Index security in kibana

[Petr.Simik]

if the user does not have access to the index, no message is displayed (insufficient privileges).
but just doesn't display any data
which confuses my users, and they call me saying the data is missing.

This is a situation where I have the correct index pattern in Space , but the user role cannot access it.
I'm looking for a tip/hint to set Kibana in order it explains to the user that the reason they are not seeing any data is because of user permissions.
Thank you for the advice

[tiagocosta]

@azasypkin is this something we have planned to be working on or are you aware of a way to overcome this?

[azasypkin]

@azasypkin is this something we have planned to be working on or are you aware of a way to overcome this?

It's something that we need to improve for sure, but it might be a bit tricky since the general consensus in software security is to avoid information leakage and hence hide the difference between missing data and the data that users don't have access to (so that unauthorized users cannot figure out which indices exist based on the error message as it might be sensitive information).

Having said that, I think it'd make sense to expand the scope of Confusing user experience with limited Kibana permissions · Issue #133727 · elastic/kibana · GitHub to include limited ES permissions as well. Ideally users\admins shouldn't deal with "Kibana security" and "Elasticsearch security" separately, but it's a significant change that is currently at the brainstorming stage.

@Petr.Simik would you mind posting your use case (voting) on the issue I mentioned above? More real demand might help Global Experience team to prioritize this work.

Thanks,
Oleg

[Petr.Simik]

Thank you,
This confusion stems from the fact that access to the Elastic index is separate from the KIbana index pattern, which is unaware of the Elastic security underneath.
So the behavior actually makes sense.