# Anonymous Dashboard Access

**URL:** <https://forum.opensearch.org/t/anonymous-dashboard-access/18876>\
**Category:** OpenSearch Dashboards\
**Created:** [April 16, 2024, 8:28am UTC](https://forum.opensearch.org/t/anonymous-dashboard-access/18876 "2024-04-16T08:28:12Z")\
**Posts on this page:** 16\
**Page:** 1

<div class="post-metadata">

**Author:** ![big-edd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/big-edd/32/6282_2.png) [@big-edd](https://forum.opensearch.org/u/big-edd)\
**Post date:** [April 16, 2024, 8:28am UTC](https://forum.opensearch.org/t/anonymous-dashboard-access/18876/1 "2024-04-16T08:28:12Z")

</div>

Hello Everyone,

Using the official documentation I have to set up anonymous dashboard access, but when browse to [http://host:5601](http://host:5601) or [http://host:5601/auth/anonymous](http://host:5601/auth/anonymous) I am still prompted for a username and password.

The following is what I added/updated in the configs.

opensearch… … config.yml

```auto
    http:
      anonymous_auth_enabled: true

```

opensearch\_dashboards.yml

```auto
opensearch_security.auth.anonymous_auth_enabled: true

```

opensearch… … roles.yml

```auto
## Added for anonymous read only access.
anonymous_users_role:
  reserved: false
  hidden: false
  cluster_permissions:
    - "*"
  index_permissions:
    - index_patterns:
        - "smtp_data_*"
      allowed_actions:
        - "read"

```

opensearch… … roles\_mapping.yml

```auto
anonymous_users_role:
  reserved: false
  hidden: false
  backend_roles:
  - "opendistro_security_anonymous_backendrole"
  description: "Added for anonymous read only access"

```

Cheers,  
Eddie.

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [April 16, 2024, 10:23am UTC](https://forum.opensearch.org/t/anonymous-dashboard-access/18876/2 "2024-04-16T10:23:28Z")

</div>

@big-edd This configuration should work. How do you deploy your cluster?  
What is the version of your OS deployment?

---

<div class="post-metadata">

**Author:** ![big-edd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/big-edd/32/6282_2.png) [@big-edd](https://forum.opensearch.org/u/big-edd)\
**Post date:** [April 16, 2024, 11:41pm UTC](https://forum.opensearch.org/t/anonymous-dashboard-access/18876/3 "2024-04-16T23:41:51Z")

</div>

Deployed with docker compose.  
Built FROM opensearchproject/opensearch-dashboards:latest

---

<div class="post-metadata">

**Author:** ![big-edd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/big-edd/32/6282_2.png) [@big-edd](https://forum.opensearch.org/u/big-edd)\
**Post date:** [April 17, 2024, 3:51am UTC](https://forum.opensearch.org/t/anonymous-dashboard-access/18876/4 "2024-04-17T03:51:21Z")

