Grant permission to space is not effect

[messi655 (Tin Huynh)]

Hi,

My Elasticsearch is: 7.1.0
My Kibana is: 7.1.1
They are enabled xpack security and successful for some kind of role like kibana_dashboard_only_user

But my problem is:

• I create 2 Spaces (development and staging) and 2 users (development and staging) , I want only 1 user can see/access 1 Space (In each space I create private Dashboard with different bussiness requirement ) . I did follow https://www.elastic.co/blog/introducing-kibana-spaces-for-organization-and-security so grant permission . But now, my problem is user staging can access Space developemt. I don't want staging user access to development Space.

User permission image

staging roles

What am I wrong?

[lukeelmers]

If you want to control individual spaces in Kibana, do not use the kibana_user or kibana_dashboard_only_user roles. These roles were built before the spaces feature was introduced and gave the user read-only access to the entire .kibana index. So users with these roles are able to access all spaces in Kibana. Instead, create your own roles that grant access to specific spaces. More details on this can be found in the docs.

We have longer term plans to improve the user experience around this, so it's more obvious in the UI that these built-in roles cannot be locked down to a specific space.

[lukeelmers]

You may find this related thread to be helpful as well:

Kibana User Roles, kibana_dashboard_only and Limit Spaces?

The kibana_dashboard_only_user from the permissions perspective gives the user read-only access to all of Kibana. To have Kibana hide all of the other applications besides the Dashboards app, the Kibana advanced setting: xpackDashboardMode:roles should be configured to list this role so that all other applications are hidden. To create a new custom role which grants read-only access to a single space, you can use a cURL request similar to the following against the Kibana Role API curl -H "kbn-…