# X-Pack Security: Discover doesn't show any data when using Active-Directory Realm with Document-Level-Security

**URL:** https://discuss.elastic.co/t/x-pack-security-discover-doesnt-show-any-data-when-using-active-directory-realm-with-document-level-security/55981
**Category:** Elasticsearch
**Created:** [July 20, 2016, 12:58pm UTC](https://discuss.elastic.co/t/x-pack-security-discover-doesnt-show-any-data-when-using-active-directory-realm-with-document-level-security/55981 "2016-07-20T12:58:25Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![nick.e](https://avatars.discourse-cdn.com/v4/letter/n/8dc957/32.png) [@nick.e](https://discuss.elastic.co/u/nick.e)
#### Post date: [July 20, 2016, 12:58pm UTC](https://discuss.elastic.co/t/x-pack-security-discover-doesnt-show-any-data-when-using-active-directory-realm-with-document-level-security/55981/1 "2016-07-20T12:58:26Z")

</div>

Hello together,

I am quite new to the ELK-Stack.  
Trying to configure the X-Pack Security plugin to work with our Active Directory, I am facing following problem:

The Discover-Tab in Kibana doesn't show any data. Same in the other Tabs, except for the console.  
Doing a search in the console gives me the expected result. (The data matching the field and query configuration in the role)  
The elastic (admin) user still sees everything.

Here a few facts:

- ActiveDirectory-realm configured to map group X to role X (works)

- role X configured in the kibana-management tab as below (works, when not setting query-attribute)

> "X": {  
> "cluster": [  
> "all"  
> ],  
> "indices": [  
> {  
> "names": [  
> "logstash-\*"  
> ],  
> "privileges": [  
> "all"  
> ],  
> "query": "{"term":{"TargetUserName":"ern"}}"  
> }  
> ],  
> "run\_as":   
> }

- When I don't set the query-attribute, everything works and the user in role X can see everything (including the mentioned Tabs)

- As I said before, when using the kibana-console with a user in the role X to search I get the expected result matching the query (all events with TargetUserName=ern)  
`GET logstash-*/_search?pretty`

- Version: All on 5.0 alpha 4

Anyone an idea what I did wrong?

Thanks in advance.

---

<div class="post-metadata">

### Author: ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)
#### Post date: [July 20, 2016, 3:54pm UTC](https://discuss.elastic.co/t/x-pack-security-discover-doesnt-show-any-data-when-using-active-directory-realm-with-document-level-security/55981/2 "2016-07-20T15:54:16Z")

</div>

Heya Nick,

A few things to check, does the user have the `kibana_user` role? All kibana users will need that role or equivalent permissions. I'm curious, how did you verify that role mapping is working?

-Jay

---

<div class="post-metadata">

### Author: ![nick.e](https://avatars.discourse-cdn.com/v4/letter/n/8dc957/32.png) [@nick.e](https://discuss.elastic.co/u/nick.e)
#### Post date: [July 21, 2016, 9:39am UTC](https://discuss.elastic.co/t/x-pack-security-discover-doesnt-show-any-data-when-using-active-directory-realm-with-document-level-security/55981/3 "2016-07-21T09:39:08Z")

</div>

Hey Jay,

thanks!

Adding the kibana\_user role additionally to the custom role solved my problem.  
I thought giving the role "all" Cluster privileges and "all" indices privileges would be enough, but it wasn't.

-Nick

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 1:40pm UTC](https://discuss.elastic.co/t/x-pack-security-discover-doesnt-show-any-data-when-using-active-directory-realm-with-document-level-security/55981/4 "2017-07-06T13:40:44Z")

</div>