticated users? Is there a more graceful approach to rolling out and working through authorization requirements?

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [September 15, 2017, 4:32am UTC](https://discuss.elastic.co/t/authenticated-user-inherits-anonymous-users-roles/100613/2 "2017-09-15T04:32:51Z")

</div>

> [@Andy\_Hamilton](#):
>
> is this the expected behavior of combining anonymous and authenticated users?

Yes. For most users, it would be very confusing if they _lost_ access rights by logging in, relative to what they had when they were unauthenticated.  
The _anonymous_ role should be understood more like a _public_ role than an _unauthenticated_ role.

I don't have any great suggestions for you I'm afraid. If you're on a platinum license, then you might be able to get the result you want through a custom realm, but that's the only idea I can some up with for your situation.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 13, 2017, 4:32am UTC](https://discuss.elastic.co/t/authenticated-user-inherits-anonymous-users-roles/100613/3 "2017-10-13T04:32:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.