# Built-in superuser role grants access to Kibana despite UI saying it does not?

**URL:** <https://discuss.elastic.co/t/built-in-superuser-role-grants-access-to-kibana-despite-ui-saying-it-does-not/355417>\
**Category:** Kibana\
**Created:** [March 14, 2024, 2:56pm UTC](https://discuss.elastic.co/t/built-in-superuser-role-grants-access-to-kibana-despite-ui-saying-it-does-not/355417 "2024-03-14T14:56:31Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![sparrowt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sparrowt/32/47163_2.png) [@sparrowt](https://discuss.elastic.co/u/sparrowt)\
**Post date:** [March 14, 2024, 2:56pm UTC](https://discuss.elastic.co/t/built-in-superuser-role-grants-access-to-kibana-despite-ui-saying-it-does-not/355417/1 "2024-03-14T14:56:32Z")

</div>

I'm a bit confused and wondering if there is a UI bug, as well as perhaps clearer documentation.

On `/app/management/security/roles/edit/superuser` it says at the bottom:

> This role does not grant access to Kibana

However in practice, a user with _only_ the `superuser` role is in fact able to log in to Kibana and do anything they like.

Now it _makes sense_ in my head that a role named 'superuser' should be able to do this, but the Kibana UI when viewing that built-in non-editable role seems to be misleading / outright wrong?

Also perhaps the `superuser` section on [Built-in roles | Elasticsearch Guide [8.12] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/built-in-roles.html) should explicitly say that it is 'special' in some way and does grant all Kibana permissions (currently it only talks about all the _indices_ that it grants access to).

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [March 14, 2024, 3:08pm UTC](https://discuss.elastic.co/t/built-in-superuser-role-grants-access-to-kibana-despite-ui-saying-it-does-not/355417/2 "2024-03-14T15:08:55Z")

</div>

Hi @sparrowt Perfect question and yes a bit confusing ... perhaps the documents should be clearer

> [@sparrowt](#):
>
> I'm a bit confused and wondering if there is a UI bug, as well as perhaps clearer documentation.
> 
> On `/app/management/security/roles/edit/superuser` it says at the bottom:
> 
> > This role does not grant access to Kibana
> 
> However in practice, a user with _only_ the `superuser` role is in fact able to log in to Kibana and do anything they like.
> 
> Now it _makes sense_ in my head that a role named 'superuser' should be able to do this, but the Kibana UI when viewing that built-in non-editable role seems to be misleading / outright wrong?

What this is saying is that you can not use the `elastic` user in the `kibana.yml` to connect the kibana application to elasticsearch application that will not work.

in the `kibana.yml` you will notice the default is the proper

```auto
#elasticsearch.username: "kibana_system"
#elasticsearch.password: "pass"

```

so `kibana_system` is the correct user unlike in the past the `elastic` super user was used ... which was not as secure...

If you try to use the following it will fail.

`elasticsearch.username: "elastic"`

Hope that helps

---

<div class="post-metadata">

**Author:** ![sparrowt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sparrowt/32/47163_2.png) [@sparrowt](https://discuss.elastic.co/u/sparrowt)\
**Post date:** [March 15, 2024, 2:47pm UTC](https://discuss.elastic.co/t/built-in-superuser-role-grants-access-to-kibana-despite-ui-saying-it-does-not/355417/3 "2024-03-15T14:47:49Z")

</div>

I see (maybe?) though is that really the intention of the _role_ editor UI? I'm not configuring any native users or doing anything to do with the elastic\<=\>kibana connection, just using Elastic Cloud and looking at roles to be applied to SSO users.

I am simply viewing the _role_ named `superuser` and looking at what it says under the Kibana heading, which for other roles shows which spaces & actions are granted, or in the case of something like `watcher_user` it says the same thing: "This role does not grant access to Kibana" (which makes sense and is true in that case).

Whereas for ` /app/management/security/roles/edit/superuser` that same bit of UI says something that is just not true afaics - presumably the superuser role has special treatment in the code somewhere such that it nevertheless grants 'all' on all spaces?

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [March 15, 2024, 3:01pm UTC](https://discuss.elastic.co/t/built-in-superuser-role-grants-access-to-kibana-despite-ui-saying-it-does-not/355417/4 "2024-03-15T15:01:19Z")

</div>

I explained with the users are for above...