</div>

Maybe this will help a little… …

```auto
$ docker logs -n 0 --follow feedsearch-dash-1
{"type":"log","@timestamp":"2024-04-17T03:42:51Z","tags":["info","plugins","securityDashboards"],"pid":1,"message":"The Redirect Path is /"}
{"type":"log","@timestamp":"2024-04-17T03:42:51Z","tags":["error","plugins","securityDashboards"],"pid":1,"message":"Failed authentication: Error: Authentication Exception. Redirecting to Login Page"}
{"type":"response","@timestamp":"2024-04-17T03:42:51Z","tags":[],"pid":1,"method":"get","statusCode":302,"req":{"url":"/auth/anonymous","method":"get","headers":{"host":"poc-dash:5601","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0","accept":"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/jxl,image/webp,*/*;q=0.8","accept-language":"en-US,en;q=0.5","accept-encoding":"gzip, deflate","sec-gpc":"1","connection":"keep-alive","upgrade-insecure-requests":"1"},"remoteAddress":"172.28.246.2","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0"},"res":{"statusCode":302,"responseTime":45,"contentLength":9},"message":"GET /auth/anonymous 302 45ms - 9.0B"}
{"type":"response","@timestamp":"2024-04-17T03:42:51Z","tags":[],"pid":1,"method":"get","statusCode":200,"req":{"url":"/app/login","method":"get","headers":{"host":"poc-dash:5601","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0","accept":"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/jxl,image/webp,*/*;q=0.8","accept-language":"en-US,en;q=0.5","accept-encoding":"gzip, deflate","sec-gpc":"1","connection":"keep-alive","upgrade-insecure-requests":"1"},"remoteAddress":"172.28.246.2","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0"},"res":{"statusCode":200,"responseTime":15,"contentLength":9},"message":"GET /app/login 200 15ms - 9.0B"}
{"type":"response","@timestamp":"2024-04-17T03:42:51Z","tags":[],"pid":1,"method":"get","statusCode":200,"req":{"url":"/ui/logos/opensearch_spinner_on_light.svg","method":"get","headers":{"host":"poc-dash:5601","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0","accept":"image/avif,image/jxl,image/webp,*/*","accept-language":"en-US,en;q=0.5","accept-encoding":"gzip, deflate","sec-gpc":"1","connection":"keep-alive","referer":"http://poc-dash:5601/app/login"},"remoteAddress":"172.28.246.2","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0","referer":"http://poc-dash:5601/app/login"},"res":{"statusCode":200,"responseTime":32,"contentLength":9},"message":"GET /ui/logos/opensearch_spinner_on_light.svg 200 32ms - 9.0B"}
{"type":"response","@timestamp":"2024-04-17T03:42:51Z","tags":[],"pid":1,"method":"get","statusCode":200,"req":{"url":"/ui/logos/opensearch_mark_on_light.svg","method":"get","headers":{"host":"poc-dash:5601","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0","accept":"image/avif,image/jxl,image/webp,*/*","accept-language":"en-US,en;q=0.5","accept-encoding":"gzip, deflate","sec-gpc":"1","connection":"keep-alive","referer":"http://poc-dash:5601/app/login"},"remoteAddress":"172.28.246.2","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0","referer":"http://poc-dash:5601/app/login"},"res":{"statusCode":200,"responseTime":36,"contentLength":9},"message":"GET /ui/logos/opensearch_mark_on_light.svg 200 36ms - 9.0B"}
{"type":"response","@timestamp":"2024-04-17T03:42:51Z","tags":["api"],"pid":1,"method":"get","statusCode":304,"req":{"url":"/bootstrap.js","method":"get","headers":{"host":"poc-dash:5601","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0","accept":"*/*","accept-language":"en-US,en;q=0.5","accept-encoding":"gzip, deflate","sec-gpc":"1","connection":"keep-alive","referer":"http://poc-dash:5601/app/login","if-none-match":"\"119fe1a7a96933af6169ac5c2ad34bb90f792421-gzip\""},"remoteAddress":"172.28.246.2","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0","referer":"http://poc-dash:5601/app/login"},"res":{"statusCode":304,"responseTime":48,"contentLength":9},"message":"GET /bootstrap.js 304 48ms - 9.0B"}
