# \[security\_exception\] action \[indices:data/read/search\]

**URL:** <https://discuss.elastic.co/t/security-exception-action-indices-data-read-search/187845>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [June 27, 2019, 1:35pm UTC](https://discuss.elastic.co/t/security-exception-action-indices-data-read-search/187845 "2019-06-27T13:35:00Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Balamurugan\_Sethuram](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/balamurugan_sethuram/32/48939_2.png) [@Balamurugan\_Sethuram](https://discuss.elastic.co/u/Balamurugan_Sethuram)\
**Post date:** [June 27, 2019, 1:35pm UTC](https://discuss.elastic.co/t/security-exception-action-indices-data-read-search/187845/1 "2019-06-27T13:35:00Z")

</div>

Hi, I am using elasticsearch 6.8.0.

Configured with AD group and getting below error

> {"message":"action [indices:data/read/search] is unauthorized for user [xxxxxx]: [security\_exception] action [indices:data/read/search] is unauthorized for user [xxxxxx]","statusCode":403,"error":"Forbidden"}

Created ADMIN Role:-

```auto
GET _xpack/security/role/ADMIN
{
  "ADMIN" : {
    "cluster" : [
      "all"
    ],
    "indices" : [
      {
        "names" : [
          "*"
        ],
        "privileges" : [
          "all"
        ],
        "field_security" : {
          "grant" : []
        },
        "allow_restricted_indices" : false
      }
    ],
    "applications" : [],
    "run_as" : [
      "*"
    ],
    "metadata" : { },
    "transient_metadata" : {
      "enabled" : true
    }
  }
}

```

Mapped ADMIN role to AD group

```auto
GET _xpack/security/role_mapping/ADMIN
{
  "ADMIN" : {
    "enabled" : true,
    "roles" : [
      "superuser",
      "reporting_user",
      "monitoring_user",
      "kibana_user"
    ],
    "rules" : {
      "field" : {
        "groups" : "CN=XXXXXX,OU=Resource,OU=Groups,OU=XXXX,DC=xxxx1,DC=xxx,DC=xxx"
      }
    },
    "metadata" : { }
  }
}

```

Anything missing on myside to get ADMIN access to view all indices?

When I give CN=\*, I am able to view all. Need help on this.

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [July 1, 2019, 6:01am UTC](https://discuss.elastic.co/t/security-exception-action-indices-data-read-search/187845/2 "2019-07-01T06:01:37Z")

</div>

> [@Balamurugan\_Sethuram](#):
>
> When I give CN=\*, I am able to view all.

That implies that the user isn't actually in the `CN=XXXXXX,OU=Resource,OU=Groups,OU=XXXX,DC=xxxx1,DC=xxx` group.

Use the [Authenticate API](https://www.elastic.co/guide/en/elasticsearch/reference/6.8/security-api-authenticate.html) and check the actual groups.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 29, 2019, 6:01am UTC](https://discuss.elastic.co/t/security-exception-action-indices-data-read-search/187845/3 "2019-07-29T06:01:43Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.