# LDAP roles + Grating access to a subset of data (Kibana 4)

**URL:** <https://discuss.elastic.co/t/ldap-roles-grating-access-to-a-subset-of-data-kibana-4/2025>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [June 5, 2015, 3:43pm UTC](https://discuss.elastic.co/t/ldap-roles-grating-access-to-a-subset-of-data-kibana-4/2025 "2015-06-05T15:43:37Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![matt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matt/32/524_2.png) [@matt](https://discuss.elastic.co/u/matt)\
**Post date:** [June 5, 2015, 3:43pm UTC](https://discuss.elastic.co/t/ldap-roles-grating-access-to-a-subset-of-data-kibana-4/2025/1 "2015-06-05T15:43:38Z")

</div>

Hi there,

We have a server farm belongs to various enterprise groups. As part of the security meassures, we want to limit certain users from accessing some parts of the centralized data.

Current Setup:

```
Server Grp A => Logstatsh appends server_grp:AAA => Central Elastic DB
Server Grp B => Logstatsh appends server_grp:BBB => Central Elastic DB
....
....
Server Grp N => Logstatsh appends server_grp:NNN => Central Elastic DB

```

LDAP User Groups:

```
UserGrp01 - Access to server_grp:AAA
UserGrp02 - Access to server_grp:BBB
UserGrp03 - Access to server_grp:AAA & BBB
UserGrp04 - Access to server_grp:BBB & NNN

```

Straight out of the box, can Shild be used to do this? Or do I have to write some wrapper module to do this.  
As it is right now, any user who gets authenticated gets access to all available logs.

Any help is much appreciated. Thanks!

MT

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [June 5, 2015, 4:34pm UTC](https://discuss.elastic.co/t/ldap-roles-grating-access-to-a-subset-of-data-kibana-4/2025/2 "2015-06-05T16:34:23Z")

</div>

Shield can out of the box control access to both indices and aliases, as well as cluster level operations. If your data goes into different indices, you can control access directly by index by assigning appropriate roles. If your events all share an index, you can instead create filtered aliases as a layer on top of the indices and control access using these instead.

Best regards,

Christian

---

<div class="post-metadata">

**Author:** ![matt](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matt/32/524_2.png) [@matt](https://discuss.elastic.co/u/matt)\
**Post date:** [June 5, 2015, 6:20pm UTC](https://discuss.elastic.co/t/ldap-roles-grating-access-to-a-subset-of-data-kibana-4/2025/3 "2015-06-05T18:20:33Z")

</div>

Thanks Christian,

Let me do some reading on that now. Thanks again for your help!

MT

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:49pm UTC](https://discuss.elastic.co/t/ldap-roles-grating-access-to-a-subset-of-data-kibana-4/2025/4 "2017-07-06T13:49:13Z")

</div>