{"type":"response","@timestamp":"2024-04-17T03:42:51Z","tags":[],"pid":1,"method":"get","statusCode":200,"req":{"url":"/ui/fonts/source_sans_3/SourceSans3-Regular.ttf.woff2","method":"get","headers":{"host":"poc-dash:5601","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0","accept":"application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8","accept-language":"en-US,en;q=0.5","accept-encoding":"identity","sec-gpc":"1","connection":"keep-alive","referer":"http://poc-dash:5601/app/login"},"remoteAddress":"172.28.246.2","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0","referer":"http://poc-dash:5601/app/login"},"res":{"statusCode":200,"responseTime":251,"contentLength":9},"message":"GET /ui/fonts/source_sans_3/SourceSans3-Regular.ttf.woff2 200 251ms - 9.0B"}
{"type":"response","@timestamp":"2024-04-17T03:42:52Z","tags":[],"pid":1,"method":"get","statusCode":200,"req":{"url":"/ui/favicons/apple-touch-icon.png","method":"get","headers":{"host":"poc-dash:5601","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0","accept":"image/avif,image/jxl,image/webp,*/*","accept-language":"en-US,en;q=0.5","accept-encoding":"gzip, deflate","sec-gpc":"1","connection":"keep-alive","referer":"http://poc-dash:5601/app/login"},"remoteAddress":"172.28.246.2","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0","referer":"http://poc-dash:5601/app/login"},"res":{"statusCode":200,"responseTime":10,"contentLength":9},"message":"GET /ui/favicons/apple-touch-icon.png 200 10ms - 9.0B"}
{"type":"response","@timestamp":"2024-04-17T03:42:52Z","tags":[],"pid":1,"method":"get","statusCode":200,"req":{"url":"/ui/favicons/favicon-16x16.png","method":"get","headers":{"host":"poc-dash:5601","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0","accept":"image/avif,image/jxl,image/webp,*/*","accept-language":"en-US,en;q=0.5","accept-encoding":"gzip, deflate","sec-gpc":"1","connection":"keep-alive","referer":"http://poc-dash:5601/app/login"},"remoteAddress":"172.28.246.2","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0","referer":"http://poc-dash:5601/app/login"},"res":{"statusCode":200,"responseTime":15,"contentLength":9},"message":"GET /ui/favicons/favicon-16x16.png 200 15ms - 9.0B"}
{"type":"response","@timestamp":"2024-04-17T03:42:53Z","tags":[],"pid":1,"method":"get","statusCode":200,"req":{"url":"/7326/bundles/osd-ui-shared-deps/osd-ui-shared-deps.v8.light.css","method":"get","headers":{"host":"poc-dash:5601","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0","accept":"text/css,*/*;q=0.1","accept-language":"en-US,en;q=0.5","accept-encoding":"gzip, deflate","sec-gpc":"1","connection":"keep-alive","referer":"http://poc-dash:5601/app/login"},"remoteAddress":"172.28.246.2","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0","referer":"http://poc-dash:5601/app/login"},"res":{"statusCode":200,"responseTime":2,"contentLength":9},"message":"GET /7326/bundles/osd-ui-shared-deps/osd-ui-shared-deps.v8.light.css 200 2ms - 9.0B"}
{"type":"response","@timestamp":"2024-04-17T03:42:53Z","tags":[],"pid":1,"method":"get","statusCode":200,"req":{"url":"/7326/bundles/osd-ui-shared-deps/osd-ui-shared-deps.css","method":"get","headers":{"host":"poc-dash:5601","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0","accept":"text/css,*/*;q=0.1","accept-language":"en-US,en;q=0.5","accept-encoding":"gzip, deflate","sec-gpc":"1","connection":"keep-alive","referer":"http://poc-dash:5601/app/login"},"remoteAddress":"172.28.246.2","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0","referer":"http://poc-dash:5601/app/login"},"res":{"statusCode":200,"responseTime":4,"contentLength":9},"message":"GET /7326/bundles/osd-ui-shared-deps/osd-ui-shared-deps.css 200 4ms - 9.0B"}
{"type":"response","@timestamp":"2024-04-17T03:42:53Z","tags":[],"pid":1,"method":"get","statusCode":200,"req":{"url":"/node_modules/@osd/ui-framework/dist/kui_next_light.css","method":"get","headers":{"host":"poc-dash:5601","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0","accept":"text/css,*/*;q=0.1","accept-language":"en-US,en;q=0.5","accept-encoding":"gzip, deflate","sec-gpc":"1","connection":"keep-alive","referer":"http://poc-dash:5601/app/login"},"remoteAddress":"172.28.246.2","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0","referer":"http://poc-dash:5601/app/login"},"res":{"statusCode":200,"responseTime":21,"contentLength":9},"message":"GET /node_modules/@osd/ui-framework/dist/kui_next_light.css 200 21ms - 9.0B"}
