# Kibana - hide space to user

**URL:** <https://discuss.elastic.co/t/kibana-hide-space-to-user/216223>\
**Category:** Kibana\
**Tags:** elastic-stack-security\
**Created:** [January 23, 2020, 11:15am UTC](https://discuss.elastic.co/t/kibana-hide-space-to-user/216223 "2020-01-23T11:15:08Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![Yannael](https://avatars.discourse-cdn.com/v4/letter/y/c37758/32.png) [@Yannael](https://discuss.elastic.co/u/Yannael)\
**Post date:** [January 23, 2020, 11:15am UTC](https://discuss.elastic.co/t/kibana-hide-space-to-user/216223/1 "2020-01-23T11:15:08Z")

</div>

Hello,  
I'm testing ELK stack in version 7.5.1, Basic licence. I would like to hide spaces to user who do not need access. I found document [here](https://www.elastic.co/guide/en/kibana/current/kibana-role-management.html) and also some topics about that. But I'm not able to get what I want!  
I have one space named "network". I create one role which has only access to the previous space, "dashboard" part. I create a user with the role juste created.  
When I connect with the user, I can see all spaces and have access to all menu.  
I don't know where I'm wrong. I'm wondering of this feature is included in Basci licence.

Any idea?

Many thanks for your help.  
Yannael

---

<div class="post-metadata">

**Author:** ![Fabio-sama](https://avatars.discourse-cdn.com/v4/letter/f/b9e5f3/32.png) [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)\
**Post date:** [January 23, 2020, 11:36am UTC](https://discuss.elastic.co/t/kibana-hide-space-to-user/216223/2 "2020-01-23T11:36:27Z")

</div>

Can you make couple of snapshots of what you're doing in the creating role and creating user parts?

---

<div class="post-metadata">

**Author:** ![Yannael](https://avatars.discourse-cdn.com/v4/letter/y/c37758/32.png) [@Yannael](https://discuss.elastic.co/u/Yannael)\
**Post date:** [January 23, 2020, 12:30pm UTC](https://discuss.elastic.co/t/kibana-hide-space-to-user/216223/3 "2020-01-23T12:30:53Z")

</div>

I tried to create as simple as possible to test access to space. So, I just create a namespace keeping default configuration. Then, I create a role like this:

 ![role-test-kib](https://us1.discourse-cdn.com/elastic/original/3X/d/1/d13e43c91728ba78d647257381ee977263454013.png)  
I create a user "test" with the role just created:  
 ![user-role](https://us1.discourse-cdn.com/elastic/original/3X/1/b/1b86df9110795a55217a6452d72cd9bc5684e085.png)  
Then, I connect to Kibana with this user and I can see all availables spaces:  
 ![list-space-available](https://us1.discourse-cdn.com/elastic/original/3X/9/6/96a7ed0b0fc91548ed3515ed8d9a71760c0b82ec.png)  
Am I missing something?  
Thanks,  
Yannaël

---

<div class="post-metadata">

**Author:** ![Fabio-sama](https://avatars.discourse-cdn.com/v4/letter/f/b9e5f3/32.png) [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)\
**Post date:** [January 23, 2020, 1:36pm UTC](https://discuss.elastic.co/t/kibana-hide-space-to-user/216223/4 "2020-01-23T13:36:33Z")

</div>

You didn't send screenshot of how you configured that `test` role.  
Can you paste here the result of the Dev Tools call  
`GET _security/role/test` ?

In order not to make any confusion, I suggest you first create a `test_role` role (`Management>Security>Roles>Create role`) giving it a name (`test_role`) access to the indices needed to see what's in the `network` space and, most importantly, a specific `space privilege` in this section.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/a/7/a744672cb6c7649fc11cdb535cf62b86efe3875a.png)

Then you create a user (`Management>Security>Users>Create user`) named `test_user` and assign to it the role `test_role` just created.

Did you follow these steps?

---

<div class="post-metadata">

**Author:** ![Yannael](https://avatars.discourse-cdn.com/v4/letter/y/c37758/32.png) [@Yannael](https://discuss.elastic.co/u/Yannael)\
**Post date:** [January 23, 2020, 2:00pm UTC](https://discuss.elastic.co/t/kibana-hide-space-to-user/216223/5 "2020-01-23T14:00:52Z")

</div>

Please, find below the result of the command:

```auto
{
  "test" : {
    "cluster" : [],
    "indices" : [
      {
        "names" : [
          "*fw*"
        ],
        "privileges" : [
          "all"
        ],
        "allow_restricted_indices" : false
      }
    ],
    "applications" : [
      {
        "application" : "kibana-.kibana",
        "privileges" : [
          "feature_discover.all",
          "feature_visualize.all",
          "feature_dashboard.all",
          "feature_dev_tools.all",
          "feature_advancedSettings.all",
          "feature_indexPatterns.all",
          "feature_savedObjectsManagement.all",
          "feature_graph.all",
          "feature_apm.all",
          "feature_maps.all",
          "feature_canvas.all",
          "feature_infrastructure.all",
          "feature_logs.all",
          "feature_siem.all",
          "feature_uptime.all"
        ],
        "resources" : [
          "space:network"
        ]
      }
    ],
    "run_as" : [],
    "metadata" : { },
    "transient_metadata" : {
      "enabled" : true
    }
  }
}
```

