# User can access index not allowed in role (security is not working) **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security, docker\ **Created:** [October 5, 2020, 12:47pm UTC](https://discuss.elastic.co/t/user-can-access-index-not-allowed-in-role-security-is-not-working/250993 "2020-10-05T12:47:35Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Petr.Simik](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/petr.simik/32/38082_2.png) [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Post date:** [October 5, 2020, 12:47pm UTC](https://discuss.elastic.co/t/user-can-access-index-not-allowed-in-role-security-is-not-working/250993/1 "2020-10-05T12:47:35Z")
Hi community, I am asking for advice, if you could help with this security problem: ES version 7.92 (in docker ) created role with access the index bs\_hdm\_tr69\_\* created user this role but user can access all indices i.e: this index should not be accessed but query provides results curl -s -XGET -u test\_simik:test\_simik "[http://oscar1:9200/bs\_config\_00001/](http://oscar1:9200/bs_config_00001/)_search" I supposed the user can access only bs\_hdm\_tr69_\* index Please do you have any advice how to troubleshoot this?. I have also 2 clusters non-docker - installed on centos and the security there works normally. role: ```auto { "elastic-ntw-hdm_tr69" : { "cluster" : [], "indices" : [ { "names" : [ "bs_hdm_tr69_*" ], "privileges" : [ "read" ], "allow_restricted_indices" : false } ], "applications" : [ { "application" : "kibana-.kibana", "privileges" : [ "all" ], "resources" : [ "*" ] } ], "run_as" : [], "metadata" : { }, "transient_metadata" : { "enabled" : true } } } ``` and user spec ```auto { "test_simik" : { "username" : "test_simik", "roles" : [ "elastic-ntw-hdm_tr69" ], "full_name" : "test_simik", "email" : "petr.simik@xxx.cz", "metadata" : { }, "enabled" : true } } ``` ---
**Author:** ![Wolfram\_Haussig](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wolfram_haussig/32/70528_2.png) [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\ **Post date:** [October 5, 2020, 1:01pm UTC](https://discuss.elastic.co/t/user-can-access-index-not-allowed-in-role-security-is-not-working/250993/2 "2020-10-05T13:01:19Z")
Hello Petr, Have you already tried to use the [authenticate API](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-authenticate.html)? When used, it returns all roles the current user has - maybe the privilege is coming from another role? Best regards Wolfram ---
**Author:** ![Petr.Simik](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/petr.simik/32/38082_2.png) [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Post date:** [October 5, 2020, 1:10pm UTC](https://discuss.elastic.co/t/user-can-access-index-not-allowed-in-role-security-is-not-working/250993/3 "2020-10-05T13:10:50Z")
Thank you (very fast response I was very surprised) I tried the API it provides this result. Do you see anything interesting there? ```auto $ curl -s -XGET -u test_simik:test_simik "http://oscar1:9200/_security/_authenticate?pretty" { "username" : "test_simik", "roles" : [ "elastic-ntw-hdm_tr69" ], "full_name" : "test_simik", "email" : "petr.simik@xxx.cz", "metadata" : { }, "enabled" : true, "authentication_realm" : { "name" : "default_native", "type" : "native" }, "lookup_realm" : { "name" : "default_native", "type" : "native" } } ``` ---
**Author:** ![Wolfram\_Haussig](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wolfram_haussig/32/70528_2.png) [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\ **Post date:** [October 5, 2020, 1:47pm UTC](https://discuss.elastic.co/t/user-can-access-index-not-allowed-in-role-security-is-not-working/250993/4 "2020-10-05T13:47:50Z")
Unfortunately, I cannot see anything wrong with this. Have you tried accessing the index anonymously? Maybe this index is accessible by everyone? ---
**Author:** ![Petr.Simik](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/petr.simik/32/38082_2.png) [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Post date:** [October 5, 2020, 3:13pm UTC](https://discuss.elastic.co/t/user-can-access-index-not-allowed-in-role-security-is-not-working/250993/5 "2020-10-05T15:13:16Z")
Yes this is the case !!! Thank you, you guided me to a point of the problem. I will explain: working scenario kibana-\>[elastic\_node\_loadbalancer\_only]{anonymous disabled} notworking scenario kibana-\>[elastic\_node\_universal\_node]{anonymous enabled} I forgot that in docker version I have kibana configured against all datanodes with enabled anonymous mode, but the problematic cluster is VM based implementation where I have kibana configured against loadbalancer node running on the same VM with disabled anonymous mode. The reason of having anonymous mode are user clients from old past when elastic did not support security and i am waiting for developers to reconfigure all the client before I disable this anonymous mode. So thank you for very fast responses I did not checked this hypothesis yet but I am sure it is is. so the solution will be to implement docker elastic loadbalancer node with disabled security and configure the kibana against this node.. ```auto #-------enable anonymous mode user: anonymous_user ------- xpack.security.authc: anonymous: username: anonymous_user roles: anonymous_full authz_exception: true ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 2, 2020, 3:13pm UTC](https://discuss.elastic.co/t/user-can-access-index-not-allowed-in-role-security-is-not-working/250993/6 "2020-11-02T15:13:21Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.