{"type":"response","@timestamp":"2024-04-17T03:42:53Z","tags":[],"pid":1,"method":"get","statusCode":200,"req":{"url":"/ui/legacy_light_theme.css","method":"get","headers":{"host":"poc-dash:5601","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0","accept":"text/css,*/*;q=0.1","accept-language":"en-US,en;q=0.5","accept-encoding":"gzip, deflate","sec-gpc":"1","connection":"keep-alive","referer":"http://poc-dash:5601/app/login"},"remoteAddress":"172.28.246.2","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0","referer":"http://poc-dash:5601/app/login"},"res":{"statusCode":200,"responseTime":18,"contentLength":9},"message":"GET /ui/legacy_light_theme.css 200 18ms - 9.0B"}
{"type":"response","@timestamp":"2024-04-17T03:42:53Z","tags":[],"pid":1,"method":"get","statusCode":304,"req":{"url":"/translations/en.json","method":"get","headers":{"host":"poc-dash:5601","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0","accept":"*/*","accept-language":"en-US,en;q=0.5","accept-encoding":"gzip, deflate","referer":"http://poc-dash:5601/app/login","sec-gpc":"1","connection":"keep-alive","if-none-match":"\"37992637719f97813c3068cfbf877b2d3bb43b97\""},"remoteAddress":"172.28.246.2","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0","referer":"http://poc-dash:5601/app/login"},"res":{"statusCode":304,"responseTime":1,"contentLength":9},"message":"GET /translations/en.json 304 1ms - 9.0B"}
{"type":"response","@timestamp":"2024-04-17T03:42:54Z","tags":[],"pid":1,"method":"post","statusCode":401,"req":{"url":"/api/ism/apiCaller","method":"post","headers":{"host":"poc-dash:5601","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0","accept":"*/*","accept-language":"en-US,en;q=0.5","accept-encoding":"gzip, deflate","referer":"http://poc-dash:5601/app/login","content-type":"application/json","osd-version":"2.12.0","osd-xsrf":"osd-fetch","content-length":"82","origin":"http://poc-dash:5601","sec-gpc":"1","connection":"keep-alive"},"remoteAddress":"172.28.246.2","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0","referer":"http://poc-dash:5601/app/login"},"res":{"statusCode":401,"responseTime":2,"contentLength":9},"message":"POST /api/ism/apiCaller 401 2ms - 9.0B"}
{"type":"response","@timestamp":"2024-04-17T03:42:54Z","tags":[],"pid":1,"method":"get","statusCode":401,"req":{"url":"/api/v1/restapiinfo","method":"get","headers":{"host":"poc-dash:5601","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0","accept":"*/*","accept-language":"en-US,en;q=0.5","accept-encoding":"gzip, deflate","referer":"http://poc-dash:5601/app/login","content-type":"application/json","osd-version":"2.12.0","osd-xsrf":"osd-fetch","sec-gpc":"1","connection":"keep-alive"},"remoteAddress":"172.28.246.2","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0","referer":"http://poc-dash:5601/app/login"},"res":{"statusCode":401,"responseTime":1,"contentLength":9},"message":"GET /api/v1/restapiinfo 401 1ms - 9.0B"}
{"type":"response","@timestamp":"2024-04-17T03:42:54Z","tags":[],"pid":1,"method":"get","statusCode":401,"req":{"url":"/api/v1/configuration/account","method":"get","headers":{"host":"poc-dash:5601","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0","accept":"*/*","accept-language":"en-US,en;q=0.5","accept-encoding":"gzip, deflate","referer":"http://poc-dash:5601/app/login","content-type":"application/json","osd-version":"2.12.0","osd-xsrf":"osd-fetch","sec-gpc":"1","connection":"keep-alive"},"remoteAddress":"172.28.246.2","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0","referer":"http://poc-dash:5601/app/login"},"res":{"statusCode":401,"responseTime":1,"contentLength":9},"message":"GET /api/v1/configuration/account 401 1ms - 9.0B"}
