# CCR user permission issue. \[indices:admin/seq\_no/renew\_retention\_lease\] is unauthorized for user \[ccr\_user\] **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security, ccr-cross-cluster-replication\ **Created:** [June 22, 2021, 4:19pm UTC](https://discuss.elastic.co/t/ccr-user-permission-issue-indices-admin-seq-no-renew-retention-lease-is-unauthorized-for-user-ccr-user/276677 "2021-06-22T16:19:10Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Armen\_Petrosyan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/armen_petrosyan/32/80330_2.png) [@Armen\_Petrosyan](https://discuss.elastic.co/u/Armen_Petrosyan)\ **Post date:** [June 22, 2021, 4:19pm UTC](https://discuss.elastic.co/t/ccr-user-permission-issue-indices-admin-seq-no-renew-retention-lease-is-unauthorized-for-user-ccr-user/276677/1 "2021-06-22T16:19:10Z")
I have two clusters 7.7.1 deployed, tested CCR, using super user. Now I defined **ccr\_user** with two newly created roles (ccr\_leader, ccr\_follower), which I am using on both leader and follower clusters. Roles looks like below: ```auto ccr_leader: cluster: - read_ccr - monitor indices: - names: '*' privileges: - monitor - read ccr_follower: cluster: - manage_ccr - monitor indices: - names: '*' privileges: - monitor - read - write - manage_follow_index ``` Issue happens, when follower tries to replicate the data. Exception in logs that I see: ```auto [2021-06-22T18:41:29,967][WARN][o.e.x.c.a.ShardFollowTasksExecutor] [elasticsearch-1] [my_index][0] background management of retention lease [logging-elasticsearch/my_index/OtuNSHhqSuKJRGZcobw6tQ-following-leader_cluster2/my_index/RXo3DIJySPGMU62AbOMzRw] failed while following org.elasticsearch.ElasticsearchSecurityException: **action [indices:admin/seq_no/renew_retention_lease]** is unauthorized for user [ccr_user] at org.elasticsearch.xpack.core.security.support.Exceptions.authorizationError(Exceptions.java:34) ~[?:?] at org.elasticsearch.xpack.security.authz.AuthorizationService.denialException(AuthorizationService.java:597) ~[?:?] at org.elasticsearch.xpack.security.authz.AuthorizationService.access$300(AuthorizationService.java:92) ~[?:?] at org.elasticsearch.xpack.security.authz.AuthorizationService$AuthorizationResultListener.handleFailure(AuthorizationService.java:644) ~[?:?] at org.elasticsearch.xpack.security.authz.AuthorizationService$AuthorizationResultListener.onResponse(AuthorizationService.java:630) ~[?:?] at org.elasticsearch.xpack.security.authz.AuthorizationService$AuthorizationResultListener.onResponse(AuthorizationService.java:600) ~[?:?] at org.elasticsearch.action.support.ContextPreservingActionListener.onResponse(ContextPreservingActionListener.java:43) ~[elasticsearch-7.7.1.jar:7.7.1] ``` I found issue opened here - [CCR exception on retention lease renewal · Issue #61308 · elastic/elasticsearch · GitHub](https://github.com/elastic/elasticsearch/issues/61308) Don't sure where it is staying... So I have few questions: 1. Is it bug? 2. Is it fixed in other versions? 3. What permissions/priveleges I need to add to my roles? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [June 22, 2021, 11:26pm UTC](https://discuss.elastic.co/t/ccr-user-permission-issue-indices-admin-seq-no-renew-retention-lease-is-unauthorized-for-user-ccr-user/276677/2 "2021-06-22T23:26:12Z")
> [@Armen\_Petrosyan](#): > > two clusters 7.7.1 I don't know CCR well, but I would definitely recommend upgrading to 7.13, as latest, and trying again. There may or may not have been a fix, but it's always good to be running latest when possible. ---
**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\ **Post date:** [June 23, 2021, 12:01am UTC](https://discuss.elastic.co/t/ccr-user-permission-issue-indices-admin-seq-no-renew-retention-lease-is-unauthorized-for-user-ccr-user/276677/3 "2021-06-23T00:01:25Z")
Yes it is a bug and it is not fixed yet. For now you can work around this by either grant `manage` privilege or explicitly add the action name for the remote index, e.g.: ```auto ccr_leader: cluster: - read_ccr - monitor indices: - names: '*' privileges: - read - manage ``` ---
**Author:** ![Armen\_Petrosyan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/armen_petrosyan/32/80330_2.png) [@Armen\_Petrosyan](https://discuss.elastic.co/u/Armen_Petrosyan)\ **Post date:** [June 23, 2021, 5:34am UTC](https://discuss.elastic.co/t/ccr-user-permission-issue-indices-admin-seq-no-renew-retention-lease-is-unauthorized-for-user-ccr-user/276677/4 "2021-06-23T05:34:09Z")
manage permissions on leader role or on follower role ??? In my case I am assigning both roles to the same user but still I thought it is issue that follower does not have privilege's. ---
**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\ **Post date:** [June 23, 2021, 8:12am UTC](https://discuss.elastic.co/t/ccr-user-permission-issue-indices-admin-seq-no-renew-retention-lease-is-unauthorized-for-user-ccr-user/276677/5 "2021-06-23T08:12:31Z")
The privilege must be given to the role that is used on the leader cluster. You can read more about history rention [here](https://www.elastic.co/guide/en/elasticsearch/reference/7.13/index-modules-history-retention.html). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 21, 2021, 8:13am UTC](https://discuss.elastic.co/t/ccr-user-permission-issue-indices-admin-seq-no-renew-retention-lease-is-unauthorized-for-user-ccr-user/276677/6 "2021-07-21T08:13:07Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.