# Kibana and Shield: user read-only access to his index

**URL:** <https://discuss.elastic.co/t/kibana-and-shield-user-read-only-access-to-his-index/48909>\
**Category:** Kibana\
**Created:** [May 2, 2016, 4:21am UTC](https://discuss.elastic.co/t/kibana-and-shield-user-read-only-access-to-his-index/48909 "2016-05-02T04:21:11Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![vando](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vando/32/9508_2.png) [@vando](https://discuss.elastic.co/u/vando)\
**Post date:** [May 2, 2016, 4:21am UTC](https://discuss.elastic.co/t/kibana-and-shield-user-read-only-access-to-his-index/48909/1 "2016-05-02T04:21:11Z")

</div>

I'm using Kibana with Shield and I want to create read-only users that they can see only his respective index.

I created this role for `foo` user:

```auto
foo:
  indices:
    - names: 'foo-*'
      privileges:
        - indices:admin/mappings/fields/get
        - indices:admin/validate/query
    - names: '.kibana'
      privileges:
        - indices:data/read/get
        - indices:data/read/mget
        - indices:data/read/search

```

After logged-in, user gets an empty Kibana page, what am I doing wrong? Thanks in advance.

---

<div class="post-metadata">

**Author:** ![Bargs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bargs/32/5429_2.png) [@Bargs](https://discuss.elastic.co/u/Bargs)\
**Post date:** [May 2, 2016, 5:52pm UTC](https://discuss.elastic.co/t/kibana-and-shield-user-read-only-access-to-his-index/48909/2 "2016-05-02T17:52:53Z")

</div>

A few questions:

What version of Kibana/ES/Shield are you using? Are you using the Kibana Shield plugin?

Are you getting any error messages, either on the page or in your DevTools console?

Do you only want the data to be read only, or do you also want to prevent users from creating new visualizations, dashboards, saved searches, etc?

---

<div class="post-metadata">

**Author:** ![vando](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vando/32/9508_2.png) [@vando](https://discuss.elastic.co/u/vando)\
**Post date:** [May 2, 2016, 8:22pm UTC](https://discuss.elastic.co/t/kibana-and-shield-user-read-only-access-to-his-index/48909/3 "2016-05-02T20:22:05Z")

</div>

Hi Bargs

> [@Bargs](#):
>
> What version of Kibana/ES/Shield are you using? Are you using the Kibana Shield plugin?

- ES: 2.3.1
- Kibana: 4.5.0
- Shield (plugin installed from ES): 2.3.1

> [@Bargs](#):
>
> Do you only want the data to be read only, or do you also want to prevent users from creating new visualizations, dashboards, saved searches, etc?

I want the data being read-only and limit user access to other indices.

And I got this error message:

> Error: [security\_exception] action [indices:admin/mappings/fields/get] is unauthorized for user [foo]

---

<div class="post-metadata">

**Author:** ![Bargs](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bargs/32/5429_2.png) [@Bargs](https://discuss.elastic.co/u/Bargs)\
**Post date:** [May 2, 2016, 9:35pm UTC](https://discuss.elastic.co/t/kibana-and-shield-user-read-only-access-to-his-index/48909/4 "2016-05-02T21:35:59Z")

</div>

> I want the data being read-only and limit user access to other indices.

If you use [this example role](https://www.elastic.co/guide/en/shield/current/kibana.html#kibana4-user-role) as a base, I think that should achieve what you need. You'll just need to switch `logstash-*` to `foo-*` and remove the `cluster` section. Let me know if that doesn't work for some reason.

As an aside, you might also want to install the Kibana Shield plugin which will give you some additional functionality like a proper login screen.

---

<div class="post-metadata">

**Author:** ![vando](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vando/32/9508_2.png) [@vando](https://discuss.elastic.co/u/vando)\
**Post date:** [May 3, 2016, 2:19pm UTC](https://discuss.elastic.co/t/kibana-and-shield-user-read-only-access-to-his-index/48909/5 "2016-05-03T14:19:12Z")

</div>

This is what I wanted, thank you @Bargs!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:54pm UTC](https://discuss.elastic.co/t/kibana-and-shield-user-read-only-access-to-his-index/48909/6 "2017-07-06T13:54:28Z")

</div>