{"type":"response","@timestamp":"2024-04-17T03:42:54Z","tags":[],"pid":1,"method":"get","statusCode":401,"req":{"url":"/api/v1/auth/dashboardsinfo","method":"get","headers":{"host":"poc-dash:5601","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0","accept":"*/*","accept-language":"en-US,en;q=0.5","accept-encoding":"gzip, deflate","referer":"http://poc-dash:5601/app/login","content-type":"application/json","osd-version":"2.12.0","osd-xsrf":"osd-fetch","sec-gpc":"1","connection":"keep-alive"},"remoteAddress":"172.28.246.2","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0","referer":"http://poc-dash:5601/app/login"},"res":{"statusCode":401,"responseTime":1,"contentLength":9},"message":"GET /api/v1/auth/dashboardsinfo 401 1ms - 9.0B"}
{"type":"response","@timestamp":"2024-04-17T03:42:54Z","tags":[],"pid":1,"method":"post","statusCode":200,"req":{"url":"/api/core/capabilities","method":"post","headers":{"host":"poc-dash:5601","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0","accept":"*/*","accept-language":"en-US,en;q=0.5","accept-encoding":"gzip, deflate","referer":"http://poc-dash:5601/app/login","content-type":"application/json","osd-version":"2.12.0","osd-xsrf":"osd-fetch","content-length":"759","origin":"http://poc-dash:5601","sec-gpc":"1","connection":"keep-alive"},"remoteAddress":"172.28.246.2","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0","referer":"http://poc-dash:5601/app/login"},"res":{"statusCode":200,"responseTime":5,"contentLength":9},"message":"POST /api/core/capabilities 200 5ms - 9.0B"}
{"type":"response","@timestamp":"2024-04-17T03:42:54Z","tags":[],"pid":1,"method":"get","statusCode":401,"req":{"url":"/api/v1/configuration/account","method":"get","headers":{"host":"poc-dash:5601","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0","accept":"*/*","accept-language":"en-US,en;q=0.5","accept-encoding":"gzip, deflate","referer":"http://poc-dash:5601/app/login","content-type":"application/json","osd-version":"2.12.0","osd-xsrf":"osd-fetch","sec-gpc":"1","connection":"keep-alive"},"remoteAddress":"172.28.246.2","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0","referer":"http://poc-dash:5601/app/login"},"res":{"statusCode":401,"responseTime":1,"contentLength":9},"message":"GET /api/v1/configuration/account 401 1ms - 9.0B"}
{"type":"response","@timestamp":"2024-04-17T03:42:54Z","tags":[],"pid":1,"method":"get","statusCode":401,"req":{"url":"/api/v1/multitenancy/tenant","method":"get","headers":{"host":"poc-dash:5601","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0","accept":"*/*","accept-language":"en-US,en;q=0.5","accept-encoding":"gzip, deflate","referer":"http://poc-dash:5601/app/login","content-type":"application/json","osd-version":"2.12.0","osd-xsrf":"osd-fetch","sec-gpc":"1","connection":"keep-alive"},"remoteAddress":"172.28.246.2","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0","referer":"http://poc-dash:5601/app/login"},"res":{"statusCode":401,"responseTime":1,"contentLength":9},"message":"GET /api/v1/multitenancy/tenant 401 1ms - 9.0B"}
{"type":"response","@timestamp":"2024-04-17T03:42:54Z","tags":[],"pid":1,"method":"get","statusCode":401,"req":{"url":"/api/dataconnections","method":"get","headers":{"host":"poc-dash:5601","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0","accept":"*/*","accept-language":"en-US,en;q=0.5","accept-encoding":"gzip, deflate","referer":"http://poc-dash:5601/app/login","content-type":"application/json","osd-version":"2.12.0","osd-xsrf":"osd-fetch","sec-gpc":"1","connection":"keep-alive"},"remoteAddress":"172.28.246.2","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0","referer":"http://poc-dash:5601/app/login"},"res":{"statusCode":401,"responseTime":1,"contentLength":9},"message":"GET /api/dataconnections 401 1ms - 9.0B"}
{"type":"response","@timestamp":"2024-04-17T03:42:55Z","tags":[],"pid":1,"method":"get","statusCode":200,"req":{"url":"/ui/logos/opensearch_on_light.svg","method":"get","headers":{"host":"poc-dash:5601","user-agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0","accept":"image/avif,image/jxl,image/webp,*/*","accept-language":"en-US,en;q=0.5","accept-encoding":"gzip, deflate","sec-gpc":"1","connection":"keep-alive","referer":"http://poc-dash:5601/app/login"},"remoteAddress":"172.28.246.2","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0","referer":"http://poc-dash:5601/app/login"},"res":{"statusCode":200,"responseTime":2,"contentLength":9},"message":"GET /ui/logos/opensearch_on_light.svg 200 2ms - 9.0B"}

