Can we use index pattern if we allow only alias in roles

Elastic Stack Elasticsearch
1

unable to query the data by using index patterns. just assume the index name is test-20210602-00001 and the alias is testing. role is

GET /_xpack/security/role/test?pretty
{
    "cluster": [],
    "indices": [
        {
            "names": ["testing"],
            "privileges": ["read","view_index_metadata"]
        }
    ]
}

able to search the document by using the alias name

curl http://hostname:9200/testing/_search?pretty

getting no documents when searching the doc by using index pattern

curl http://hostname:9200/test*/_search?pretty

is this expected behavior?

Elasticsearch version is 7.9.0 and created the role using role API.

2

That is not the expected behaviour, and I can't reproduce it.

Can you provide more details?

3

@TimV you can follow the steps to reproduce

Create the ROLE

curl -XPUT -H 'Content-Type: application/json' -k -u user:password 
https://hostname:9200/_xpack/security/role/test 
-d'{
"cluster": [],
"indices": [
    {"names": ["testing"],
    "privileges": ["read","view_index_metadata"]
    }
 ]
}'

Create the user

curl -XPUT -H 'Content-Type: application/json' -k -u user:password 
https://hostname:9200/_xpack/security/user/user_name 
-d'{
    "password": "password",
    "roles" : ["kibana_user","test"],
}'

Create index with alias

curl -XPUT -H 'Content-Type: application/json' -k -u user:password 
https://hostname:9200/failed-000001 
-d'{
"aliases": {
    "testing":{
        "is_write_index": true 
        }
    }
}'

Posting the doc

curl -XPOST -H 'Content-Type: application/json' -k -u user:password 
https://hostname:9200/testing/_doc 
-d'{
   "name": "test"
}'

able to search the data with alias name

GET testing/_search

but unable to query the data with index or index pattern

GET failed-000001/_search
Error is 
"reason" : "action [indices:data/read/search] is unauthorized..."

with index pattern getting no doc

GET failed*/_search
{
 "took" : 0,
 "timed_out" : false,
 "_shards" : {
  "total" : 0,
  "successful" : 0,
  "skipped" : 0,
  "failed" : 0
 },
 "hits" : {
  "total" : {
  "value" : 0,
  "relation" : "eq"
},
"max_score" : 0.0,
"hits" : [ ]
}

}

4

OK. That's expected behaviour (but it's not what your original post described).

If you grant access via an alias, then the user may only access the documents via that alias, they cannot access the index itself.

5

@TimV Thank you for the confirmation

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.