# Kibana 7.11 problems with spaces and roles -

**URL:** <https://discuss.elastic.co/t/kibana-7-11-problems-with-spaces-and-roles/265679>\
**Category:** Kibana\
**Tags:** elastic-stack-security\
**Created:** [February 27, 2021, 4:16am UTC](https://discuss.elastic.co/t/kibana-7-11-problems-with-spaces-and-roles/265679 "2021-02-27T04:16:49Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![byteandbit](https://avatars.discourse-cdn.com/v4/letter/b/f05b48/32.png) [@byteandbit](https://discuss.elastic.co/u/byteandbit)\
**Post date:** [February 27, 2021, 4:16am UTC](https://discuss.elastic.co/t/kibana-7-11-problems-with-spaces-and-roles/265679/1 "2021-02-27T04:16:49Z")

</div>

Hello,

We have created a new space just for read only user to access - Visibility in Analytics-\>Dashboard, Discover and Visualise.

 ![Screen Shot 2021-02-27 at 3.07.02 pm](https://us1.discourse-cdn.com/elastic/original/3X/2/3/235bde31b83d8b1576928538002de8d1908187d1.jpeg)

Then we created a new role within new space only, with read only privileges again for Analytics-\>Dashboard, Discover and Visualise. We did not assigned any Cluster privileges as we are just testing RBAC at this stage.

And then we created a new user and assigned new role to it.

For some reason when the new user logins to Kibana it can change the space to 'default' one with full access to everything.... On top of that within new space Management menu is available (along with Analytics one) with all submenus and again full access to write/read etc.

Is this a bug or we are doing something wrong?

We are running ELK 7.11 on k8s (self managed) on GCP.

Thanks,  
Bog

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [February 27, 2021, 6:01am UTC](https://discuss.elastic.co/t/kibana-7-11-problems-with-spaces-and-roles/265679/2 "2021-02-27T06:01:59Z")

</div>

Hmm It should work as you think. Just curious what license level are you running just Basic Right? pretty sure that should still work.

So this is what my 7.11.1 looks like

Role Definition: Note only my dashboard-external space at the bottom.  
I customized the space as well Just Dashboards

 ![Screen Shot 2021-02-26 at 9.49.42 PM](https://us1.discourse-cdn.com/elastic/original/3X/e/c/eceb1169dbf04085a46c15803e96a2816b29d884.png)

Here is my user definition note the only role.

 ![Screen Shot 2021-02-26 at 9.58.19 PM](https://us1.discourse-cdn.com/elastic/original/3X/3/5/35b5c88def302d4a48fe8ba1e4e2e881c145e2c3.png)

Now here is what mine looks like when I log in note the default space is not available.

 ![Screen Shot 2021-02-26 at 9.50.47 PM](https://us1.discourse-cdn.com/elastic/original/3X/7/4/749994e35780160330170e2bb9758f1ed1f2c824.png)

---

<div class="post-metadata">

**Author:** ![byteandbit](https://avatars.discourse-cdn.com/v4/letter/b/f05b48/32.png) [@byteandbit](https://discuss.elastic.co/u/byteandbit)\
**Post date:** [February 27, 2021, 10:32am UTC](https://discuss.elastic.co/t/kibana-7-11-problems-with-spaces-and-roles/265679/3 "2021-02-27T10:32:31Z")

</div>

Thank you for looking at this!

Yes we are running Basic license.

 ![Screen Shot 2021-02-27 at 9.31.51 pm](https://us1.discourse-cdn.com/elastic/original/3X/f/c/fca1ef61f89d265fd6a010d4126eb4282a51d6c9.png)

We have tried to delete new role, space and user and crate again but unfortunately keep getting the same problem (ability to select Default space and access to Stack Management menu).

Any suggestions how to troubleshoot it?

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [February 27, 2021, 3:53pm UTC](https://discuss.elastic.co/t/kibana-7-11-problems-with-spaces-and-roles/265679/4 "2021-02-27T15:53:27Z")

</div>

I was thinking for a moment that Basic would be the problem, but I just set up exactly the same using a Cluster I deployed with ECK (K8s) with a basic license and it worked just how I expected with a basic license.

