# User in Kibana get 403
**URL:** https://discuss.elastic.co/t/user-in-kibana-get-403/192818
**Category:** Elasticsearch
**Tags:** elastic-stack-security
**Created:** [July 30, 2019, 4:36am UTC](https://discuss.elastic.co/t/user-in-kibana-get-403/192818 "2019-07-30T04:36:36Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@Gidi\_Kalef](https://discuss.elastic.co/u/Gidi_Kalef)
#### Post date: [July 30, 2019, 4:36am UTC](https://discuss.elastic.co/t/user-in-kibana-get-403/192818/1 "2019-07-30T04:36:36Z")
Hi Guys,
i create a role with the following permissions and assigned it to user :
```auto
"webrtmon" : {
"cluster" : [],
"indices" : [
{
"names" : [
"*"
],
"privileges" : [
"all",
"manage",
"monitor",
"read",
"index",
"create",
"delete",
"write",
"delete_index",
"view_index_metadata",
"create_index",
"read_cross_cluster",
"manage_follow_index"
],
"allow_restricted_indices" : false
}
],
"applications" : [
{
"application" : "kibana-.kibana",
"privileges" : [
"all"
],
"resources" : [
"*"
]
}
],
"run_as" : [],
"metadata" : { },
"transient_metadata" : {
"enabled" : true
}
}
}
```
In Additional, i assigned to the user "kibana\_user" role,
when i log in into kibana i got the following error:
\<
Error: Request to Elasticsearch failed: {"error":{"root\_cause":[{"type":"security\_exception","reason":"action [indices:data/read/search[can\_match]] is unauthorized for user [webrtmon]"},{"type":"security\_exception","reason":"action [indices:data/read/search[can\_match]] is unauthorized for user [webrtmon]"},{"type":"security\_exception","reason":"action [indices:data/read/search[can\_match]] is unauthorized for user [webrtmon]"},{"type":"security\_exception","reason":"action [indices:data/read/search[can\_match]] is unauthorized for user [webrtmon]"},{"type":"security\_exception","reason":"action [indices:data/read/search[can\_match]] is unauthorized for user [webrtmon]"},{"type":"security\_exception","reason":"action [indices:data/read/search[can\_match]] is unauthorized for user [webrtmon]"},{"type":"security\_exception","reason":"action [indices:data/read/search[can\_match]] is unauthorized for user [webrtmon]"},{"type":"security\_exception","reason":"action [indices:data/read/search[can\_match]] is unauthorized for user [webrtmon]"},{"type":"security\_exception","reason":"action [indices:data/read/search[can\_match]] is unauthorized for user [webrtmon]"},{"type":"security\_exception","reason":"action [indices:data/read/search[can\_match]] is unauthorized for user [webrtmon]"},{"type":"security\_exception","reason":"action [indices:data/read/search[can\_match]] is unauthorized for user [webrtmon]"},{"type":"security\_exception","reason":"action [indices:data/read/search[can\_match]] is unauthorized for user [webrtmon]"},{"type":"security\_exception","reason":"action [indices:data/read/search[can\_match]] is unauthorized for user [webrtmon]"},{"type":"security\_exception","reason":"action [indices:data/read/search[can\_match]] is unauthorized for user [webrtmon]"}],"type":"search\_phase\_execution\_exception","reason":"all shards failed","phase":"can\_match","grouped":true,"failed\_shards":[{"shard":0,"index":"prod-eqx-webrtmon-2019.07.17","node":"tYmlAKs7Q-ivDnwmjnXOyA","reason":{"type":"security\_exception","reason":"action [indices:data/read/search[can\_match]] is unauthorized for user [webrtmon]"}},{"shard":0,"index":"prod-eqx-webrtmon-2019.07.18","node":"ikGwnTHESpK1cihK3QYXdA","reason":{"type":"security\_exception","reason":"action [indices:data/read/search[can\_match]] is unauthorized for user [webrtmon]"}},{"shard":0,"index":"prod-eqx-webrtmon-2019.07.19","node":"ikGwnTHESpK1cihK3QYXdA","reason":{"type":"security\_exception","reason":"action [indices:data/read/search[can\_match]] is unauthorized for user [webrtmon]"}},{"shard":0,"index":"prod-eqx-webrtmon-2019.07.20","node":"ikGwnTHESpK1cihK3QYXdA","reason":{"type":"security\_exception","reason":"action [indices:data/read/search[can\_match]] is unauthorized for user [webrtmon]"}},{"shard":0,"index":"prod-eqx-webrtmon-2019.07.21","node":"ikGwnTHESpK1cihK3QYXdA","reason":{"type":"security\_exception","reason":"action [indices:data/read/search[can\_match]] is unauthorized for user [webrtmon]"}},{"shard":0,"index":"prod-eqx-webrtmon-2019.07.22","node":"BpSucbW5Rf-fnByas2xNiA","reason":{"type":"security\_exception","reason":"action [indices:data/read/search[can\_match]] is unauthorized for user [webrtmon]"}},{"shard":0,"index":"prod-eqx-webrtmon-2019.07.23","node":"tYmlAKs7Q-ivDnwmjnXOyA","reason":{"type":"security\_exception","reason":"action /\>
After i saw the following user i logged in with my superuser(elastic) and ran the command:
```auto
GET _XPACK/security/authenticate
```
once with my superuser and once with the user i created and i see the following diffs with my superuser the respond is
:
```auto
{
"username" : "elastic",
"roles" : [
"superuser"
],
"full_name" : null,
"email" : null,
"metadata" : {
"_reserved" : true
},
"enabled" : true,
"authentication_realm" : {
"name" : "reserved",
"type" : "reserved"
},
"lookup_realm" : {
"name" : "reserved",
"type" : "reserved"
}
}
```
And with my new user respond is :
```auto
{
"username" : "webrtmon",
"roles" : [
"kibana_user",
"webrtmon"
],
"full_name" : null,
"email" : null,
"metadata" : { },
"enabled" : true,
"authentication_realm" : {
"name" : "default_native",
"type" : "native"
},
"lookup_realm" : {
"name" : "default_native",
"type" : "native"
}
}
```
i see they use different realm which i never configured, what could be the reason..?( it happens with every user i create)
and how can i fix it?
---
### Author:  [@ikakavas](https://discuss.elastic.co/u/ikakavas)
#### Post date: [July 30, 2019, 3:35pm UTC](https://discuss.elastic.co/t/user-in-kibana-get-403/192818/2 "2019-07-30T15:35:22Z")
I can't reproduce this with what you gave us, by why do you use this long list of index privileges if you also add "all" to it? Using just "all" would suffice.
---
### Author:  [@Gidi\_Kalef](https://discuss.elastic.co/u/Gidi_Kalef)
#### Post date: [July 30, 2019, 4:02pm UTC](https://discuss.elastic.co/t/user-in-kibana-get-403/192818/3 "2019-07-30T16:02:11Z")
I tried with just all and still getting 403, the example I showed here is after many attempts
even when I gave just all still nothing happend ..
---
### Author:  [@ikakavas](https://discuss.elastic.co/u/ikakavas)
#### Post date: [July 30, 2019, 4:24pm UTC](https://discuss.elastic.co/t/user-in-kibana-get-403/192818/4 "2019-07-30T16:24:01Z")
Apologies, but I can't replicate your issue. Can you start over with a new role definition ( a simple one ) and guide us through the steps that you take to get to this point where you get the errors ( and share the exact errors ) ?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 27, 2019, 4:24pm UTC](https://discuss.elastic.co/t/user-in-kibana-get-403/192818/5 "2019-08-27T16:24:05Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.