# Alerting backend roles not working even after enabling the backend roles

**URL:** <https://forum.opensearch.org/t/alerting-backend-roles-not-working-even-after-enabling-the-backend-roles/21353>\
**Category:** Security\
**Tags:** troubleshoot, configure, alerting, anomaly-detection, security-issue\
**Created:** [September 11, 2024, 5:00pm UTC](https://forum.opensearch.org/t/alerting-backend-roles-not-working-even-after-enabling-the-backend-roles/21353 "2024-09-11T17:00:12Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![sreekanth3](https://avatars.discourse-cdn.com/v4/letter/s/4491bb/32.png) [@sreekanth3](https://forum.opensearch.org/u/sreekanth3)\
**Post date:** [September 11, 2024, 5:00pm UTC](https://forum.opensearch.org/t/alerting-backend-roles-not-working-even-after-enabling-the-backend-roles/21353/1 "2024-09-11T17:00:12Z")

</div>

**Opensearch-2.13** / **Opensearch-2.15**

**Describe the issue** : We are trying to create the alert monitors in different tenants but however all the monitors are being visible in both the tenants and app teams are complaining about the RBAC in the alerting plugin.

Even after enabling the backend roles the rbac with alerting plugin is not working. Below is the settings that are enabled in the cluster.  
**settings\_in\_cluster** :

> {  
> “persistent”: {  
> “cluster”: {  
> “routing”: {  
> “allocation”: {  
> “cluster\_concurrent\_rebalance”: “50”,  
> “node\_concurrent\_recoveries”: “50”,  
> “enable”: “all”,  
> “total\_shards\_per\_node”: “5000”  
> }  
> },  
> “max\_shards\_per\_node”: “5000”  
> },  
> “indices”: {  
> “breaker”: {  
> “fielddata”: {  
> “limit”: “60%”  
> }  
> },  
> “recovery”: {  
> “max\_bytes\_per\_sec”: “1024mb”,  
> “max\_concurrent\_file\_chunks”: “5”,  
> “max\_concurrent\_operations”: “4”  
> }  
> },  
> “opensearch”: {  
> “notifications”: {  
> “general”: {  
> “filter\_by\_backend\_roles”: “true”  
> }  
> }  
> },  
> “plugins”: {  
> “index\_state\_management”: {  
> “metadata\_migration”: {  
> “status”: “1”  
> },  
> “template\_migration”: {  
> “control”: “-1”  
> }  
> },  
> “alerting”: {  
> “filter\_by\_backend\_roles”: “true”  
> }  
> }  
> },  
> “transient”: {  
> “cluster”: {  
> “routing”: {  
> “allocation”: {  
> “disk”: {  
> “watermark”: {  
> “low”: “95%”,  
> “flood\_stage”: “95%”,  
> “high”: “95%”  
> }  
> },  
> “enable”: “all”,  
> “total\_shards\_per\_node”: “5000”  
> }  
> },  
> “info”: {  
> “update”: {  
> “interval”: “1m”  
> }  
> },  
> “max\_shards\_per\_node”: “5000”  
> },  
> “plugins”: {  
> “anomaly\_detection”: {  
> “filter\_by\_backend\_roles”: “true”  
> },  
> “alerting”: {  
> “filter\_by\_backend\_roles”: “true”  
> }  
> }  
> }  
> }

**Roles&users** :  
Below are the configuration I have used for the tenants , Roles, Internal users.  
For the internal users We have provided the pre-defined roles as **alerting\_full\_access**

**Relevant Logs or Screenshots** :

 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/9/961cc2874dd239ffca73c017757dbf7a0c601487.png)  
 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/1/1418b00771cf7c1656d48a0cb86d927cc0e1e134.png)

When I start to create the monitors , the monitors are being appeared on both the tenants regardless in which tenant space they are created.  
I need the help to debug the issue to create the monitors for individual tenants and no app team has to view the other app teams monitors.  
This self service has been a blocker on our side to provide the access to app teams.