But now I see (sorry) you are talking about roles.... sorry

You are looking at:

 ![Screenshot 2024-03-15 at 8.29.36 AM](https://us1.discourse-cdn.com/elastic/original/3X/9/6/96257703f37c7bcc6f45f79a96c54b97fc09d53b.png)

 ![Screenshot 2024-03-15 at 8.29.41 AM](https://us1.discourse-cdn.com/elastic/original/3X/1/6/16b5c26ff2c8738f26a92a4d0a3e15dc554fcad6.png)

Yup that is confusing BUT if you simply run this in Kibana - Dev Tools

Login as the `elastic` user you will see this

```auto
GET _security/role/superuser
GET /_security/_authenticate
GET /_security/user/_privileges

```

You will get this.. and this shows that

```auto
# GET _security/role/superuser 200 OK
{
  "superuser": {
    "cluster": [
      "all"
    ],
    "indices": [
      {
        "names": [
          "*"
        ],
        "privileges": [
          "all"
        ],
        "allow_restricted_indices": false
      },
      {
        "names": [
          "*"
        ],
        "privileges": [
          "monitor",
          "read",
          "view_index_metadata",
          "read_cross_cluster"
        ],
        "allow_restricted_indices": true
      }
    ],
    "applications": [ << All Kibana Here
      {
        "application": "*", << All Kibana Here
        "privileges": [
          "*" << All Kibana Here
        ],
        "resources": [
          "*" << All Kibana Here
        ]
      }
    ],
    "run_as": [
      "*"
    ],
    "metadata": {
      "_reserved": true
    },
    "transient_metadata": {},
    "remote_indices": [
      {
        "names": [
          "*"
        ],
        "privileges": [
          "all"
        ],
        "allow_restricted_indices": false,
        "clusters": [
          "*"
        ]
      },
      {
        "names": [
          "*"
        ],
        "privileges": [
          "monitor",
          "read",
          "view_index_metadata",
          "read_cross_cluster"
        ],
        "allow_restricted_indices": true,
        "clusters": [
          "*"
        ]
      }
    ]
  }
}
# GET /_security/_authenticate 200 OK
{
  "username": "elastic",
  "roles": [
    "superuser"
  ],
  "full_name": null,
  "email": null,
  "metadata": {},
  "enabled": true,
  "authentication_realm": {
    "name": "found",
    "type": "file",
    "domain": "cloud-file"
  },
  "lookup_realm": {
    "name": "found",
    "type": "file",
    "domain": "cloud-file"
  },
  "authentication_type": "realm"
}
# GET /_security/user/_privileges 200 OK
{
  "cluster": [
    "all"
  ],
  "global": [],
  "indices": [
    {
      "names": [
        "*"
      ],
      "privileges": [
        "all"
      ],
      "allow_restricted_indices": false
    },
    {
      "names": [
        "*"
      ],
      "privileges": [
        "monitor",
        "read",
        "read_cross_cluster",
        "view_index_metadata"
      ],
      "allow_restricted_indices": true
    }
  ],
  "applications": [
    {
      "application": "*",
      "privileges": [
        "*"
      ],
      "resources": [
        "*"
      ]
    }
  ],
  "run_as": [
    "*"
  ],
  "remote_indices": [
    {
      "names": [
        "*"
      ],
      "privileges": [
        "all"
      ],
      "allow_restricted_indices": false,
      "clusters": [
        "*"
      ]
    },
    {
      "names": [
        "*"
      ],
      "privileges": [
        "monitor",
        "read",
        "read_cross_cluster",
        "view_index_metadata"
      ],
      "allow_restricted_indices": true,
      "clusters": [
        "*"
      ]
    }
  ]
}

```

So yeah why the UI says that... huh... not sure if I get a chance to find out I will let you know...

That said I would just move forward...

You can test

Create a users `mytest` assign it role `superuser` you will see you have all access to kibana.

I asked internally lets see if I get answer... you got me curious 😉

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [March 15, 2024, 11:59pm UTC](https://discuss.elastic.co/t/built-in-superuser-role-grants-access-to-kibana-despite-ui-saying-it-does-not/355417/5 "2024-03-15T23:59:46Z")

</div>

Asked internal...

> It’s a known, and unfortunately longstanding issue: [superuser role's Kibana privileges are inaccurate · Issue #106561 · elastic/kibana · GitHub](https://github.com/elastic/kibana/issues/106561)

---

<div class="post-metadata">

**Author:** ![sparrowt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sparrowt/32/47163_2.png) [@sparrowt](https://discuss.elastic.co/u/sparrowt)\
**Post date:** [March 18, 2024, 5:23pm UTC](https://discuss.elastic.co/t/built-in-superuser-role-grants-access-to-kibana-despite-ui-saying-it-does-not/355417/6 "2024-03-18T17:23:59Z")

</div>

Sorry yes I should've included a screenshot to start with.

Aha ok thanks - at least it is known.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 15, 2024, 5:24pm UTC](https://discuss.elastic.co/t/built-in-superuser-role-grants-access-to-kibana-despite-ui-saying-it-does-not/355417/7 "2024-04-15T17:24:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.