I already did what you suggest. But in doubt, I did it again.  
Role creation:

 ![2-create-role](https://us1.discourse-cdn.com/elastic/original/3X/7/d/7d681e6ce0d9d53ca75806811f14f3aa2dd6d54d.png)  
User creation:  
 ![2-create-user](https://us1.discourse-cdn.com/elastic/original/3X/4/d/4d959f5a568e047030ba5c7046192ef9e9c0038c.png)

Same result, this new user can see every spaces.  
Yannaël

---

<div class="post-metadata">

**Author:** ![Fabio-sama](https://avatars.discourse-cdn.com/v4/letter/f/b9e5f3/32.png) [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)\
**Post date:** [January 23, 2020, 3:02pm UTC](https://discuss.elastic.co/t/kibana-hide-space-to-user/216223/6 "2020-01-23T15:02:28Z")

</div>

It is pretty akward to be honest. I've downloaded a brand new version of Kibana and Elastic (7.5.1), added

```
xpack.security.enabled: true
xpack.security.transport.ssl.enabled: true

```

In the `elasticsearch.yml` and

```
elasticsearch.username: "elastic"
elasticsearch.password: "my_pw"

```

In the `kibana.yml`.  
Launched ES and Kibana, created a `testing_space` and get the `kibana_sample_data_ecommerce` data and visualizations/dashboards in it.

Then create a `test_role` role as follows:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/3/f3f8b644706ad71fdec69a66c9806a477a50db4e.png)

And when I try the `GET _security/role/test_role` call from Dev Tools it returns:

```
{
  "test_role" : {
    "cluster" : [],
    "indices" : [
      {
        "names" : [
          "kibana*"
        ],
        "privileges" : [
          "all"
        ],
        "allow_restricted_indices" : false
      }
    ],
    "applications" : [
      {
        "application" : "kibana-.kibana",
        "privileges" : [
          "space_all"
        ],
        "resources" : [
          "space:testing_space"
        ]
      }
    ],
    "run_as" : [],
    "metadata" : { },
    "transient_metadata" : {
      "enabled" : true
    }
  }
}

```

Finally I created a `test_user` user and assigned it that role.  
It works perfectly and when I log in with that user I can only see the `testing_space` space.

You sure you are not logged in with the superuser in another browser tab?

Cause if you open a tab and log in with the `test_user` and then open another tab and log in with the `admin` user, then going back to the previous tab a clicking on the spaces in the top left corner, it shows you the whole list, as if you were logged with the `admin` (which you are, in fact, but in another tab). In that case try refreshing the page and see if the user you're logged in with changes.

---

<div class="post-metadata">

**Author:** ![Yannael](https://avatars.discourse-cdn.com/v4/letter/y/c37758/32.png) [@Yannael](https://discuss.elastic.co/u/Yannael)\
**Post date:** [January 23, 2020, 3:32pm UTC](https://discuss.elastic.co/t/kibana-hide-space-to-user/216223/7 "2020-01-23T15:32:44Z")

</div>

Really strange... The goods news for me is it must work on this version on Basic licence. I'm installing a fresh cluster. Maybe I made too much tests on my previous! 😅

I use Firefox and I execute a private windows to make my test to be sure to not have a current session. I also tried with another web browser I never used. Same result.

Thanks for your time, I will try on a fresh install and let you know.

Yannaël

---

<div class="post-metadata">

**Author:** ![Yannael](https://avatars.discourse-cdn.com/v4/letter/y/c37758/32.png) [@Yannael](https://discuss.elastic.co/u/Yannael)\
**Post date:** [January 24, 2020, 9:39am UTC](https://discuss.elastic.co/t/kibana-hide-space-to-user/216223/8 "2020-01-24T09:39:19Z")

</div>

Hello,  
On a fresh installation, it's working fine. I don't yet what is wrong on the previous install. Thanks,  
Yannaël

---

<div class="post-metadata">

**Author:** ![Yannael](https://avatars.discourse-cdn.com/v4/letter/y/c37758/32.png) [@Yannael](https://discuss.elastic.co/u/Yannael)\
**Post date:** [January 24, 2020, 9:51am UTC](https://discuss.elastic.co/t/kibana-hide-space-to-user/216223/9 "2020-01-24T09:51:08Z")

</div>

For your knowledge, I found the problem in my first installation. Anonymous access was enabled. When I removed it, the privileges worked fine. My anonymous account get the role "kibana\_dashboard\_only\_user". It should mean that everyone get the role of the anonymous account ?!  
Yannael

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 21, 2020, 9:51am UTC](https://discuss.elastic.co/t/kibana-hide-space-to-user/216223/10 "2020-02-21T09:51:09Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.