# Security\_exception: action \[indices:admin/rollover\] is unauthorized for user **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security, ilm-index-lifecycle-management\ **Created:** [August 19, 2020, 12:12pm UTC](https://discuss.elastic.co/t/security-exception-action-indices-admin-rollover-is-unauthorized-for-user/245593 "2020-08-19T12:12:05Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![hendry.lim](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hendry.lim/32/71328_2.png) [@hendry.lim](https://discuss.elastic.co/u/hendry.lim)\ **Post date:** [August 19, 2020, 12:12pm UTC](https://discuss.elastic.co/t/security-exception-action-indices-admin-rollover-is-unauthorized-for-user/245593/1 "2020-08-19T12:12:05Z")
Elasticsearch: `7.9.0` Kibana: `7.9.0` I am hitting the issue described in [#47500](https://github.com/elastic/elasticsearch/issues/47500). I believe the same issue has been raised a few times. However, adding `manage` privilege on the index level for the role does not seem to work. I am still getting the same error. Screenshots: > **Expand** > > ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/c/9c97ef6460fc637f231b0444ebecde9462d23e68.png) > > ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/3/73dab571dd010561f8231cef9f9414a8de0e724d.png) > > ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/a/da5673aae24256044172a20685064b63b4cb4157.png) > > ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/d/8d1b082b6b1c9fae85f9ce55ce3ccfc5c143f5e8.png) > **Error** > > ```auto > { > "type": "server", > "timestamp": "2020-08-19T12:08:46,690Z", > "level": "WARN", > "component": "o.e.i.s.IndexShard", > "cluster.name": "docker-cluster", > "node.name": "es01", > "message": " [apm-7.9.0-transaction-000001][0] onPreFetchPhase listener [org.elasticsearch.xpack.security.authz.SecuritySearchOperationListener@ccd1c8b] failed", > "cluster.uuid": "D8swAaZPTDeLax90eETYwg", > "node.id": "6a3KukJsTrqiibIoFlOQ8A", > "stacktrace": ["org.elasticsearch.ElasticsearchSecurityException: [[FAOfBnQBQcojp3HWI0Vd][23968]] expected scroll indices access control [IndicesAccessControl{granted=true, indexPermissions={apm-7.9.0-error=IndexAccessControl{granted=true, fieldPermissions=org.elasticsearch.xpack.core.security.authz.permission.FieldPermissions@1, documentPermissions=DocumentPermissions [queries=null, scopedByQueries=null]}, apm-7.9.0-span=IndexAccessControl{granted=true, fieldPermissions=org.elasticsearch.xpack.core.security.authz.permission.FieldPermissions@1, documentPermissions=DocumentPermissions [queries=null, scopedByQueries=null]}, apm-7.9.0-metric=IndexAccessControl{granted=true, fieldPermissions=org.elasticsearch.xpack.core.security.authz.permission.FieldPermissions@1, documentPermissions=DocumentPermissions [queries=null, scopedByQueries=null]}, apm-7.9.0-onboarding-2020.08.18=IndexAccessControl{granted=true, fieldPermissions=org.elasticsearch.xpack.core.security.authz.permission.FieldPermissions@1, documentPermissions=DocumentPermissions [queries=null, scopedByQueries=null]}, apm-7.9.0-transaction-000001=IndexAccessControl{granted=true, fieldPermissions=org.elasticsearch.xpack.core.security.authz.permission.FieldPermissions@1, documentPermissions=DocumentPermissions [queries=null, scopedByQueries=null]}, apm-7.9.0-metric-000001=IndexAccessControl{granted=true, fieldPermissions=org.elasticsearch.xpack.core.security.authz.permission.FieldPermissions@1, documentPermissions=DocumentPermissions [queries=null, scopedByQueries=null]}, apm-7.9.0-onboarding=IndexAccessControl{granted=true, fieldPermissions=org.elasticsearch.xpack.core.security.authz.permission.FieldPermissions@1, documentPermissions=DocumentPermissions [queries=null, scopedByQueries=null]}, apm-7.9.0-profile-000001=IndexAccessControl{granted=true, fieldPermissions=org.elasticsearch.xpack.core.security.authz.permission.FieldPermissions@1, documentPermissions=DocumentPermissions [queries=null, scopedByQueries=null]}, apm-7.9.0-error-000001=IndexAccessControl{granted=true, fieldPermissions=org.elasticsearch.xpack.core.security.authz.permission.FieldPermissions@1, documentPermissions=DocumentPermissions [queries=null, scopedByQueries=null]}, apm-7.9.0-span-000001=IndexAccessControl{granted=true, fieldPermissions=org.elasticsearch.xpack.core.security.authz.permission.FieldPermissions@1, documentPermissions=DocumentPermissions [queries=null, scopedByQueries=null]}, apm-7.9.0-profile=IndexAccessControl{granted=true, fieldPermissions=org.elasticsearch.xpack.core.security.authz.permission.FieldPermissions@1, documentPermissions=DocumentPermissions [queries=null, scopedByQueries=null]}, apm-7.9.0-transaction=IndexAccessControl{granted=true, fieldPermissions=org.elasticsearch.xpack.core.security.authz.permission.FieldPermissions@1, documentPermissions=DocumentPermissions [queries=null, scopedByQueries=null]}}}] but found [IndicesAccessControl{granted=true, indexPermissions={apm-7.9.0-error=IndexAccessControl{granted=true, fieldPermissions=org.elasticsearch.xpack.core.security.authz.permission.FieldPermissions@1, documentPermissions=DocumentPermissions [queries=null, scopedByQueries=null]}, apm-7.9.0-span=IndexAccessControl{granted=true, fieldPermissions=org.elasticsearch.xpack.core.security.authz.permission.FieldPermissions@1, documentPermissions=DocumentPermissions [queries=null, scopedByQueries=null]}, apm-7.9.0-metric=IndexAccessControl{granted=true, fieldPermissions=org.elasticsearch.xpack.core.security.authz.permission.FieldPermissions@1, documentPermissions=DocumentPermissions [queries=null, scopedByQueries=null]}, apm-7.9.0-onboarding-2020.08.18=IndexAccessControl{granted=true, fieldPermissions=org.elasticsearch.xpack.core.security.authz.permission.FieldPermissions@1, documentPermissions=DocumentPermissions [queries=null, scopedByQueries=null]}, apm-7.9.0-transaction-000001=IndexAccessControl{granted=true, fieldPermissions=org.elasticsearch.xpack.core.security.authz.permission.FieldPermissions@1, documentPermissions=DocumentPermissions [queries=null, scopedByQueries=null]}, apm-7.9.0-metric-000001=IndexAccessControl{granted=true, fieldPermissions=org.elasticsearch.xpack.core.security.authz.permission.FieldPermissions@1, documentPermissions=DocumentPermissions [queries=null, scopedByQueries=null]}, apm-7.9.0-onboarding=IndexAccessControl{granted=true, fieldPermissions=org.elasticsearch.xpack.core.security.authz.permission.FieldPermissions@1, documentPermissions=DocumentPermissions [queries=null, scopedByQueries=null]}, apm-7.9.0-profile-000001=IndexAccessControl{granted=true, fieldPermissions=org.elasticsearch.xpack.core.security.authz.permission.FieldPermissions@1, documentPermissions=DocumentPermissions [queries=null, scopedByQueries=null]}, apm-7.9.0-error-000001=IndexAccessControl{granted=true, fieldPermissions=org.elasticsearch.xpack.core.security.authz.permission.FieldPermissions@1, documentPermissions=DocumentPermissions [queries=null, scopedByQueries=null]}, apm-7.9.0-span-000001=IndexAccessControl{granted=true, fieldPermissions=org.elasticsearch.xpack.core.security.authz.permission.FieldPermissions@1, documentPermissions=DocumentPermissions [queries=null, scopedByQueries=null]}, apm-7.9.0-profile=IndexAccessControl{granted=true, fieldPermissions=org.elasticsearch.xpack.core.security.authz.permission.FieldPermissions@1, documentPermissions=DocumentPermissions [queries=null, scopedByQueries=null]}, apm-7.9.0-transaction=IndexAccessControl{granted=true, fieldPermissions=org.elasticsearch.xpack.core.security.authz.permission.FieldPermissions@1, documentPermissions=DocumentPermissions [queries=null, scopedByQueries=null]}}}] in thread context", > "at org.elasticsearch.xpack.security.authz.SecuritySearchOperationListener.ensureIndicesAccessControlForScrollThreadContext(SecuritySearchOperationListener.java:111) ~[?:?]", > "at org.elasticsearch.xpack.security.authz.SecuritySearchOperationListener.onPreFetchPhase(SecuritySearchOperationListener.java:95) ~[?:?]", > "at org.elasticsearch.index.shard.SearchOperationListener$CompositeListener.onPreFetchPhase(SearchOperationListener.java:166) [elasticsearch-7.9.0.jar:7.9.0]", > "at org.elasticsearch.search.SearchService$SearchOperationListenerExecutor.