# Adding role to user breaks his access

**URL:** <https://forum.opensearch.org/t/adding-role-to-user-breaks-his-access/17315>\
**Category:** Security\
**Created:** [January 3, 2024, 12:08pm UTC](https://forum.opensearch.org/t/adding-role-to-user-breaks-his-access/17315 "2024-01-03T12:08:05Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![rlevitsky](https://avatars.discourse-cdn.com/v4/letter/r/49beb7/32.png) [@rlevitsky](https://forum.opensearch.org/u/rlevitsky)\
**Post date:** [January 3, 2024, 12:08pm UTC](https://forum.opensearch.org/t/adding-role-to-user-breaks-his-access/17315/1 "2024-01-03T12:08:05Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser):  
2.9, 1.3, and even OpenDistro couple years ago

**Describe the issue** :  
We have a user that has 2 roles “sa” and “own\_index” as per “View roles and identities” link. All is working as expected, user is able to access indices, alerting etc.

One day user was added to another group and granted additional role, name it “dev” which has limited access to some indices.

Now user has three roles “dev”, “own\_index”, and “sa” at his “View roles and identities” link. However, it turns out that now user is unable to access the data he was able to access previously.  
It is now acting as he just have “dev” role and no “sa” role.

**Configuration** :  
Pretty straightforward, Keycloak and LDAP as authentication backend.

**Question** :  
Could somebody please point me to the solution for this issue?  
Is there a way for user to gain **all** his roles but not the only **one** randomly-selected role?

---

<div class="post-metadata">

**Author:** ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)\
**Post date:** [January 3, 2024, 12:24pm UTC](https://forum.opensearch.org/t/adding-role-to-user-breaks-his-access/17315/2 "2024-01-03T12:24:47Z")

</div>

Hi @rlevitsky,

Could you please run the belove and share the output ( **NOTE** : please blank if any **sensitive** data):

`curl --insecure -u <username>:<password> -XGET https://<OS_node>:9200/_plugins/_security/authinfo?pretty`

`curl --insecure -u <admin>:<password> -XGET https://<OS_node>:9200/_plugins/_security/api/roles/sa`

`curl --insecure -u <admin>:<password> -XGET https://<OS_node>:9200/_plugins/_security/api/roles/dev`

best,  
mj

---

<div class="post-metadata">

**Author:** ![rlevitsky](https://avatars.discourse-cdn.com/v4/letter/r/49beb7/32.png) [@rlevitsky](https://forum.opensearch.org/u/rlevitsky)\
**Post date:** [February 5, 2024, 8:05am UTC](https://forum.opensearch.org/t/adding-role-to-user-breaks-his-access/17315/3 "2024-02-05T08:05:54Z")

</div>

Hi @Mantas ,  
Sorry missed your reply.  
This issue was posted multiple times here, say, [Users getting least permissions when mapped to multiple roles - #6 by rlevitsky](https://forum.opensearch.org/t/users-getting-least-permissions-when-mapped-to-multiple-roles/5787/6)  
There is a workaround that worked for me: [How is DLS applied when user has multiple roles - #6 by rlevitsky](https://forum.opensearch.org/t/how-is-dls-applied-when-user-has-multiple-roles/2946/6)

However, this wokraround breaks Index Patter updating, [Weird error when trying to update index pattern - #3 by pablo](https://forum.opensearch.org/t/weird-error-when-trying-to-update-index-pattern/17682/3)