```

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [April 17, 2024, 8:30pm UTC](https://forum.opensearch.org/t/anonymous-dashboard-access/18876/5 "2024-04-17T20:30:53Z")

</div>

@big-edd Could you check if you all the configuration files are correctly mapped in the OpenSearch and OpenSearch Dashboards containers?

Also pleaee ensure that all mapped files belongs to opensearch user inside the containers.

---

<div class="post-metadata">

**Author:** ![big-edd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/big-edd/32/6282_2.png) [@big-edd](https://forum.opensearch.org/u/big-edd)\
**Post date:** [April 18, 2024, 1:21am UTC](https://forum.opensearch.org/t/anonymous-dashboard-access/18876/6 "2024-04-18T01:21:55Z")

</div>

@pablo

They look to be mapped OK, as I can see my additions/updates within the containers.

* * *

Dashboards:

```auto
$ cd /usr/share/opensearch-dashboards/config/

```

* * *

opensearch\_dashboards.yml

```auto
$ ls -l opensearch_dashboards.yml
-rw-rw-r--. 1 opensearch-dashboards opensearch-dashboards 594 Apr 16 07:43 opensearch_dashboards.yml
$ grep opensearch_security.auth.anonymous_auth_enabled opensearch_dashboards.yml
opensearch_security.auth.anonymous_auth_enabled: true

```

* * *

OpenSearch:

```auto
$ cd /usr/share/opensearch/config/opensearch-security

```

* * *

config.yml

```auto
$ ls -l config.yml
-rw-rw-r--. 1 opensearch opensearch 10063 Apr 16 06:13 config.yml
$ grep anonymous_auth_enabled config.yml
      anonymous_auth_enabled: true

```

* * *

roles.yml

```auto
$ ls -l roles.yml
-rw-rw-r--. 1 opensearch opensearch 14478 Apr 16 07:51 roles.yml
$ grep -A 10 anonymous_users_role roles.yml
anonymous_users_role:
  reserved: false
  hidden: false
  cluster_permissions:
    - "*"
  index_permissions:
    - index_patterns:
        - "smtp_data_*"
      allowed_actions:
        - "read"

```

* * *

roles\_mapping.yml

```auto
$ ls -l roles_mapping.yml
-rw-rw-r--. 1 opensearch opensearch 1021 Apr 16 08:19 roles_mapping.yml
$ grep -A 6 anonymous_users_role roles_mapping.yml
anonymous_users_role:
  reserved: false
  hidden: false
  backend_roles:
  - "opendistro_security_anonymous_backendrole"
  description: "Added for anonymous read only access"

```

* * *

Cheers,  
Eddie.

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [April 18, 2024, 8:41pm UTC](https://forum.opensearch.org/t/anonymous-dashboard-access/18876/7 "2024-04-18T20:41:28Z")

</div>

@big-edd Thanks for checking. Could you run the below command against the OpenSearch node and share the results?

```auto
curl --insecure https://<OpenSearch_node_FQDN_or_IP>:9200/_plugins/_security/authinfo?pretty

```

---

<div class="post-metadata">

**Author:** ![big-edd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/big-edd/32/6282_2.png) [@big-edd](https://forum.opensearch.org/u/big-edd)\
**Post date:** [April 18, 2024, 11:13pm UTC](https://forum.opensearch.org/t/anonymous-dashboard-access/18876/8 "2024-04-18T23:13:19Z")

