# Permission to view all indices and create dashboards
**URL:** https://discuss.elastic.co/t/permission-to-view-all-indices-and-create-dashboards/274227
**Category:** Kibana
**Tags:** elastic-stack-security
**Created:** [May 27, 2021, 2:32pm UTC](https://discuss.elastic.co/t/permission-to-view-all-indices-and-create-dashboards/274227 "2021-05-27T14:32:44Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@lchan](https://discuss.elastic.co/u/lchan)
#### Post date: [May 27, 2021, 2:32pm UTC](https://discuss.elastic.co/t/permission-to-view-all-indices-and-create-dashboards/274227/1 "2021-05-27T14:32:44Z")
I am looking to give permission SAML user to read all indices and I have done the following:
1. assign the following permissions with role indices\_viewer
2. Confirm role mapping is setup
However users are still getting 403, what is the next step of troubleshooting?
```auto
{
"indices_viewer" : {
"cluster" : [],
"indices" : [
{
"names" : [
"*"
],
"privileges" : [
"read",
"monitor",
"view_index_metadata"
],
"field_security" : {
"grant" : [
"*"
],
"except" : []
},
"allow_restricted_indices" : false
}
],
"applications" : [],
"run_as" : [],
"metadata" : { },
"transient_metadata" : {
"enabled" : true
}
}
}
```
> [@What permissions/roles should I assign to create a read-only Kibana user?](https://discuss.elastic.co/t/what-permissions-roles-should-i-assign-to-create-a-read-only-kibana-user/97108):
>
> One who can read all my indices, see all my visualisations and dashboards, but not be able to change any visualisations or dashboards? The built-in kibana\_user role doesn't do it, because that lets the user destroy things. But if I reduce the privileges on .kibana\* to just "read" (and add "read" to indices "\*" for access to the actual data) I just get a blank screen. (Yes I know there are many similar such questions, but I can't find one that has an actual answer.)
---
### Author:  [@Aaron\_Caldwell](https://discuss.elastic.co/u/Aaron_Caldwell)
#### Post date: [May 27, 2021, 3:06pm UTC](https://discuss.elastic.co/t/permission-to-view-all-indices-and-create-dashboards/274227/2 "2021-05-27T15:06:28Z")
Hello,
Try looking at the network requests that are getting 403s in your browser debugger. They'll usually have a message in the response that gives clues as to what permissions are missing and needed.
Hope that helps!
Regards,
Aaron
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [May 28, 2021, 1:24am UTC](https://discuss.elastic.co/t/permission-to-view-all-indices-and-create-dashboards/274227/3 "2021-05-28T01:24:05Z")
That role does not appear to have [access to Kibana](https://www.elastic.co/guide/en/kibana/current/kibana-role-management.html#adding_kibana_privileges).
Are you encountering the 403 error while logging into Kibana? If so, that is a likely cause.
---
### Author:  [@lchan](https://discuss.elastic.co/u/lchan)
#### Post date: [May 28, 2021, 3:15am UTC](https://discuss.elastic.co/t/permission-to-view-all-indices-and-create-dashboards/274227/4 "2021-05-28T03:15:32Z")
Sorry, I was not specific enough after re-reading my post.
The user are able to login but they are not seeing any indices. The users also have kibana\_admin in addition to the above custom role.
However, they are still getting 403 on the dashboards. Is there a built-in user permission to able to read all indices?
```auto
PUT _security/role_mapping/CLOUD_SAML_TO_KIBANA_ADMIN
{
"enabled": true,
"roles": [
"kibana_admin"
],
"rules": { "all" : [
{ "field": { "realm.name": "okta-realm" } },
{ "field": { "groups": "elastic-cloud" } }
]},
"metadata": {
"version": 1
}
}
```
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [May 28, 2021, 4:15am UTC](https://discuss.elastic.co/t/permission-to-view-all-indices-and-create-dashboards/274227/5 "2021-05-28T04:15:46Z")
> [@lchan](#):
>
> The user are able to login but they are not seeing any indices.
In which case the issue is almost certainly with your role mapping to the `indices_viewer` role. Tat role is correctly set up to grant read access to all indices, but it doesn't look like your users are being assigned the role.
---
### Author:  [@lchan](https://discuss.elastic.co/u/lchan)
#### Post date: [May 29, 2021, 5:50pm UTC](https://discuss.elastic.co/t/permission-to-view-all-indices-and-create-dashboards/274227/6 "2021-05-29T17:50:07Z")
Thanks @TimV
The users have roles mapped to kibana\_admin and indices\_viewer. They can login but not able to see any indices or dashboard from the indices.
So it looks like the roles mapping is not working. Is it possible to see their roles from my account? GET /\_security/\_authenticate/ doesn't work from my account as I can only see my permissions.
---
### Author:  [@lchan](https://discuss.elastic.co/u/lchan)
#### Post date: [June 3, 2021, 5:29pm UTC](https://discuss.elastic.co/t/permission-to-view-all-indices-and-create-dashboards/274227/7 "2021-06-03T17:29:01Z")
I confirmed the user are getting indices\_viewer but still cannot see any indices or dashboard(cluster health dashboard for instance). So it looks like this is role permission rather?
```auto
GET /_security/_authenticate/
{
"username" : "foo.bar@example.com",
"roles" : [
"kibana_admin",
"indices_viewer",
"anonymous"
],
...
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 1, 2021, 5:29pm UTC](https://discuss.elastic.co/t/permission-to-view-all-indices-and-create-dashboards/274227/8 "2021-07-01T17:29:13Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.