---

<div class="post-metadata">

**Author:** ![navyagoli](https://avatars.discourse-cdn.com/v4/letter/n/7bcc69/32.png) [@navyagoli](https://forum.opensearch.org/u/navyagoli)\
**Post date:** [September 12, 2024, 8:03am UTC](https://forum.opensearch.org/t/alerting-backend-roles-not-working-even-after-enabling-the-backend-roles/21353/2 "2024-09-12T08:03:32Z")

</div>

Hi @sreekanth3

We are also in need of this feature please do let us know if you find any solution for this issue, we have also enabled the backend roles and created monitors in two different tenants, but no matter what the monitors are visible in both the tenants irrespective of the tenant where they were created.

Thanks & Regards  
Navya Goli

---

<div class="post-metadata">

**Author:** ![Eugene7](https://avatars.discourse-cdn.com/v4/letter/e/bbce88/32.png) [@Eugene7](https://forum.opensearch.org/u/Eugene7)\
**Post date:** [September 13, 2024, 7:50am UTC](https://forum.opensearch.org/t/alerting-backend-roles-not-working-even-after-enabling-the-backend-roles/21353/3 "2024-09-13T07:50:42Z")

</div>

Hi @navyagoli,

Could you please share the response to the following request in DevTools?

`GET _plugins/_security/api/roles/<your-alert-role>`

Also, please share the list of roles that your admin user has:

`GET _plugins/_security/api/internalusers/<username>`

Thank you!

---

<div class="post-metadata">

**Author:** ![navyagoli](https://avatars.discourse-cdn.com/v4/letter/n/7bcc69/32.png) [@navyagoli](https://forum.opensearch.org/u/navyagoli)\
**Post date:** [September 13, 2024, 8:39am UTC](https://forum.opensearch.org/t/alerting-backend-roles-not-working-even-after-enabling-the-backend-roles/21353/4 "2024-09-13T08:39:30Z")

</div>

Hi @Eugene7,

These are the results for the queries you asked for:

**GET \_plugins/\_security/api/roles/tenant1-role**

{  
“tenant1-role”: {  
“reserved”: false,  
“hidden”: false,  
“cluster\_permissions”: [  
“cluster\_monitor”,  
“cluster:admin/opendistro/alerting/_"  
],  
“index\_permissions”: [  
{  
“index\_patterns”: [  
"_”  
],  
“fls”: ,  
“masked\_fields”: ,  
“allowed\_actions”: [  
“indices\_monitor”,  
“indices:admin/aliases/get”,  
“indices:admin/mappings/get”,  
“indices\_all”  
]  
}  
],  
“tenant\_permissions”: [  
{  
“tenant\_patterns”: [  
“tenant1”  
],  
“allowed\_actions”: [  
“kibana\_all\_write”  
]  
}  
],  
“static”: false  
}  
}

**GET \_plugins/\_security/api/internalusers/tenant1-user**

{  
“tenant1-user”: {  
“hash”: “”,  
“reserved”: false,  
“hidden”: false,  
“backend\_roles”: [  
“alerting\_full\_access”  
],  
“attributes”: {},  
“opendistro\_security\_roles”: ,  
“static”: false  
}  
}

the same set of permissions and roles are given to tenant2 user as well.

Thanks  
Navya Goli

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [September 13, 2024, 2:34pm UTC](https://forum.opensearch.org/t/alerting-backend-roles-not-working-even-after-enabling-the-backend-roles/21353/5 "2024-09-13T14:34:17Z")

</div>

@navyagoli @sreekanth3 According to this GitHub feature request this is a missing and still not implemented feature.

