# Document level security not behaving as expected **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [October 11, 2022, 10:49am UTC](https://discuss.elastic.co/t/document-level-security-not-behaving-as-expected/316320 "2022-10-11T10:49:38Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![iaata](https://avatars.discourse-cdn.com/v4/letter/i/b77776/32.png) [@iaata](https://discuss.elastic.co/u/iaata)\ **Post date:** [October 11, 2022, 10:49am UTC](https://discuss.elastic.co/t/document-level-security-not-behaving-as-expected/316320/1 "2022-10-11T10:49:38Z")
Hello. I am trying to setup document level security for a single index. My goal is to restrict access to documents in a way, where users only have access to the documents where their username match a field in the document. After logging into the newly created users, I am expecting to only see documents related to that user. However, I receive all documents. I am currently using a trial license. My license: ```auto { "license": { "status": "active", "uid": "68d47d6b-e629-4cf6-b882-f2fc4ecae7a2", "type": "trial", "issue_date": "2022-10-07T11:12:25.839Z", "issue_date_in_millis": 1665141145839, "expiry_date": "2022-11-06T11:12:25.839Z", "expiry_date_in_millis": 1667733145839, "max_nodes": 1000, "max_resource_units": null, "issued_to": "elasticsearch", "issuer": "elasticsearch", "start_date_in_millis": -1 } } ``` **Here is my (very simple) approach:** First, I create an index. Let's call it "abc\_index": ```auto PUT abc_index { "mappings" : { "properties" : { "body" : { "type" : "text" }, "user" : { "type" : "text" } } } } ``` Response: ```auto { "acknowledged": true, "shards_acknowledged": true, "index": "abc_index" } ``` Then, I create three documents. Two belonging to "jimmy" and one belonging to "thomas": ```auto PUT abc_index/_doc/1 { "user": "jimmy", "body": "This is a document written by Jimmy :)" } PUT abc_index/_doc/2 { "user": "jimmy", "body": "This is another document written by Jimmy :-(" } PUT abc_index/_doc/3 { "user": "thomas", "body": "THIS DOCUMENT IS THOMAS' PRIVATE DOCUMENT DO NOT READ" } ``` Response of all 3 queries above (note that I have altered \_id to reflect the individual runs): ```auto { "_index": "abc_index", "_id": "<1/2/3>", "_version": 1, "result": "created", "_shards": { "total": 2, "successful": 1, "failed": 0 }, "_seq_no": 2, "_primary_term": 1 } ``` Now I want to create a role for users to restrict their access to documents related to them. For simplicity's sake, let's create a role that will show only results belonging to jimmy and assign jimmy to that role: > Note: I've done the following based on [this](https://www.elastic.co/guide/en/x-pack/current/field-and-document-access-control.html#document-level-security). ```auto POST /_security/role/abc_role { "indices": [ { "names": ["abc_*"], "privileges": ["read"], "query": "{\"match\": {\"user\": \"jimmy\"}}" } ] } ``` Result: ```auto { "role": { "created": true } } ``` ... Then create the "jimmy" user with the new role: ```auto PUT /_security/user/jimmy { "username": "jimmy", "password":"test1234", "roles": ["abc_role", "viewer"], "full_name": "Jimmy Neutron", "email": "Jimmy@Neutron.com" } ``` Result: ```auto { "created": true } ``` Now, after logging into the newly created "jimmy" account, I should expect to only get document 1 and 2, belonging to jimmy. However, I get the following result: ```auto GET abc_index/_search ``` Result: ```auto { "took": 0, "timed_out": false, "_shards": { "total": 1, "successful": 1, "skipped": 0, "failed": 0 }, "hits": { "total": { "value": 3, "relation": "eq" }, "max_score": 1, "hits": [ { "_index": "abc_index", "_id": "1", "_score": 1, "_source": { "user": "jimmy", "body": "This is a document written by Jimmy :)" } }, { "_index": "abc_index", "_id": "2", "_score": 1, "_source": { "user": "jimmy", "body": "This is another document written by Jimmy :-(" } }, { "_index": "abc_index", "_id": "3", "_score": 1, "_source": { "user": "thomas", "body": "THIS DOCUMENT IS THOMAS' PRIVATE DOCUMENT DO NOT READ" } } ] } } ``` Trying the following yields the expected result: ```auto GET abc_index/_search { "query": { "match": { "user": "jimmy" } } } ``` Result: ```auto { "took": 2, "timed_out": false, "_shards": { "total": 1, "successful": 1, "skipped": 0, "failed": 0 }, "hits": { "total": { "value": 2, "relation": "eq" }, "max_score": 0.4700036, "hits": [ { "_index": "abc_index", "_id": "1", "_score": 0.4700036, "_source": { "user": "jimmy", "body": "This is a document written by Jimmy :)" } }, { "_index": "abc_index", "_id": "2", "_score": 0.4700036, "_source": { "user": "jimmy", "body": "This is another document written by Jimmy :-(" } } ] } } ``` ... What am I missing? Cleary, I must be misunderstanding something. If so, please let me know. I've searched around a lot and I have tried numerous things but nothing has worked for me. Based on [this](https://discuss.elastic.co/t/x-pack-document-level-filtering-not-operating-as-expected/134497/13) thread, I thought it might have something to do with role permissions being overwritten or something similar, but I was unable to find anything that indicated that this was the issue. I am fearly new to all of this so any help is greatly appreciated. Thanks. ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [October 11, 2022, 11:02am UTC](https://discuss.elastic.co/t/document-level-security-not-behaving-as-expected/316320/2 "2022-10-11T11:02:38Z")
> [@iaata](#): > > `"roles": ["abc_role", "viewer"],` The built in `viewer` role gives access to all indices, so overrides the more restrictive access in your `abc_role`. ---
**Author:** ![iaata](https://avatars.discourse-cdn.com/v4/letter/i/b77776/32.png) [@iaata](https://discuss.elastic.co/u/iaata)\ **Post date:** [October 11, 2022, 11:16am UTC](https://discuss.elastic.co/t/document-level-security-not-behaving-as-expected/316320/3 "2022-10-11T11:16:42Z")
Hello @Christian_Dahlqvist Thank you so much for your response. This was indeed the issue. After creating the user with only the "abc\_role", I was able to get only the documents related to Jimmy. Originally I added the viewer role to the user to enable access to the interface, so the user could inspect data from there. When using curl, I get the expected result. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 8, 2022, 11:16am UTC](https://discuss.elastic.co/t/document-level-security-not-behaving-as-expected/316320/4 "2022-11-08T11:16:47Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.