(SearchService.java:1272) [elasticsearch-7.9.0.jar:7.9.0]", > "at org.elasticsearch.search.SearchService.lambda$executeFetchPhase$4(SearchService.java:584) [elasticsearch-7.9.0.jar:7.9.0]", > "at org.elasticsearch.action.ActionRunnable.lambda$supply$0(ActionRunnable.java:58) [elasticsearch-7.9.0.jar:7.9.0]", > "at org.elasticsearch.action.ActionRunnable$2.doRun(ActionRunnable.java:73) [elasticsearch-7.9.0.jar:7.9.0]", > "at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) [elasticsearch-7.9.0.jar:7.9.0]", > "at org.elasticsearch.common.util.concurrent.TimedRunnable.doRun(TimedRunnable.java:44) [elasticsearch-7.9.0.jar:7.9.0]", > "at org.elasticsearch.common.util.concurrent.ThreadContext$ContextPreservingAbstractRunnable.doRun(ThreadContext.java:710) [elasticsearch-7.9.0.jar:7.9.0]", > "at org.elasticsearch.common.util.concurrent.AbstractRunnable.run(AbstractRunnable.java:37) [elasticsearch-7.9.0.jar:7.9.0]", > "at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1130) [?:?]", > "at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:630) [?:?]", > "at java.lang.Thread.run(Thread.java:832) [?:?]"] > } > > ``` ---
**Author:** ![hendry.lim](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hendry.lim/32/71328_2.png) [@hendry.lim](https://discuss.elastic.co/u/hendry.lim)\ **Post date:** [August 20, 2020, 1:23am UTC](https://discuss.elastic.co/t/security-exception-action-indices-admin-rollover-is-unauthorized-for-user/245593/2 "2020-08-20T01:23:10Z")
Added `all` privilege to the index level privilege, but I am still seeing the same errors. One interesting thing is that the error only appears for `auditbeat`, `heartbeat`, and `winlogbeat` indices. I also noticed that sometimes the error resolved by itself. ---
**Author:** ![MarcinMiszk](https://avatars.discourse-cdn.com/v4/letter/m/278dde/32.png) [@MarcinMiszk](https://discuss.elastic.co/u/MarcinMiszk)\ **Post date:** [August 25, 2020, 11:30am UTC](https://discuss.elastic.co/t/security-exception-action-indices-admin-rollover-is-unauthorized-for-user/245593/3 "2020-08-25T11:30:33Z")
Hi Hedry Could you tell if you have found a way to solve this problem ? Our logs are full of warnings/errors like the one mentioned by you. Kind Regards Marcin ---
**Author:** ![hendry.lim](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hendry.lim/32/71328_2.png) [@hendry.lim](https://discuss.elastic.co/u/hendry.lim)\ **Post date:** [August 25, 2020, 1:03pm UTC](https://discuss.elastic.co/t/security-exception-action-indices-admin-rollover-is-unauthorized-for-user/245593/4 "2020-08-25T13:03:06Z")
@MarcinMiszk unfortunately no, it's still happening randomly in my local environment. I have another ECE environment, which does not seem to be affected by this issue. I have opened a Github issue [#61453](https://github.com/elastic/elasticsearch/issues/61453). ---
**Author:** ![hendry.lim](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/hendry.lim/32/71328_2.png) [@hendry.lim](https://discuss.elastic.co/u/hendry.lim)\ **Post date:** [September 4, 2020, 2:58am UTC](https://discuss.elastic.co/t/security-exception-action-indices-admin-rollover-is-unauthorized-for-user/245593/5 "2020-09-04T02:58:16Z")
Error does not appear in `7.9.1`. Should have been fixed in [#61446](https://github.com/elastic/elasticsearch/pull/61446). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 2, 2020, 2:58am UTC](https://discuss.elastic.co/t/security-exception-action-indices-admin-rollover-is-unauthorized-for-user/245593/6 "2020-10-02T02:58:34Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.