# User Not Permitted to Check If Index Exists

**URL:** https://discuss.elastic.co/t/user-not-permitted-to-check-if-index-exists/187917
**Category:** Elasticsearch
**Tags:** elastic-stack-security
**Created:** [June 27, 2019, 8:09pm UTC](https://discuss.elastic.co/t/user-not-permitted-to-check-if-index-exists/187917 "2019-06-27T20:09:58Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![ryh](https://avatars.discourse-cdn.com/v4/letter/r/ba9def/32.png) [@ryh](https://discuss.elastic.co/u/ryh)
#### Post date: [June 27, 2019, 8:09pm UTC](https://discuss.elastic.co/t/user-not-permitted-to-check-if-index-exists/187917/1 "2019-06-27T20:09:58Z")

</div>

Hi,

I have a current role mapping of

```auto
"es_write_only" : {
    "cluster" : [
      "all"
    ],
    "indices" : [
      {
        "names" : [
          "*"
        ],
        "privileges" : [
          "all"
        ],
        "allow_restricted_indices" : false
      }
    ],
    "applications" : [
      {
        "application" : "*",
        "privileges" : [
          "8"
        ],
        "resources" : [
          "all"
        ]
      }
    ],
    "run_as" : [],
    "metadata" : { },
    "transient_metadata" : {
      "enabled" : true
    }
  }

```

But the user with this role isn't allowed to check if the index exists via the python elasticsearch client. I'm getting a 403 error.

Any ideas?

Thanks,  
Ry

---

<div class="post-metadata">

### Author: ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [July 1, 2019, 5:58am UTC](https://discuss.elastic.co/t/user-not-permitted-to-check-if-index-exists/187917/2 "2019-07-01T05:58:47Z")

</div>

> [@ryh](#):
>
> But the user with this role isn't allowed to check if the index exists via the python elasticsearch client. I'm getting a 403 error.

It doesn't look like the role is the actual cause of your problem, that role permits everything.

Can you please provide a complete example?

---

<div class="post-metadata">

### Author: ![ryh](https://avatars.discourse-cdn.com/v4/letter/r/ba9def/32.png) [@ryh](https://discuss.elastic.co/u/ryh)
#### Post date: [July 1, 2019, 6:49pm UTC](https://discuss.elastic.co/t/user-not-permitted-to-check-if-index-exists/187917/3 "2019-07-01T18:49:28Z")

</div>

Hi Tim,

I made a mistake under applications, the privileges was set to 8 instead of \*. This setting works now.

But how can I make restrictions such as only allowing the following privileges on indices:  
"privileges": ["write", "create\_index", "create", "index", "read"]

and still be able to check if the index exists? Is the permission under applications or indices? With the provided privileges, I'm getting a permissions error.

Thanks,  
Ry

---

<div class="post-metadata">

### Author: ![ryh](https://avatars.discourse-cdn.com/v4/letter/r/ba9def/32.png) [@ryh](https://discuss.elastic.co/u/ryh)
#### Post date: [July 1, 2019, 6:54pm UTC](https://discuss.elastic.co/t/user-not-permitted-to-check-if-index-exists/187917/4 "2019-07-01T18:54:37Z")

</div>

Here are the settings and result  
create role with limited index privileges

```auto
curl -X PUT "elastic:changeme@localhost:9200/_security/role/es_write_only" -H 'Content-Type: application/json' -d'
{
  "cluster" : [
      "all"
    ],
    "indices" : [
      {
        "names" : [
          "*"
        ],
        "privileges": ["write", "create_index", "create", "index", "read"],
        "allow_restricted_indices" : false
      }
    ],
    "applications" : [
      {
        "application" : "*",
        "privileges" : [
          "*"
        ],
        "resources" : [
          "all"
        ]
      }
    ]
}
'

```

assign role to user

```auto
curl -X POST "elastic:changeme@localhost:9200/_security/user/some_app" -H 'Content-Type: application/json' -d'
{
  "password" : "testtest",
  "roles" : ["es_write_only"]
}
'

```

elastic user to show all indices

```auto
curl elastic:changeme@localhost:9200/_cat/indices?v
health status index uuid pri rep docs.count docs.deleted store.size pri.store.size
green open .kibana_1 zTZKCuXAQauxZJG0acOJGA 1 0 5 1 39.4kb 39.4kb
green open .security-7 600qyaUsQB2u_dRtm_tBvA 1 0 6 6 34.3kb 34.3kb
yellow open unspecified-abc UxEc8jzSRMyYvMti68ENiA 1 1 274 0 157.2kb 157.2kb
green open .kibana_task_manager yyEJyEY_SjmEmvTWP3fUow 1 0 2 0 29.6kb 29.6kb

```

use some\_app user to check if unspecified-abc exists

```auto
curl -I some_app:testtest@localhost:9200/unspecified-abc
HTTP/1.1 403 Forbidden
content-type: application/json; charset=UTF-8
content-length: 245

```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 29, 2019, 7:03pm UTC](https://discuss.elastic.co/t/user-not-permitted-to-check-if-index-exists/187917/5 "2019-07-29T19:03:25Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.