# Try to define an admin role (used setting similar to superuser) but not work

**URL:** <https://discuss.elastic.co/t/try-to-define-an-admin-role-used-setting-similar-to-superuser-but-not-work/190791>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [July 16, 2019, 4:22pm UTC](https://discuss.elastic.co/t/try-to-define-an-admin-role-used-setting-similar-to-superuser-but-not-work/190791 "2019-07-16T16:22:24Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![xujohn](https://avatars.discourse-cdn.com/v4/letter/x/c0e974/32.png) [@xujohn](https://discuss.elastic.co/u/xujohn)\
**Post date:** [July 16, 2019, 4:22pm UTC](https://discuss.elastic.co/t/try-to-define-an-admin-role-used-setting-similar-to-superuser-but-not-work/190791/1 "2019-07-16T16:22:24Z")

</div>

In elasticsearch 7.2.0, I try to define in roles.yml the following role:

admin\_role:  
cluster: ["all"]  
indices:  
- names : [" \* "]  
priviledges: ["all"]  
allow\_restricted\_indices: true  
run\_as: [" \* "]  
applications:  
- application : " \* "  
privileges : [" \* "]  
resources : [" \* "]

I assigned an LDAP group (such as LDAP\_GROUP\_1) to this role in role\_mapping.yml.

admin\_role:  
"cn=LDAP\_GROUP\_1,ou=groups,o=my\_org"

In log, although user1, belonging to the LDAP group, is shown in admin\_role:  
user [user1], with roles [[admin\_role]]

The user1 cannot access the API GET such as  
GET /\_security/role

The error message is  
"reason": "action [cluster:admin/xpack/security/role/get] is unauthorized for user [user1]"

ir I assign the LDAP group in role\_mapping.yml as supperuser:  
superuser:  
"cn=LDAP\_GROUP\_1,ou=groups,o=my\_org"

user1 this time can access all the api such as GET /\_security/role

I checked superuser role GET /\_security/role/superuser, and it returns same setting as I did for admin\_role.

Does anyone know why this happens?

Thank you.

John

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [July 16, 2019, 10:33pm UTC](https://discuss.elastic.co/t/try-to-define-an-admin-role-used-setting-similar-to-superuser-but-not-work/190791/2 "2019-07-16T22:33:34Z")

</div>

> [@xujohn](#):
>
> priviledges: ["all"]

That's not how you spell `privileges`.  
If that has been directly copied from your `roles.yml` file, then this role is invalid and will be ignored.  
The logs should report that.

---

<div class="post-metadata">

**Author:** ![xujohn](https://avatars.discourse-cdn.com/v4/letter/x/c0e974/32.png) [@xujohn](https://discuss.elastic.co/u/xujohn)\
**Post date:** [July 16, 2019, 11:34pm UTC](https://discuss.elastic.co/t/try-to-define-an-admin-role-used-setting-similar-to-superuser-but-not-work/190791/3 "2019-07-16T23:34:10Z")

</div>

Tim, I am sorry and thank you for finding the wrong spelling.

After corrected the spell to privileges, I run this again. Security roles returned correct.

However, when I issue this (my\_index\_name\_1 is an index in elasticsearch 7.2):

GET my\_index\_name\_1/\_search  
{  
"query": {  
"match": {"record" : "12345"}  
}  
}

I received:  
{  
"error": {  
"root\_cause": [  
{  
"type": "security\_exception",  
"reason": "action [indices:data/read/search] is unauthorized for user [user1]"  
}  
],  
"type": "security\_exception",  
"reason": "action [indices:data/read/search] is unauthorized for user [user1]"  
},  
"status": 403  
}

where user1 is user name.

When I assign the LDAP\_GROUP\_1 to superuser role , however, it can get the search results.

Did miss something on this role? maybe this role did not have access to my\_index\_name\_1 mentioned above?

It turns out that I need to update data nodes with the role to get the admin\_users work.

Thank you.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 13, 2019, 11:34pm UTC](https://discuss.elastic.co/t/try-to-define-an-admin-role-used-setting-similar-to-superuser-but-not-work/190791/4 "2019-08-13T23:34:13Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.