> <https://github.com/opensearch-project/alerting-dashboards-plugin/issues/708>
>
> \*\*Is your feature request related to a problem?\*\*
> A large organization is most …likely to have multiple administrators for managing cluster resources. For example, \`admin\_a\` and \`admin\_b\` could be responsible for managing indices \`index\_x\`, \`index\_y\` and associated resources such as alerts and monitors. Similarly \`admin\_a\`, \`admin\_c\` could be responsible for \`index\_z\`. 
> 
> Alerting does not have a concept of ownership, any user with the right permissions can read/delete alerting resources. \[#138\](https://github.com/opensearch-project/alerting/issues/138) provided some segmentation based on backend roles.   
> 
> To ease the administrative process, Dashboard tenancy provides a way to group related objects together although such support is only available for Dashboard objects such as visualizations, index patterns. For cluster owned items such as alerting, tenancy separation is not available. For example, in the above scenario, \`admin\_a\` would like to group \`index\_x\` and \`index\_y\` related Information in one tenant and \`index\_z\` in another tenant. Such tenant separation is currently available for items such as index patterns but for plugin objects like monitors. 
> 
> 
> 
> \*\*What solution would you like?\*\*
> Would like the ability to group not only Dashboard objects but Cluster/Plugin/Extension objects (specifically alerting) with tenants/\[workspaces\](https://github.com/opensearch-project/OpenSearch-Dashboards/issues/4615)  
> 
> Possible approaches could be to store references to the alerting objects as part of Dashboard tenants or store tenant information as metadata in the alerting object which can then be used later as filter during display.x 
> 
> \*\*What alternatives have you considered?\*\*
> Considered \[#138\](https://github.com/opensearch-project/alerting/issues/138) but is has few drawbacks. It does not address scenarios such as the one mentioned, requires additional backend roles to be created in some instances and end users need to be aware of backend roles that need to be mapped.
> 
> \*\*Do you have any additional context?\*\*
> Add any other context or screenshots about the feature request here.

This is a bug reported a week ago.

> <https://github.com/opensearch-project/OpenSearch-Dashboards/issues/8052>
>
> \*\*Describe the bug\*\*
> 
> There is a bug in the Alerting feature of the OpenSearch… Plugin: Although users can be granted the ability to view items on the Alerting monitor or alert pages by assigning them the alerting\_read\_access\_new role (a new role copied from alerting\_read\_access), the Alerting Items cannot be isolated by Tenant. This means that as long as a user’s role includes alerting\_read\_access\_new, they can see all Alerting Items across the entire system, even if I have added a tenant specific to this user in alerting\_read\_access\_new. 
> 
> \*\*Expected behavior\*\*
> I hope this bug can be fixed in the next version so that user roles can isolate alerting items by tenant.
> 
> \*\*OpenSearch Version\*\*
> 2.15.0
> 
> \*\*Dashboards Version\*\*
> 2.15.0
> 
> \*\*Plugins\*\*
> Alerting
> Reporting
> 
> 
> \*\*Host/Environment (please complete the following information):\*\*
> - OS: Rocky Linux release 8 (x86\_64)

Unfortunately, current Alerting is not a tenant-aware plugin.

---

<div class="post-metadata">

**Author:** ![sreekanth3](https://avatars.discourse-cdn.com/v4/letter/s/4491bb/32.png) [@sreekanth3](https://forum.opensearch.org/u/sreekanth3)\
**Post date:** [September 13, 2024, 3:02pm UTC](https://forum.opensearch.org/t/alerting-backend-roles-not-working-even-after-enabling-the-backend-roles/21353/6 "2024-09-13T15:02:56Z")

</div>

> [@pablo](#):
>
> According to this GitHub feature request this is a missing and still not implemented feature.
> 
> [[FEATURE]Support separation of alerts/monitors/destinations based on tenants/workspaces · Issue #708 · opensearch-project/alerting-dashboards-plugin · GitHub](https://github.com/opensearch-project/alerting-dashboards-plugin/issues/708)
> 
> This is a bug reported a week ago.
> 
> [Alerting items cannot be isolated by tenant. · Issue #1096 · opensearch-project/alerting-dashboards-plugin · GitHub](https://github.com/opensearch-project/OpenSearch-Dashboards/issues/8052)
> 
> Unfortunately, current Alerting is not a tenant-aware plugin.

Thankyou @pablo for the information .Appreciate it.