# Problem with document level security
**URL:** https://discuss.elastic.co/t/problem-with-document-level-security/41944
**Category:** Elasticsearch
**Tags:** elastic-stack-security
**Created:** [February 16, 2016, 9:47pm UTC](https://discuss.elastic.co/t/problem-with-document-level-security/41944 "2016-02-16T21:47:35Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@AndreyL](https://discuss.elastic.co/u/AndreyL)
#### Post date: [February 16, 2016, 9:47pm UTC](https://discuss.elastic.co/t/problem-with-document-level-security/41944/1 "2016-02-16T21:47:35Z")
I have the following two documents in Elastic:
```
[ {
"_index" : "hr",
"_type" : "blog",
"_id" : "123",
"_score" : 1.0,
"_source" : {
"title" : "blah blah Doe"
}
}, {
"_index" : "hr",
"_type" : "person",
"_id" : "1",
"_score" : 1.0,
"_source" : {
"name" : "Jane Doe",
"title" : "Software Engineer"
}
} ]
```
==========================================
I have two roles: `hr_user` and `hr_blog_reader`, and two users mapped to them. Role `hr_user` should have full access to hr index; `hr_blog_reader` should only have access to documents with `_type=blog`:
```
hr_blog_reader:
indices:
'hr':
privileges: read
query: '{"match":{"_type":"blog"}}'
hr_user:
indices:
'hr':
privileges: all
```
When I run a query as `hr_user`, I get both documents back, as expected. When I run a query as `hr_blog_reader`, I get the following error:
```
{
"error" : {
"root_cause" : [ {
"type" : "security_exception",
"reason" : "action [indices:data/read/search] is unauthorized for user [hr_blog_reader]"
} ],
"type" : "security_exception",
"reason" : "action [indices:data/read/search] is unauthorized for user [hr_blog_reader]"
},
"status" : 403
}
```
I'm running the queries using curl:
```
curl http://localhost:9200/_search?pretty -u hr_blog_reader
```
Any ideas what I'm doing wrong?
---
### Author:  [@jaymode](https://discuss.elastic.co/u/jaymode)
#### Post date: [February 16, 2016, 11:11pm UTC](https://discuss.elastic.co/t/problem-with-document-level-security/41944/2 "2016-02-16T23:11:27Z")
What version of Shield are you using? You may need to set `shield.dls_fls.enabled: true` in your elasticsearch.yml file. This was supposed to be enabled by default in 2.2, but there was a bug and it was not; we'll fix it in the next bug release version.
Also, in your logs you might have a message saying that role isn't valid and why.
---
### Author:  [@AndreyL](https://discuss.elastic.co/u/AndreyL)
#### Post date: [February 17, 2016, 5:40pm UTC](https://discuss.elastic.co/t/problem-with-document-level-security/41944/4 "2016-02-17T17:40:46Z")
That worked, thank you!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 1:46pm UTC](https://discuss.elastic.co/t/problem-with-document-level-security/41944/5 "2017-07-06T13:46:45Z")