# Role based access control

**URL:** https://discuss.elastic.co/t/role-based-access-control/214300
**Category:** Kibana
**Tags:** elastic-stack-security
**Created:** [January 8, 2020, 8:21pm UTC](https://discuss.elastic.co/t/role-based-access-control/214300 "2020-01-08T20:21:18Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![sentient](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sentient/32/34996_2.png) [@sentient](https://discuss.elastic.co/u/sentient)
#### Post date: [January 8, 2020, 8:21pm UTC](https://discuss.elastic.co/t/role-based-access-control/214300/1 "2020-01-08T20:21:19Z")

</div>

I'm trying to setup role based access control. I define a security\_engineer role and a security\_engineer space for the security engineers that needs read only access.

I'm on elasticsearch version 7.5.0 with security enabled (basic license)

I define the role as

> ```
> curl -v -k -u <usename>:<password> -XPUT -H "kbn-xsrf: true" -H "Content-Type: application/json" "http://127.0.0.1:5601/api/security/role/security_engineer" -d '
> {     
> "elasticsearch": {
> "cluster" : ["all"],
> "indices" : [ {
> "names" : ["wazuh*", "phoenix*"],
> "privileges" : ["read"]      
> } ]
> },
> "kibana": [
> {
> "base": [],
> "feature": {
> "discover": ["read"],
> "dashboard": ["read"],
> "siem" : ["read"],
> "wazuh": ["read"]
> },
> "spaces": [
> "security_engineer"
> ]
> }
> ]
> }'
> 
> ```

And I assign this role to a specific security engineer.

They indeed only see the features for discover, dashboard,siem and wazuh.

but they can also get to the settings.

so once they login they can just assign themselves the superuser role

That is obviously not the idea. So I must be doing something really stupid.

The question are:

- where do I enforce that a user cannot change it's own security roles.
- how can I disable the settings feature?

---

<div class="post-metadata">

### Author: ![elasticforme](https://avatars.discourse-cdn.com/v4/letter/e/f05b48/32.png) [@elasticforme](https://discuss.elastic.co/u/elasticforme)
#### Post date: [January 8, 2020, 8:52pm UTC](https://discuss.elastic.co/t/role-based-access-control/214300/2 "2020-01-08T20:52:24Z")

</div>

I actually go in to kibana and do it. do not know how to do it via command line

create a space called secutiry\_engineer

then on roles there is a last thing called Add space privilege

add secutiry\_engineer (space) and limit them to see feature.  
now they can't go to setting anymore

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/5/c5551dd234dbd05a91b6c99ebb3ffaf795a74d87.png)

---

<div class="post-metadata">

### Author: ![sentient](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sentient/32/34996_2.png) [@sentient](https://discuss.elastic.co/u/sentient)
#### Post date: [January 8, 2020, 9:00pm UTC](https://discuss.elastic.co/t/role-based-access-control/214300/3 "2020-01-08T21:00:19Z")

</div>

Thanks Sachin,  
That's what I was expecting as well.  
Although I have a space defined, it still shows me the settings

 ![Screenshot from 2020-01-08 13-01-08](https://us1.discourse-cdn.com/elastic/original/3X/f/8/f8e2f330bbbe32df4da5c5f0c39f6b0973011ef8.png)

 ![Screenshot from 2020-01-08 12-58-14](https://us1.discourse-cdn.com/elastic/original/3X/3/5/35ed2c2d6f4b4b096dd52505f88f6cb010f887e9.png)

---

<div class="post-metadata">

### Author: ![sentient](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sentient/32/34996_2.png) [@sentient](https://discuss.elastic.co/u/sentient)
#### Post date: [January 8, 2020, 9:54pm UTC](https://discuss.elastic.co/t/role-based-access-control/214300/4 "2020-01-08T21:54:40Z")

</div>

Not sure what happened. But it seems to be running now.

I did notice in the documentation

> **[Security | Kibana Guide \[8.11\] | Elastic](https://www.elastic.co/guide/en/kibana/current/xpack-security.html)**

> Managing roles that grant [Kibana privileges](https://www.elastic.co/guide/en/kibana/current/kibana-privileges.html) using the Elasticsearch [role management APIs](https://www.elastic.co/guide/en/elasticsearch/reference/7.5/security-api.html#security-role-apis) is not supported. Doing so will likely cause Kibana’s authorization to behave unexpectedly.

Maybe that is what was my issue. Not sure what that statement means exactly. Are the elastic roles visible in kibana? How do I keep one seperate from the other.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 5, 2020, 9:54pm UTC](https://discuss.elastic.co/t/role-based-access-control/214300/5 "2020-02-05T21:54:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.