I want to create a user who has admin rights (search, read, write) access on testIndex index. For this, I created a role testIndex_admin (ref. kibana screenshot attached here) and assigned the new user this role.
However after the user logs in he only see an empty screen with a "Help us improve the Elastic Stack by providing basic feature usage statistics?" popup. On the browser console I found the following request being made which failed with 403 error.
Request URL: http://localhost:5601/api/saved_objects/_find?type=index-pattern&per_page=10000
{
"message": "action [indices:data/read/search] is unauthorized for user [user01]: [security_exception] action [indices:data/read/search] is unauthorized for user [user01]",
"statusCode": 403,
"error": "Forbidden"
}
Also there is a "Advanced Setting Error" popup that appears (give below)
What can be done so that the user can access only his testIndex with all permission to it?
Few portions of log that was generated before login when http://localhost:5601 was visited :
log [11:34:43.343] [debug][plugin] Checking Elasticsearch version
log [11:34:45.854] [debug][plugin] Checking Elasticsearch version
ops [11:34:46.256] memory: 110.1MB uptime: 0:01:43 load: [0.00 0.00 0.00] delay: 3.243
log [11:34:46.261] [debug][kibana-monitoring][monitoring-ui] Received Kibana Ops event data
error [11:34:47.457] [debug][auth][security][session] Error: Unauthorized
at validate (C:\Program Files\Elastic\kibana\6.3.2\node_modules\hapi-auth-cookie\lib\index.js:145:49)
at Object.authenticate (C:\Program Files\Elastic\kibana\6.3.2\node_modules\hapi-auth-cookie\lib\index.js:210:13)
at module.exports.internals.Auth.internals.Auth.test (C:\Program Files\Elastic\kibana\6.3.2\node_modules\hapi\lib\auth.js:96:22)
at Object.test (C:\Program Files\Elastic\kibana\6.3.2\node_modules\hapi\lib\plugin.js:65:64)
at resolve (C:/Program Files/Elastic/kibana/6.3.2/node_modules/x-pack/plugins/security/server/lib/authentication/session.js:56:25)
at new Promise ()
at Session.get (C:/Program Files/Elastic/kibana/6.3.2/node_modules/x-pack/plugins/security/server/lib/authentication/session.js:55:12)
at Authenticator.authenticate (C:/Program Files/Elastic/kibana/6.3.2/node_modules/x-pack/plugins/security/server/lib/authentication/authenticator.js:137:49)
at Object.server.expose.request [as authenticate] (C:/Program Files/Elastic/kibana/6.3.2/node_modules/x-pack/plugins/security/server/lib/authentication/authenticator.js:277:60)
at handler (C:/Program Files/Elastic/kibana/6.3.2/node_modules/x-pack/plugins/security/server/routes/api/v1/authenticate.js:30:68)
at Object.internals.handler (C:\Program Files\Elastic\kibana\6.3.2\node_modules\hapi\lib\handler.js:96:36)
at request._protect.run (C:\Program Files\Elastic\kibana\6.3.2\node_modules\hapi\lib\handler.js:30:23)
at module.exports.internals.Protect.internals.Protect.run (C:\Program Files\Elastic\kibana\6.3.2\node_modules\hapi\lib\protect.js:64:5)
at exports.execute (C:\Program Files\Elastic\kibana\6.3.2\node_modules\hapi\lib\handler.js:24:22)
at each (C:\Program Files\Elastic\kibana\6.3.2\node_modules\hapi\lib\request.js:384:16)
at iterate (C:\Program Files\Elastic\kibana\6.3.2\node_modules\items\lib\index.js:36:13)
at done (C:\Program Files\Elastic\kibana\6.3.2\node_modules\items\lib\index.js:28:25)
at postValidate (C:\Program Files\Elastic\kibana\6.3.2\node_modules\hapi\lib\validation.js:68:20)
at internals.Object._validateWithOptions (C:\Program Files\Elastic\kibana\6.3.2\node_modules\hapi\node_modules\joi\lib\any.js:604:20)
at module.exports.internals.Any.root.validate (C:\Program Files\Elastic\kibana\6.3.2\node_modules\hapi\node_modules\joi\lib\index.js:105:23)
at Object.internals.input (C:\Program Files\Elastic\kibana\6.3.2\node_modules\hapi\lib\validation.js:137:20)
at exports.payload (C:\Program Files\Elastic\kibana\6.3.2\node_modules\hapi\lib\validation.js:42:22)
log [11:34:47.486] [debug][basic][security] Trying to authenticate user request to /api/security/v1/login.
log [11:34:47.486] [debug][basic][security] Trying to authenticate via header.
log [11:34:47.571] [debug][basic][security] Request has been authenticated via header.
respons [11:34:47.445] POST /api/security/v1/login 200 139ms - 9.0B
log [11:34:47.596] [debug][basic][security] Trying to authenticate user request to /.
log [11:34:47.597] [debug][basic][security] Trying to authenticate via header.
log [11:34:47.601] [debug][basic][security] Authorization header is not presented.
log [11:34:47.603] [debug][basic][security] Trying to authenticate via state.
log [11:34:47.606] [debug][basic][security] Request has been authenticated via state.
respons [11:34:47.592] GET / 200 28ms - 9.0B
Another observation
For the new role, I tried, passing the Index name and also the Index pattern but both didn't work. But when I tired * it worked. But that was not my intension as with the * the user can work on any index.
do you mean the new user should be given multiple roles
Yes, The kibana_user role grants access to the resources that are required when using Kibana.
You need to grant that role, and whatever additional roles your require in order to get access to the data itself.
I tried, passing the Index name and also the Index pattern but both didn't work
Happy to help debug this, but you'll need to provide a bit more detail - "didn't work" is too abiguous to do much about.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.
