# What is a good user security strategy in a muti-tiered application?

**URL:** <https://discuss.elastic.co/t/what-is-a-good-user-security-strategy-in-a-muti-tiered-application/69354>\
**Category:** Elasticsearch\
**Created:** [December 18, 2016, 6:22am UTC](https://discuss.elastic.co/t/what-is-a-good-user-security-strategy-in-a-muti-tiered-application/69354 "2016-12-18T06:22:19Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![baden0x1](https://avatars.discourse-cdn.com/v4/letter/b/4da419/32.png) [@baden0x1](https://discuss.elastic.co/u/baden0x1)\
**Post date:** [December 18, 2016, 6:22am UTC](https://discuss.elastic.co/t/what-is-a-good-user-security-strategy-in-a-muti-tiered-application/69354/1 "2016-12-18T06:22:19Z")

</div>

In a multi-tiered application, we've normally got separation / an abstraction layer between the application layer and database. To access the database, the application gets a user name to access the database.

In what I've been reading about [securing ElasticSearch](https://www.elastic.co/guide/en/x-pack/current/xpack-security.html), most of the text discusses direct database access for users. In a multi-user, application, indices and documents within will be secured to a tenant, while keeping a user list in a separate index. Got it.

Now, what about granting the application layer access to the database - now it's completely isolated from front-end users. Next, add on \_user.metadata (hash) to each document as it is written -based on who's document it is.

For retrieval, the application layer will add the logged-in user's meta-data hash.

However, since we are using the application tier's user ID, I just have to ensure that it is in an admin/super-user role in ElasticSearch, correct?

Is this a good strategy for ES or is there a better way of doing this?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 15, 2017, 6:22am UTC](https://discuss.elastic.co/t/what-is-a-good-user-security-strategy-in-a-muti-tiered-application/69354/2 "2017-01-15T06:22:31Z")

</div>

Closed on January 15, 2017, 6:22am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.