# Document-level security query failing **URL:** \ **Category:** Elasticsearch\ **Created:** [February 2, 2017, 10:06pm UTC](https://discuss.elastic.co/t/document-level-security-query-failing/73763 "2017-02-02T22:06:01Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![jmcginty](https://avatars.discourse-cdn.com/v4/letter/j/e9bcb4/32.png) [@jmcginty](https://discuss.elastic.co/u/jmcginty)\ **Post date:** [February 2, 2017, 10:06pm UTC](https://discuss.elastic.co/t/document-level-security-query-failing/73763/1 "2017-02-02T22:06:01Z")
Hi, I want to add a document level filter that uses user metadata. My user metadata is defined as: "metadata": { "sids": [1,2,3] } } My role for the user is defined as: { "cluster": [ "all" ], "indices": [ { "names": [ "_" ], "privileges": [ "read" ], "query": {"term":{"securityIds":"{{\_user.metadata.sids}}}}"}} } ], "run\_as": [ "_" ], "metadata": {} } When I execute a query I get the error: failed to create query: { "term" : { "securityIds" : { "value" : "{{\_user.metadata.sids}}}}", "boost" : 1.0 } I've tried adding the {{#toJson}} as decribed here: > [@X-Pack Security : Role definition query template with 'terms'](https://discuss.elastic.co/t/x-pack-security-role-definition-query-template-with-terms/62790): > > Hi, I am evaluating Elastic 5 beta1 X-Pack document level security. I have user metadata object which has attribute 'groups'. The groups is a list of group names. Assume I have one user who has \_user.metadata.groups =["a","b"]. I try to write query template to generate below query: {"template":{"inline":{"terms":{"acl.groups":["a", "b"] }}}} My question is How do I pass variable \_user.metadata.groups as "acl.groups' field's value in the template? Another question about X-Pack security l… But that does work either. I know that he query works without the \_user variable because if I substitute a hard-code value it works, e.g. "query": {"term":{"securityIds":1}} I set up the query using filterWithHeader(..) to specify the user. Any ideas? Thanks. ---
**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\ **Post date:** [February 2, 2017, 10:24pm UTC](https://discuss.elastic.co/t/document-level-security-query-failing/73763/2 "2017-02-02T22:24:00Z")
Heya, I think the missing piece is the `template` object around the query, see the examples in the docs: [https://www.elastic.co/guide/en/x-pack/current/field-and-document-access-control.html#templating-role-query](https://www.elastic.co/guide/en/x-pack/current/field-and-document-access-control.html#templating-role-query) ---
**Author:** ![jmcginty](https://avatars.discourse-cdn.com/v4/letter/j/e9bcb4/32.png) [@jmcginty](https://discuss.elastic.co/u/jmcginty)\ **Post date:** [February 2, 2017, 10:33pm UTC](https://discuss.elastic.co/t/document-level-security-query-failing/73763/3 "2017-02-02T22:33:45Z")
Thank you! That makes \_user.metadata.sids resolve. But now it resolves \_user\_metadata.sids to a string-wrapped json value. The value in the actual user metadata is: "sids": [1,2,3] And the query error is: caused by: failed to create query: { "term" : { "securityIds" : { "value" : "[1,2,3]", "boost" : 1.0 } ---
**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\ **Post date:** [February 2, 2017, 10:50pm UTC](https://discuss.elastic.co/t/document-level-security-query-failing/73763/4 "2017-02-02T22:50:19Z")
I think you'll need to add the toJson into the query in the role ---
**Author:** ![jmcginty](https://avatars.discourse-cdn.com/v4/letter/j/e9bcb4/32.png) [@jmcginty](https://discuss.elastic.co/u/jmcginty)\ **Post date:** [February 2, 2017, 11:02pm UTC](https://discuss.elastic.co/t/document-level-security-query-failing/73763/5 "2017-02-02T23:02:14Z")
Thanks. I've tried it both ways and neither resolves to an array. 1. With "securityIds": "{{\_user.metadata.sids}}" the error is: caused by: failed to create query: { "term" : { "securityIds" : { "value" : "{0=1, 1=2, 2=3}", "boost" : 1.0 } 2. With "securityIds": "{{#toJson}}\_user.metadata.sids{{/toJson}}" the error is: caused by: failed to create query: { "term" : { "securityIds" : { "value" : "[1,2,3]", "boost" : 1.0 } 2 is almost correct, except that it's wrapped in a string. ---
