# How to create custom privileges for Elasticsearch x-pack?
**URL:** https://discuss.elastic.co/t/how-to-create-custom-privileges-for-elasticsearch-x-pack/312097
**Category:** Elasticsearch
**Tags:** elastic-stack-security
**Created:** [August 15, 2022, 12:09pm UTC](https://discuss.elastic.co/t/how-to-create-custom-privileges-for-elasticsearch-x-pack/312097 "2022-08-15T12:09:50Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@WhatIsKibana](https://discuss.elastic.co/u/WhatIsKibana)
#### Post date: [August 15, 2022, 12:09pm UTC](https://discuss.elastic.co/t/how-to-create-custom-privileges-for-elasticsearch-x-pack/312097/1 "2022-08-15T12:09:50Z")
Hello everyone,
I'm using ELK stack 6.8, but I want to replace kibana with my own simple ui which will fit better for my case.
My app should contain user management, restrictions for operations (eg some users will be able only to read data from one index, some - from all indexes, some - read and write into indexes), so I want to keep x-pack for elasticsearch.
I've checked x-pack api for elasticsearch [X-Pack APIs | Elasticsearch Guide [6.8] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/6.8/xpack-api.html)
and I found that every user role should have a reference to existing privilege from privilege api.
While api is quite clear, body structure sometimes is not, so I have question in this regard:
What are all possible actions values for elasticsearch? From the doc I can see:
> actions
> (array-of-string) A list of action names that are granted by this privilege. This field must exist and cannot be an empty array.
I've tried to create my own privilege without any permissions
```auto
"no-priv": {
"application": "kibana-.kibana",
"name": "no-priv",
"actions": [
"some_dummy_action/"
],
"metadata": {}
},
```
and then I tried to make a simple search to elasticsearch directly to elasticsearch endpoint
`http://localhost:9200/my_index/_search`
with this role assigned to new user, but I got error
` action [indices:data/read/search] is unauthorized for user [test_user_no_priv]`
So, it is obvious, that I have to write "indices:data/read/search" in actions for my custom privelege "no-priv", but where can I find full list of all possible actions?
In default kibana's priveleges I can see different list of actions and probably all of them are managed by x-pack on kibana's side, not on elasticsearch.
---
### Author:  [@Justin\_Cranford](https://discuss.elastic.co/u/Justin_Cranford)
#### Post date: [August 15, 2022, 6:09pm UTC](https://discuss.elastic.co/t/how-to-create-custom-privileges-for-elasticsearch-x-pack/312097/2 "2022-08-15T18:09:07Z")
In a Role, the Global and Application Privilege parts are for external applications to define, configure and interpret.
For example, a bespoke GUI similar to Kibana may have features like Dashboards. An admin may give access to that Dashboard for some users, but not all. When rendering a GUI page, the GUI application can make Has Privilege API calls to see what parts to render, based on the Application Privileges written into Elasticsearch. Defining, configuring, and interpreting those Application Privileges is external to Elasticsearch.
If you multiplex Application privileges (external GUI) with Index privileges (Elasticsearch) into a single Role, your Application privileges are defined by you, and the Elasticsearch privileges are documented on each Elasticsearch APIs page. I don't think there is a central place to find a mapping of all Elasticsearch privileges to APIs.
To understand the Application Privileges API, you may get more context starting here.
> **[Defining roles | Elasticsearch Guide \[6.8\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/6.8/defining-roles.html)**
Note, I don't think 6.x is supported. Only 8.x and 7.x are supported. If you create a bespoke GUI, you may want to consider migrating to the latest version of Elasticsearch 8.x first. It is possible the latest Kibana has some features you are looking for, or you can submit enhancement requests.
---
### Author:  [@WhatIsKibana](https://discuss.elastic.co/u/WhatIsKibana)
#### Post date: [August 15, 2022, 8:49pm UTC](https://discuss.elastic.co/t/how-to-create-custom-privileges-for-elasticsearch-x-pack/312097/3 "2022-08-15T20:49:20Z")
@Justin_Cranford ok, thanks
I had a doubts, but it is more clear now. Also, I found this long read topic related to my question. I guess it can be useful if anyone will search for similar answer
>
>
> \*Original comment by @jaymode:\*
>
> In order to support security for other componen…ts of the stack, we will provide a primitive on the roles that exist in elasticsearch. This primitive is a new entry or entries alongside the current indices and cluster entries. The entries would contain an array of arbitrary string values.
>
> If other applications in the stack need the ability to get a view of the current user's combined privileges, we would need an API to render this combined view. When merging roles we should simply combine all of the lists.
Btw, my error happened not because of application permissions, but because of my test role didn't have native "read" permission for index. Those native permissions described here
> **[Security privileges | Elasticsearch Guide \[6.8\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/6.8/security-privileges.html#privileges-list-indices)**
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 12, 2022, 8:49pm UTC](https://discuss.elastic.co/t/how-to-create-custom-privileges-for-elasticsearch-x-pack/312097/4 "2022-09-12T20:49:45Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.