# Authentication role issues
**URL:** https://discuss.elastic.co/t/authentication-role-issues/94032
**Category:** Elasticsearch
**Created:** [July 20, 2017, 11:16pm UTC](https://discuss.elastic.co/t/authentication-role-issues/94032 "2017-07-20T23:16:51Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@Sannj](https://discuss.elastic.co/u/Sannj)
#### Post date: [July 20, 2017, 11:16pm UTC](https://discuss.elastic.co/t/authentication-role-issues/94032/1 "2017-07-20T23:16:51Z")
We are trying to use authentication roles to limit the data that is visible based on a value in that data.
It looks like Granted Documents Query is the best option to do so. We have created a new user role -
> {
> "random\_user": {
> "cluster": [
> "all"
> ],
> "indices": [
> {
> "names": [
> "\*",
> "customer"
> ],
> "privileges": [
> "all"
> ],
> "query": """{"term": {"company": "Google"}}"""
> }
> ],
> "run\_as": ,
> "metadata": {},
> "transient\_metadata": {
> "enabled": true
> }
> }
> }
However, whenever we try to login with these privileges we get -
`Unable to fetch mapping. Do you have indices matching the pattern? `
and if enter the index name, we get
`Could not locate that index-pattern (id: customer)`
and
`Config: Error 400 Bad Request: [security_exception] Can't execute an update request if field or document level security is enabled`.
When we define the role, if we select the proper index rather than `'*'` and then if we access the kibana page, it only shows the side bar and nothing else. Clicking on any options like `discover` or `visualize` doesn't load anything.
Does anyone how to fix this or can identify something that we are missing?
 
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [July 24, 2017, 3:34am UTC](https://discuss.elastic.co/t/authentication-role-issues/94032/2 "2017-07-24T03:34:24Z")
```auto
"indices": [
{
"names": ["*", "customer"],
"privileges": ["all"],
"query": """{"term": {"company": "Google"}}"""
}
],
```
You shouldn't do this.
There's 2 problems here:
1. You are applying _Document Level Security_ (DLS) to **all** indices (`names: *`) which is a problem. Kibana uses indices to store configuration and dashboards, and you are attempting to restriction the user to documents that have a `company` of `Google` (which won't be true for internal Kibana documents). If you want to use _DLS_ then you need to be very careful to only apply it to the correct indices.
2. You are using `privileges: all` with _DLS_. _Document Level Security_ is a _read-only_ feature. (See the "NOTE" at the top of [this page](https://www.elastic.co/guide/en/x-pack/current/field-and-document-access-control.html#field-and-document-access-control)) If you are assigning a _DLS_ query to an index pattern within a role, you should only grant `read` privileges to that index.
---
### Author:  [@Sannj](https://discuss.elastic.co/u/Sannj)
#### Post date: [July 24, 2017, 6:27pm UTC](https://discuss.elastic.co/t/authentication-role-issues/94032/3 "2017-07-24T18:27:29Z")
Hi Tim,
For,
1: As before if don't have \* in there, everything is just blank for the user. (see the first image)
2: It works if we do \* but otherwise if we select an index we get the following error.
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [July 25, 2017, 5:52am UTC](https://discuss.elastic.co/t/authentication-role-issues/94032/4 "2017-07-25T05:52:01Z")
Have you assigned the `kibana_user` role to the user that you're testing with?
The instructions for using Kibana with X-Pack security are here: [Kibana Guide [8.11] | Elastic](https://www.elastic.co/guide/en/x-pack/current/kibana.html)
Point 2 is:
> Assign the kibana\_user role to grant Kibana users the privileges they need to use Kibana.
---
### Author:  [@Sannj](https://discuss.elastic.co/u/Sannj)
#### Post date: [July 25, 2017, 4:30pm UTC](https://discuss.elastic.co/t/authentication-role-issues/94032/5 "2017-07-25T16:30:31Z")
Got it. That was the mistake I was making. Thank you so much. I missed adding 'kibana\_user'.
Thank you, Tim 🙂
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 22, 2017, 4:31pm UTC](https://discuss.elastic.co/t/authentication-role-issues/94032/6 "2017-08-22T16:31:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.