# \[security\_exception\] action \[indices:data/read/search\] is unauthorized for user \[user\]
**URL:** https://discuss.elastic.co/t/security-exception-action-indices-data-read-search-is-unauthorized-for-user-user/164848
**Category:** APM
**Tags:** elastic-stack-security
**Created:** [January 18, 2019, 7:08pm UTC](https://discuss.elastic.co/t/security-exception-action-indices-data-read-search-is-unauthorized-for-user-user/164848 "2019-01-18T19:08:10Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@alexus](https://discuss.elastic.co/u/alexus)
#### Post date: [January 18, 2019, 7:08pm UTC](https://discuss.elastic.co/t/security-exception-action-indices-data-read-search-is-unauthorized-for-user-user/164848/1 "2019-01-18T19:08:10Z")
Hello,
I followed [Grant users access to APM Server indices | APM Server Reference [6.5] | Elastic](https://www.elastic.co/guide/en/apm/server/current/beats-user-access.html), yet user (w/ `apm_reader` role) is unable to access the way superuser does (some parts of apm are visible, while others is not)
user also provided following information that he's got via debug in a browser:
> {“statusCode”:403,“error”:“Forbidden”,“message”:“[security\_exception] action [indices:data/read/search] is unauthorized for user [user]“}
Please advise.
---
### Author:  [@ikakavas](https://discuss.elastic.co/u/ikakavas)
#### Post date: [January 19, 2019, 11:49am UTC](https://discuss.elastic.co/t/security-exception-action-indices-data-read-search-is-unauthorized-for-user-user/164848/2 "2019-01-19T11:49:56Z")
Hi,
> [@alexus](#):
>
> yet user (w/ `apm_reader` role) is unable to access the way superuser does
This is to be expected, the `superuser` has by default/definition access to anything.
> [@alexus](#):
>
> some parts of apm are visible, while others is not)
Can you be a little more specific? What parts did you expect to be visible that are not?
Did you follow the instructions explicitly? Did you also add the `kibana_user` role to your user as mentioned there?
Can you share the output of the following two requests from Kibana's dev tools ?
`GET _xpack/security/role/apm_reader` ( run that while logged in as a superuser)
`GET _xpack/security/_authenticate` (run that while logged in as `user`)
---
### Author:  [@alexus](https://discuss.elastic.co/u/alexus)
#### Post date: [January 19, 2019, 4:25pm UTC](https://discuss.elastic.co/t/security-exception-action-indices-data-read-search-is-unauthorized-for-user-user/164848/3 "2019-01-19T16:25:16Z")
sure, more specific (in terms of visibility): everything is accessible except for actual charts (see attached screenshot)
and yes, I followed instruction explicitly. `kibana_user` role is already part of user's role.
`GET _xpack/security/role/apm_reader`:
```
{
"apm_reader" : {
"cluster" : [],
"indices" : [
{
"names" : [
"apm-*"
],
"privileges" : [
"read",
"view_index_metadata"
]
}
],
"applications" : [],
"run_as" : [],
"metadata" : { },
"transient_metadata" : {
"enabled" : true
}
}
}
```
`GET _xpack/security/_authenticate`:
```
{
"username" : "user",
"roles" : [
"kibana_user",
"apm_reader"
],
"full_name" : "xxx",
"email" : "x@x.x",
"metadata" : { },
"enabled" : true
}
```
---
### Author:  [@sqren](https://discuss.elastic.co/u/sqren)
#### Post date: [January 22, 2019, 9:37am UTC](https://discuss.elastic.co/t/security-exception-action-indices-data-read-search-is-unauthorized-for-user-user/164848/4 "2019-01-22T09:37:29Z")
Hi @alexus,
This is related to a bug that was found in Kibana 6.5: [https://github.com/elastic/kibana/issues/23463](https://github.com/elastic/kibana/issues/23463).
It will be fixed in 6.6.
Until then you will have to give the user permission to access the machine learning anomaly indices: `.ml-anomalies-*`
You need to define a role that gives the user access to these indices and assign that role to their user.
Read more here: [https://www.elastic.co/guide/en/elastic-stack-overview/current/defining-roles.html#roles-indices-priv](https://www.elastic.co/guide/en/elastic-stack-overview/current/defining-roles.html#roles-indices-priv)
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 12, 2019, 5:37am UTC](https://discuss.elastic.co/t/security-exception-action-indices-data-read-search-is-unauthorized-for-user-user/164848/5 "2019-02-12T05:37:30Z")
This topic was automatically closed 20 days after the last reply. New replies are no longer allowed.