Want a user to access only his index

[mohsinhafeez]

Hope you are doing well. I am trying to setup a customer, I want this customer to be able to access only the index which I have created for it. Right now, it is able to access all the indexes, I want it to be able to access only the index which was created for it

. It should also be able to make reports. Could you please help me in setting this up?

I have installed xpack as well.

I have already created the user and the role.

GET /_xpack/security/role/nmdc
{
"nmdc": {
"cluster": [
"monitor"
],
"indices": [
{
"names": [
"nmdc*"
],
"privileges": [
"read",
"view_index_metadata"
],
"field_security": {
"grant": [
"*"
]
}
}
],
"run_as": [
"read",
"nmdc"
],
"metadata": {},
"transient_metadata": {
"enabled": true
}
}
}

GET /_xpack/security/user/nmdc
{
"nmdc": {
"username": "nmdc",
"roles": [
"nmdc",
"kibana_user"
],
"full_name": "nmdc",
"email": "nmdc@nmdc.com",
"metadata": {},
"enabled": true
}
}

Regards,
Mohsin

[TimV (Tim Vernum)]

@mohsinhafeez

Right now, it is able to access all the indexes,

Can you clarify exactly what you mean here? Perhaps provide an example using curl that doesnt behave the way you expect it to?

[mohsinhafeez]

I am monitoring customers networks, I want to be able to provide them with access to kibana, in kibana I want them to be able to access the index which I have created for them(each customer has his own index and should only be able to see it) and should also be able to make reports. I have been trying to achieve this but no success yet, I see all indexes when I login with a customers username and password. Hope this clarifies.

[mohsinhafeez]

Let me put it this way, if I create users and assign roles to them, will I be able to apply restrictions in a way that certain users will be able to see indexes on kibana which are only meant for them? How can I achieve this?

[TimV (Tim Vernum)]

I think he issue is a matter of terminology.

Kibana doesnt show indices, it shows visualisations and dashboards.
Kibana doesn't support restricting access to visualisations, but users should not be able to see any actual data that they do not have permission to access.