# Permissions issue with \`Kibana\_admin\` role and OpenIDConnect provider

**URL:** <https://discuss.elastic.co/t/permissions-issue-with-kibana-admin-role-and-openidconnect-provider/246264>\
**Category:** Kibana\
**Created:** [August 25, 2020, 10:44am UTC](https://discuss.elastic.co/t/permissions-issue-with-kibana-admin-role-and-openidconnect-provider/246264 "2020-08-25T10:44:59Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Xavier\_Krantz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xavier_krantz/32/59812_2.png) [@Xavier\_Krantz](https://discuss.elastic.co/u/Xavier_Krantz)\
**Post date:** [August 25, 2020, 10:45am UTC](https://discuss.elastic.co/t/permissions-issue-with-kibana-admin-role-and-openidconnect-provider/246264/1 "2020-08-25T10:45:00Z")

</div>

Hi there,

I am using ES Cloud and trying to setup "SSO" with OpenID Connect.

I have managed to connect my IdentityProvider (GitHub) to ElasticSearch through Auth0 (Which does the translation to provide ES with OpenID JWT).

In the end, when I log-in as a User with OpenID authentication realm:

- I can not see any documents from the indices I have (`filebeat-*`, `logs-*`, `metricbeat-*`), which I can see when logged as SuperUser

Here are some info I get from the DevTools

```auto
GET /_security/_authenticate
{
  "username" : "xakraz@gmail.com",
  "roles" : [
    "monitoring_user",
    "machine_learning_user",
    "kibana_admin"
  ],
  "full_name" : null,
  "email" : null,
  "metadata" : {
    "oidc(iss)" : "https://MY-DOMAIN.eu.auth0.com/",
    "oidc(email)" : "xakraz@gmail.com",
    "oidc(sub)" : "github|1590399",
    "oidc(name)" : "Xavier Krantz",
    "oidc(picture)" : "https://avatars0.githubusercontent.com/u/1590399?v=4",
    "oidc(aud)" : [REDACTED],
    "oidc(CUSTOM_CLAIM_1)" : [],
    "oidc(id_token_hint)" : "REDACTED",
    "oidc(nickname)" : "xakraz",
    "oidc(CUSTOM_CLAIM_2)" : [],
    "oidc(CUSTOM_CLAIM_3)" : [],
    "oidc(CUSTOM_CLAIM_3)" : [],
    "oidc(updated_at)" : "2020-08-25T10:32:41.412Z"
  },
  "enabled" : true,
  "authentication_realm" : {
    "name" : "MY_REALM",
    "type" : "oidc"
  },
  "lookup_realm" : {
    "name" : "MY_REALM",
    "type" : "oidc"
  }
}

```

Any idea ?

---

<div class="post-metadata">

**Author:** ![Xavier\_Krantz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/xavier_krantz/32/59812_2.png) [@Xavier\_Krantz](https://discuss.elastic.co/u/Xavier_Krantz)\
**Post date:** [August 25, 2020, 3:10pm UTC](https://discuss.elastic.co/t/permissions-issue-with-kibana-admin-role-and-openidconnect-provider/246264/2 "2020-08-25T15:10:42Z")

</div>

So, PEBCAK again ...

it turns out that `kibana_admin` role let you "only" edit dashboards, SavedSearches, Visualizations ("SavedObjects"), access to "workspaces" or other "app" features (Logs, Monitoring, SIEM, ...) proper to Kibana.

For indices queries you need an additional role ... So I have created a basic `incides_reader`

```auto
/_security/role/indices_reader
{
    "cluster" : [],
    "indices" : [
      {
        "names" : [
          "*"
        ],
        "privileges" : [
          "view_index_metadata",
          "read_cross_cluster",
          "read"
        ],
        "field_security" : {
          "grant" : [
            "*"
          ],
          "except" : []
        },
        "allow_restricted_indices" : false
      }
    ],
    "applications" : [],
    "run_as" : [],
    "metadata" : { },
    "transient_metadata" : {
      "enabled" : true
    }
 }

```

Without this kind of role you can not do anything out of the box, except if you are `SuperUser`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 22, 2020, 3:10pm UTC](https://discuss.elastic.co/t/permissions-issue-with-kibana-admin-role-and-openidconnect-provider/246264/3 "2020-09-22T15:10:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.