# Roles not restricting as expected
**URL:** https://discuss.elastic.co/t/roles-not-restricting-as-expected/295989
**Category:** Kibana
**Tags:** elastic-stack-security
**Created:** [February 1, 2022, 7:25pm UTC](https://discuss.elastic.co/t/roles-not-restricting-as-expected/295989 "2022-02-01T19:25:15Z")
**Posts on this page:** 9
**Page:** 1
### Author:  [@psmithuk](https://discuss.elastic.co/u/psmithuk)
#### Post date: [February 1, 2022, 7:25pm UTC](https://discuss.elastic.co/t/roles-not-restricting-as-expected/295989/1 "2022-02-01T19:25:15Z")
Hi,
I have created a custom read only role for users from my company with the intention that they have read only access to dashboards to consume the data.
I have created a custom role on the indices that they need access to, assigned the "read" privilege to those indices.
Additionally I have provisioned the role read access for Kibana discover and dashboards on the production space only.
We are set up with SSO and the roles on AD are mapped correctly.
However when I log in as a test user who is assigned this role I still have full reign to view all spaces, even delete and create those spaces. They're also able to access Enterprise search, Observability, Security and Dev tools etc on all our space. Components that were excluded from the one space I did give access to.
Everything looks to me like it is in order from both the AD and Elastic side but is there anything that I have missed?
Cheers, Pete
---
### Author:  [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)
#### Post date: [February 2, 2022, 3:46am UTC](https://discuss.elastic.co/t/roles-not-restricting-as-expected/295989/2 "2022-02-02T03:46:26Z")
Are you sure those users have no other roles than your custom role? If so, I have no idea..
---
### Author:  [@psmithuk](https://discuss.elastic.co/u/psmithuk)
#### Post date: [February 2, 2022, 3:52am UTC](https://discuss.elastic.co/t/roles-not-restricting-as-expected/295989/3 "2022-02-02T03:52:04Z")
Hey Tomo\_M,
Thanks for the response. Yeah very sure, have checked that out in Azure AD.
I saw the post below about enabling security in the Elasticsearch.yml, because by default on basic tier licenses it's disabled. This would be more security features on the cluster though I imagine. Would you know?
> **[Security settings in Elasticsearch | Elasticsearch Guide \[7.17\] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/7.17/security-settings.html)**
Cheers, Pete
---
### Author:  [@Tomo\_M](https://discuss.elastic.co/u/Tomo_M)
#### Post date: [February 2, 2022, 4:09am UTC](https://discuss.elastic.co/t/roles-not-restricting-as-expected/295989/4 "2022-02-02T04:09:09Z")
Yes, setting the security configuration `xpack.security.enabled: true` in Elasticsearch.yml seems to be the first step for configuring security in kibana.
> **[Configure security in Kibana | Kibana Guide \[7.17\] | Elastic](https://www.elastic.co/guide/en/kibana/current/using-kibana-with-security.html)**
>
> A list of the supported authentication mechanisms in Kibana.
---
### Author:  [@psmithuk](https://discuss.elastic.co/u/psmithuk)
#### Post date: [February 2, 2022, 6:32pm UTC](https://discuss.elastic.co/t/roles-not-restricting-as-expected/295989/5 "2022-02-02T18:32:42Z")
Great, thanks. Will try that first port of call.
Seems strange though that functionality provided from stack management wouldn't actually provide any security restrictions until the yml is edited. I find it hard to imagine we're the first users that's tripped up
Thanks again,
Pete
---
### Author:  [@psmithuk](https://discuss.elastic.co/u/psmithuk)
#### Post date: [February 8, 2022, 6:18pm UTC](https://discuss.elastic.co/t/roles-not-restricting-as-expected/295989/6 "2022-02-08T18:18:45Z")
Update: I have found that by default the kibana\_admin role is getting applied all users by default. Does anyone know where this would be configured? Or how to overwrite?
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [February 9, 2022, 2:47am UTC](https://discuss.elastic.co/t/roles-not-restricting-as-expected/295989/7 "2022-02-09T02:47:00Z")
It sounds like you have a [role mapping](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-get-role-mapping.html) that matches all users.
---
### Author:  [@psmithuk](https://discuss.elastic.co/u/psmithuk)
#### Post date: [February 12, 2022, 7:19am UTC](https://discuss.elastic.co/t/roles-not-restricting-as-expected/295989/8 "2022-02-12T07:19:01Z")
Hi Tim,
Cheers for your response. You were absolutely right. We were missing a condition on the role mapping so it was catching everything user from our Ad realm
Thanks again
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 12, 2022, 7:19am UTC](https://discuss.elastic.co/t/roles-not-restricting-as-expected/295989/9 "2022-03-12T07:19:38Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.