# Checking if a User Has a Specific Role in Node.js with Elasticsearch ClusterClient

**URL:** <https://discuss.elastic.co/t/checking-if-a-user-has-a-specific-role-in-node-js-with-elasticsearch-clusterclient/355236>\
**Category:** Kibana\
**Tags:** kibana-plugin-development\
**Created:** [March 12, 2024, 2:16pm UTC](https://discuss.elastic.co/t/checking-if-a-user-has-a-specific-role-in-node-js-with-elasticsearch-clusterclient/355236 "2024-03-12T14:16:54Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![bertugmete](https://avatars.discourse-cdn.com/v4/letter/b/d26b3c/32.png) [@bertugmete](https://discuss.elastic.co/u/bertugmete)\
**Post date:** [March 12, 2024, 2:16pm UTC](https://discuss.elastic.co/t/checking-if-a-user-has-a-specific-role-in-node-js-with-elasticsearch-clusterclient/355236/1 "2024-03-12T14:16:54Z")

</div>

I'm trying to check if a user has a specific role using the following Node.js function. However, the `clusterClient.asInternalUser.security.getUser()` function returns information about all users in Kibana. My goal is to obtain the roles of the logged-in user.

```auto
const checkUserRole = (router, clusterClient) => {
  router.post(
    {
      path: '/api/check-user-role',
      validate: false,
    },
    async (context, request, response) => {
      try {
        // Using getUser function to retrieve user information
        const user = await clusterClient.asInternalUser.security.getUser();

        // Check if the user has a specific role
        if (user && user.roles && user.roles.includes('X')) {
          return response.ok({ body: { hasRole: true } });
        } else {
          return response.ok({ body: { hasRole: false } });
        }
      } catch (error) {
        return response.badRequest({ body: { message: error.message } });
      }
    }
  );
};

```

Is this function correctly checking if the user has a specific role? What would be the best approach to retrieve logged-in user information? Any suggestions would be appreciated. We have basic version.Thank you!

---

<div class="post-metadata">

**Author:** ![tsullivan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tsullivan/32/31077_2.png) [@tsullivan](https://discuss.elastic.co/u/tsullivan)\
**Post date:** [March 19, 2024, 8:58pm UTC](https://discuss.elastic.co/t/checking-if-a-user-has-a-specific-role-in-node-js-with-elasticsearch-clusterclient/355236/2 "2024-03-19T20:58:18Z")

</div>

This route handler will not check if the currently-logged in user has the `X` role. I believe that will check against the user specified in the `elasticsearch.user` setting kibana.yml.

**Note:** checking if the currently-logged in user belongs to specific role will not work when using some kinds of authentication, specifically API keys. If the user with the `X` role creates an API key, when using that API key the role will not be found. This is because API keys are encoded with the privileges that the roles offer at the time the key was created, and the key doesn't have information about the names of the roles that gave those privileges. To work around that, consider using the Kibana Application Privilege model instead.

For more on the Kibana Application Privilege model, see:

- [https://www.elastic.co/guide/en/kibana/current/kibana-privileges.html](https://www.elastic.co/guide/en/kibana/current/kibana-privileges.html)
- [https://www.elastic.co/guide/en/kibana/current/development-security.html#development-rbac-privileges](https://www.elastic.co/guide/en/kibana/current/development-security.html#development-rbac-privileges)

To determine if the currently logged in user has a literal specific role, try a snipped like this:

```typescript
import type { AuthenticatedUser, IRouter, RequestHandlerContext } from '@kbn/core/server';

const REQUIRED_ROLE = 'X';

async function getUser(context: RequestHandlerContext): Promise<AuthenticatedUser | null> {
  const security = (await context.core).security;
  return security.authc.getCurrentUser();
}

export function defineRoutes(router: IRouter) {
  router.post(
    {
      path: '/api/check-user-role',
      validate: false,
    },
    async (context, request, response) => {
      let hasRole: boolean | null = null; // if the Security plugin is disabled, the value will remain `null`
      const user = await getUser(context);
      if (user) {
        hasRole = user.roles.includes(REQUIRED_ROLE);
      }

      return response.ok({
        body: {
          has_role: hasRole,
        },
      });
    }
  );
}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 16, 2024, 8:58pm UTC](https://discuss.elastic.co/t/checking-if-a-user-has-a-specific-role-in-node-js-with-elasticsearch-clusterclient/355236/3 "2024-04-16T20:58:43Z")

</div>

Closed on April 16, 2024, 8:58pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.