# No .kibana privilege on Kibana UI?

**URL:** <https://discuss.elastic.co/t/no-kibana-privilege-on-kibana-ui/71684>\
**Category:** Kibana\
**Created:** [January 16, 2017, 7:07am UTC](https://discuss.elastic.co/t/no-kibana-privilege-on-kibana-ui/71684 "2017-01-16T07:07:13Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![YuWatanabe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuwatanabe/32/13259_2.png) [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)\
**Post date:** [January 16, 2017, 7:07am UTC](https://discuss.elastic.co/t/no-kibana-privilege-on-kibana-ui/71684/1 "2017-01-16T07:07:13Z")

</div>

**Environement**  
Kibana 5.1.2  
x-pack 5.1.2

Newly created role requires .kibana index access when search is done through kibana UI otherwise below error occurs in the audit log.

```
[2017-01-16T15:47:26,692] [transport] [access_denied] origin_type=[rest], origin_address=[10.1.0.15], principal=[someuser], action=[indices:data/read/get], indices=[.kibana], request=[GetRequest]
[2017-01-16T15:47:29,014] [transport] [access_denied] origin_type=[rest], origin_address=[10.1.0.15], principal=[someuser], action=[indices:data/read/search], indices=[.kibana], request=[SearchRequest]

```

However, there seems to be no choice for **.kibana** in the **Indices Privileges**.

![](https://us1.discourse-cdn.com/elastic/original/2X/3/325f1d51036b5d1eea55a2f00c450949254f96e1.PNG)

Should I add the .kibana privilege through [Role Management API](https://www.elastic.co/guide/en/x-pack/current/defining-roles.html#roles-management-api) everytime I create a role?

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [January 17, 2017, 4:27am UTC](https://discuss.elastic.co/t/no-kibana-privilege-on-kibana-ui/71684/2 "2017-01-17T04:27:48Z")

</div>

The [recommended](https://www.elastic.co/guide/en/x-pack/current/kibana.html) approach for enabling Kibana access is to grant the user the `kibana_user` role.

Is there a reason that you want to incorporate those permissions into each of your own roles (such as `GeneralUser`) instead of just including `kibana_user` in the user's role list?

It's technically possible to do what you want (via the API) but it's not the intended approach.

---

<div class="post-metadata">

**Author:** ![YuWatanabe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuwatanabe/32/13259_2.png) [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)\
**Post date:** [January 17, 2017, 7:26am UTC](https://discuss.elastic.co/t/no-kibana-privilege-on-kibana-ui/71684/3 "2017-01-17T07:26:50Z")

</div>

@TimV

Thank you for the reply. Yes I followed your link and I was able to search index with newly created user with kibana\_user role.

However, I have a requirement where multiple roles per company department is required and need to assign each employee to the role. Which will end up having different **Indice privilege** among the roles.

Thus, to achieve this , instead of setting **indice privilege** of .kibana to GeneralUser, I have just tried assigning kibana\_user as **Run As Privilege** but I get search denied error in the audit log. As a result, nothing was returned in discovery.

`[2017-01-17T16:11:14,054] [transport] [access_denied] origin_type=[rest], origin_address=[10.1.0.15], principal=[someuser], action=[indices:data/read/search], indices=[.kibana], request=[SearchRequest]`

My role definition is below.

 ![](https://us1.discourse-cdn.com/elastic/original/2X/0/09771c8fb453800230b39e3ad9840104479369e4.PNG)

Per your explanation, I guess I will need to use the API and force to add .kibana index to each role.

---

<div class="post-metadata">

**Author:** ![YuWatanabe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuwatanabe/32/13259_2.png) [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)\
**Post date:** [January 20, 2017, 7:43am UTC](https://discuss.elastic.co/t/no-kibana-privilege-on-kibana-ui/71684/4 "2017-01-20T07:43:10Z")

</div>

Found much better way. All I need to do it was just add **.kibana** and the other role to the user.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 17, 2017, 7:43am UTC](https://discuss.elastic.co/t/no-kibana-privilege-on-kibana-ui/71684/5 "2017-02-17T07:43:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.