What version I am using 7.11.1

One question are you actually logging completely out and then logging in with the new user... if you just switch between spaces while you are logged in as `elastic` user you will not see the role based control because it inherits the the `elastic` user privileges.

If still trouble please paste a complete view of the role creation. Notice I only have the one space then I went into that a specifically set the priviliges, it is kinda weird you set up what is available in the space under manage space then you refine it / do it again in the Kbana privileges during role creation.

 ![Screen Shot 2021-02-27 at 8.05.47 AM](https://us1.discourse-cdn.com/elastic/original/3X/d/5/d52ae127c8ed4e7a9ef7fd17ad6a426826effac5.png)

 ![Screen Shot 2021-02-27 at 8.07.10 AM](https://us1.discourse-cdn.com/elastic/original/3X/8/5/8532ffb16abb77e74e1831a365a15c7da1cbf0b9.jpeg)

 ![Screen Shot 2021-02-27 at 8.09.32 AM](https://us1.discourse-cdn.com/elastic/original/3X/4/4/444e50add9c86bec3cc92444f619463ccb071b05.png)

---

<div class="post-metadata">

**Author:** ![byteandbit](https://avatars.discourse-cdn.com/v4/letter/b/f05b48/32.png) [@byteandbit](https://discuss.elastic.co/u/byteandbit)\
**Post date:** [March 1, 2021, 12:11am UTC](https://discuss.elastic.co/t/kibana-7-11-problems-with-spaces-and-roles/265679/5 "2021-03-01T00:11:02Z")

</div>

Zone setting:

 ![Screen Shot 2021-03-01 at 10.56.31 am](https://us1.discourse-cdn.com/elastic/original/3X/4/c/4c9a91dbad6049eeaf691e2cc2890387d37b0e2a.png)

Rolle setting:

 ![Screen Shot 2021-03-01 at 11.00.57 am](https://us1.discourse-cdn.com/elastic/original/3X/0/e/0ed26f6808ca8b6eae82d21d60a2e2f560647c92.png)  
 ![Screen Shot 2021-03-01 at 11.00.28 am](https://us1.discourse-cdn.com/elastic/original/3X/3/b/3b45e2b3b8a85672e410fe5c660af535501f7306.png)

User setting:

 ![Screen Shot 2021-03-01 at 11.02.00 am](https://us1.discourse-cdn.com/elastic/original/3X/8/2/8231a2b65bbd913f7ff419ee1cc0dba3a21f38b4.png)

After User logins (see default space to chose from):

 ![Screen Shot 2021-03-01 at 11.03.59 am](https://us1.discourse-cdn.com/elastic/original/3X/8/a/8aee809ee9f31e0354666b9dedca9ac8d40699f4.png)

After switching space to new one, management menu is still visible.

 ![Screen Shot 2021-03-01 at 11.05.21 am](https://us1.discourse-cdn.com/elastic/original/3X/c/a/ca7dfaef2331c79f8504cc3d9dcce706109c6844.png)

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [March 1, 2021, 12:50am UTC](https://discuss.elastic.co/t/kibana-7-11-problems-with-spaces-and-roles/265679/6 "2021-03-01T00:50:11Z")

</div>

That is unusual...

What are you putting in for the index privileges in the role? What about cluster privileges?

 ![Screen Shot 2021-02-28 at 4.30.56 PM](https://us1.discourse-cdn.com/elastic/original/3X/7/8/782ec13643a0899cbe768fb641ba39727e5e9d08.png)

Are you integrated with some other SAML / Auth provider? How did you install?

Here is what mine looks like no stack management and no other spaces.

 ![Screen Shot 2021-02-28 at 4.43.09 PM](https://us1.discourse-cdn.com/elastic/original/3X/a/9/a9de16e75cf8235cab395799bb0f0383c750d84a.jpeg)

What I see your looks like is when I just change spaces without logging out, but I can see your "t" user in the top right.