**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\ **Post date:** [February 2, 2017, 11:12pm UTC](https://discuss.elastic.co/t/document-level-security-query-failing/73763/6 "2017-02-02T23:12:59Z")
I think the query needs to be defined as a string like this: ``` "query": "{\"template\":{\"inline\":\"{\"term\":{\"securityIds\": {{#toJson}}_user.metadata.sids{{/toJson}} }}\"}}" ``` ---
**Author:** ![jmcginty](https://avatars.discourse-cdn.com/v4/letter/j/e9bcb4/32.png) [@jmcginty](https://discuss.elastic.co/u/jmcginty)\ **Post date:** [February 2, 2017, 11:48pm UTC](https://discuss.elastic.co/t/document-level-security-query-failing/73763/7 "2017-02-02T23:48:34Z")
Thanks. With: "query": "{ "template":{"inline":"{"term":{"securityIds": {{#toJson}}\_user.metadata.sids{{/toJson}} }}"}} }" I get exception: aused by: [script] failed to parse object org.elasticsearch.common.xcontent.ObjectParser.apply(ObjectParser.java:186) org.elasticsearch.script.Script.parse(Script.java:322) org.elasticsearch.script.Script.parse(Script.java:231) org.elasticsearch.xpack.security.authz.accesscontrol.SecurityIndexSearcherWrapper.evaluateTemplate(SecurityIndexSearcherWrapper.java:317) org.elasticsearch.xpack.security.authz.accesscontrol.SecurityIndexSearcherWrapper.wrap(SecurityIndexSearcherWrapper.java:170) org.elasticsearch.index.shard.IndexSearcherWrapper.wrap(IndexSearcherWrapper.java:75) org.elasticsearch.index.shard.IndexShard.acquireSearcher(IndexShard.java:898) org.elasticsearch.search.SearchService.createSearchContext(SearchService.java:588) org.elasticsearch.search.SearchService.createContext(SearchService.java:547) ... caused by: Unexpected character ('t' (code 116)): was expecting comma to separate Object entries at [Source: org.elasticsearch.common.bytes.BytesReference$MarkSupportingStreamInputWrapper@5536ea; line: 1, column: 30] com.fasterxml.jackson.core.JsonParser.\_constructError(JsonParser.java:1702) com.fasterxml.jackson.core.base.ParserMinimalBase.\_reportError(ParserMinimalBase.java:558) com.fasterxml.jackson.core.base.ParserMinimalBase.\_reportUnexpectedChar(ParserMinimalBase.java:456) com.fasterxml.jackson.core.json.UTF8StreamJsonParser.nextToken(UTF8StreamJsonParser.java:761) org.elasticsearch.common.xcontent.json.JsonXContentParser.nextToken(JsonXContentParser.java:52) org.elasticsearch.common.xcontent.ObjectParser.parse(ObjectParser.java:157) org.elasticsearch.common.xcontent.ObjectParser.apply(ObjectParser.java:184) org.elasticsearch.script.Script.parse(Script.java:322) org.elasticsearch.script.Script.parse(Script.java:231) ... ---
**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\ **Post date:** [February 3, 2017, 12:54am UTC](https://discuss.elastic.co/t/document-level-security-query-failing/73763/8 "2017-02-03T00:54:38Z")
Sorry about that, I took this from a working test: ``` query: { "template": { "inline": "{\"terms\" : { \"securityIds\" : {{#toJson}}_user.metadata.sids{{/toJson}} } }" } } ``` ---
**Author:** ![jmcginty](https://avatars.discourse-cdn.com/v4/letter/j/e9bcb4/32.png) [@jmcginty](https://discuss.elastic.co/u/jmcginty)\ **Post date:** [February 3, 2017, 4:24pm UTC](https://discuss.elastic.co/t/document-level-security-query-failing/73763/9 "2017-02-03T16:24:33Z")
> [@jaymode](#): > > "inline": "{"terms" : { "securityIds" : {{#toJson}}\_user.metadata.sids{{/toJson}} } }" Hey Jay, that works - THANK YOU! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 3, 2017, 4:24pm UTC](https://discuss.elastic.co/t/document-level-security-query-failing/73763/10 "2017-03-03T16:24:52Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.