Can you try logging in from a completely separate browser or incognito window? What Browser are you using?

 ![Screen Shot 2021-02-28 at 4.46.19 PM](https://us1.discourse-cdn.com/elastic/original/3X/8/9/89d4662173ae41f25c81d04f4972ec01db9855f1.jpeg)

---

<div class="post-metadata">

**Author:** ![byteandbit](https://avatars.discourse-cdn.com/v4/letter/b/f05b48/32.png) [@byteandbit](https://discuss.elastic.co/u/byteandbit)\
**Post date:** [March 1, 2021, 2:07am UTC](https://discuss.elastic.co/t/kibana-7-11-problems-with-spaces-and-roles/265679/7 "2021-03-01T02:07:52Z")

</div>

At this stage we did not configure any cluster privileges. Should we?

 ![Screen Shot 2021-03-01 at 12.59.30 pm](https://us1.discourse-cdn.com/elastic/original/3X/3/5/358c58082e8348db4c59ed1e5feb1d06bf86432c.png)

No we are not integrating with any 3rd party for Authentication.

As in my first post we are on k8s (self managed) on GCP, 7.11.1 ELK.

We are logging in in private window (FireFox) or Chrome (Incognito). In both cases exactly the same problem.

We are also behind Google Identity-Aware Proxy.

Thank you,  
Bog

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [March 1, 2021, 2:21am UTC](https://discuss.elastic.co/t/kibana-7-11-problems-with-spaces-and-roles/265679/8 "2021-03-01T02:21:04Z")

</div>

Can you show us two additional things:

1. the raw role definition
2. the user's privileges

For the role definition, go into Dev Tools / Console in Kibana (when logged in as your administration user, e.g. `elastic`) and run

```auto
GET /_security/role/test-role

```

That will show us exactly what this role can do, and will show us if something is out of place.

For the user's privileges, go into Dev Tools / Console as the `test` user (assuming that is possible - it sounds like in your case the user has access to Dev Tools, even though you don't want it to), and run

```auto
GET /_security/_authenticate

```

_and_

```auto
GET /_security/user/_privileges

```

Something isn't quite right here, and hopefully that information will pinpoint what it is, and then we can try and work out why it got into that state.

---

<div class="post-metadata">

**Author:** ![byteandbit](https://avatars.discourse-cdn.com/v4/letter/b/f05b48/32.png) [@byteandbit](https://discuss.elastic.co/u/byteandbit)\
**Post date:** [March 1, 2021, 3:04am UTC](https://discuss.elastic.co/t/kibana-7-11-problems-with-spaces-and-roles/265679/9 "2021-03-01T03:04:44Z")

</div>

As `elastic` user:

```auto
    GET /_security/role/test-role

    {
      "test-role" : {
        "cluster" : [],
        "indices" : [],
        "applications" : [
          {
            "application" : "kibana-.kibana",
            "privileges" : [
              "feature_discover.read",
              "feature_dashboard.read",
              "feature_visualize.read"
            ],
            "resources" : [
              "space:test-readonly"
            ]
          }
        ],
        "run_as" : [],
        "metadata" : { },
        "transient_metadata" : {
          "enabled" : true
        }
      }
    }

```

As `test` user and after switching to `default` space (to access Dev Tools):

```auto
     GET /_security/_authenticate 
        
      {
          "username" : "test",
          "roles" : [
            "test-role",
            "superuser"
          ],
          "full_name" : "",
          "email" : "",
          "metadata" : { },
          "enabled" : true,
          "authentication_realm" : {
            "name" : "default_native",
            "type" : "native"
          },
          "lookup_realm" : {
            "name" : "default_native",
            "type" : "native"
          },
          "authentication_type" : "realm"
        }

```

Strange why there is `superuser` role?

```auto
    GET /_security/user/_privileges

    {
      "cluster" : [
        "all"
      ],
      "global" : [],
      "indices" : [
        {
          "names" : [
            "*"
          ],
          "privileges" : [
            "all"
          ],
          "allow_restricted_indices" : true
        }
      ],
      "applications" : [
        {
          "application" : "*",
          "privileges" : [
            "*"
          ],
          "resources" : [
            "*"
          ]
        }
      ],
      "run_as" : [
        "*"
      ]
    }

```

Full privileges??

 ![Screen Shot 2021-03-01 at 2.03.18 pm](https://us1.discourse-cdn.com/elastic/original/3X/1/3/13826b0d82c8420bbf4c9554a6abe8e8f740fbc5.png)

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [March 1, 2021, 4:17am UTC](https://discuss.elastic.co/t/kibana-7-11-problems-with-spaces-and-roles/265679/10 "2021-03-01T04:17:06Z")

</div>

> [@byteandbit](#):
>
> Strange why there is `superuser` role?

You don't happen to have anonymous access turned on in Elasticsearch do you?

---

<div class="post-metadata">

**Author:** ![byteandbit](https://avatars.discourse-cdn.com/v4/letter/b/f05b48/32.png) [@byteandbit](https://discuss.elastic.co/u/byteandbit)\
**Post date:** [March 1, 2021, 4:56am UTC](https://discuss.elastic.co/t/kibana-7-11-problems-with-spaces-and-roles/265679/11 "2021-03-01T04:56:06Z")

</div>

Hmm I think we have?!

Here is our ES config:

```auto
cluster.name=csv-test
discovery.seed_hosts=es-cluster-0.elasticsearch
cluster.initial_master_nodes=es-cluster-0
ES_JAVA_OPTS=-Xms512m -Xmx512m
xpack.security.enabled=true
xpack.security.http.ssl.enabled=true
xpack.security.http.ssl.keystore.path=certs/http.p12
xpack.security.http.ssl.client_authentication=optional
xpack.security.authc.api_key.enabled=true
xpack.security.authc.token.enabled=false
xpack.security.authc.anonymous.username=agent
xpack.security.authc.anonymous.roles=superuser
ELASTIC_USERNAME=elastic
node.store.allow_mmap=false
xpack.security.transport.ssl.enabled=true
xpack.security.transport.ssl.verification_mode=certificate
xpack.security.transport.ssl.keystore.path=certs/elastic-certificates.p12
xpack.security.transport.ssl.truststore.path=certs/elastic-certificates.p12

```

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [March 1, 2021, 5:44am UTC](https://discuss.elastic.co/t/kibana-7-11-problems-with-spaces-and-roles/265679/12 "2021-03-01T05:44:59Z")

</div>

That explains it then.

One of the surprising features of anonymous access in Elasticsearch is that the roles listed in `xpack.security.authc.anonymous.roles` are added to _every user_, not just the anonymous user.

It is more accurate to think of them as "global roles" rather than "anonymous roles". I'm afraid that you will not be able to implement role based access control while also granting the `superuser` role to every user.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [March 1, 2021, 6:18am UTC](https://discuss.elastic.co/t/kibana-7-11-problems-with-spaces-and-roles/265679/13 "2021-03-01T06:18:16Z")

</div>

@TimV Thanks I learn something new everyday, put that in my knowledge base.

---

<div class="post-metadata">

**Author:** ![byteandbit](https://avatars.discourse-cdn.com/v4/letter/b/f05b48/32.png) [@byteandbit](https://discuss.elastic.co/u/byteandbit)\
**Post date:** [March 1, 2021, 6:48am UTC](https://discuss.elastic.co/t/kibana-7-11-problems-with-spaces-and-roles/265679/14 "2021-03-01T06:48:19Z")

</div>

Tanks Guys for the help.

I have disabled `xpack.security.authc.anonymous.roles` and now roles work as expected.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 29, 2021, 6:48am UTC](https://discuss.elastic.co/t/kibana-7-11-problems-with-spaces-and-roles/265679/15 "2021-03-29T06:48:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.