</div>

Output:

```auto
{
  "user" : "User [name=admin, backend_roles=[admin], requestedTenant=null]",
  "user_name" : "admin",
  "user_requested_tenant" : null,
  "remote_address" : "172.21.0.1:43632",
  "backend_roles" : [
    "admin"
  ],
  "custom_attribute_names" : [],
  "roles" : [
    "own_index",
    "all_access"
  ],
  "tenants" : {
    "global_tenant" : true,
    "admin_tenant" : true,
    "admin" : true
  },
  "principal" : null,
  "peer_certificates" : "0",
  "sso_logout_url" : null
}

```

Since I do not see the anonymous user and role above, it is not using the config as expected?

---

<div class="post-metadata">

**Author:** ![big-edd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/big-edd/32/6282_2.png) [@big-edd](https://forum.opensearch.org/u/big-edd)\
**Post date:** [April 19, 2024, 6:14am UTC](https://forum.opensearch.org/t/anonymous-dashboard-access/18876/9 "2024-04-19T06:14:36Z")

</div>

Could this be why? … …

```auto
$ docker logs feedsearch-osearch-1 | grep roles

```

```auto
.. [WARN][o.o.s.OpenSearchSecurityPlugin] [opensearch] File /usr/share/opensearch/config/opensearch-security/roles.yml has insecure file permissions (should be 0600)
.. [WARN][o.o.s.OpenSearchSecurityPlugin] [opensearch] File /usr/share/opensearch/config/opensearch-security/roles_mapping.yml has insecure file permissions (should be 0600)
.. [INFO][o.o.n.Node] [opensearch] node name [opensearch], node ID [q-k-tb_8Qjq1uf0q0MbOxQ], cluster name [docker-cluster], roles [ingest, remote_cluster_client, data, cluster_manager]
.. [INFO][o.o.s.s.ConfigHelper] [opensearch] Will update 'roles' with /usr/share/opensearch/config/opensearch-security/roles.yml and populate it with empty doc if file missing and populateEmptyIfFileMissing=false
.. [INFO][o.o.s.s.ConfigHelper] [opensearch] Index .opendistro_security already contains doc with id roles, skipping update.
.. [INFO][o.o.s.s.ConfigHelper] [opensearch] Will update 'rolesmapping' with /usr/share/opensearch/config/opensearch-security/roles_mapping.yml and populate it with empty doc if file missing and populateEmptyIfFileMissing=false
.. [INFO][o.o.s.s.ConfigHelper] [opensearch] Index .opendistro_security already contains doc with id rolesmapping, skipping update.

```

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [April 19, 2024, 11:01pm UTC](https://forum.opensearch.org/t/anonymous-dashboard-access/18876/10 "2024-04-19T23:01:28Z")

</div>

@big-edd With anonymous authetication enabled you don’t need to run curl command with user and password. Please run the curl command as I posted in my last message. Share the output even if you’ll get an error.

How did you update roles and roles\_mapping? You must use either OpenSearch Dashboards or securityadmin.sh.

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [April 19, 2024, 11:05pm UTC](https://forum.opensearch.org/t/anonymous-dashboard-access/18876/11 "2024-04-19T23:05:38Z")

</div>

Also, please run the below command and share the output.

```auto
curl --insecure -u admin:<password> https://<OpenSearch_node_FQDN_or_IP>:9200/_plugins/_security/api/securityconfig?pretty

```

---

<div class="post-metadata">

**Author:** ![big-edd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/big-edd/32/6282_2.png) [@big-edd](https://forum.opensearch.org/u/big-edd)\
**Post date:** [April 21, 2024, 11:16am UTC](https://forum.opensearch.org/t/anonymous-dashboard-access/18876/12 "2024-04-21T11:16:26Z")

</div>

Hello,

I only changed the config files to update roles and roles\_mapping.  
Did not realize that we must use either securityadmin.sh or OpenSearch Dashboards.  
How do people automate it? We would like it to happen as the containers are deployed.

$ curl --insecure [https://localhost:9200/\_plugins/\_security/authinfo?pretty](https://localhost:9200/_plugins/_security/authinfo?pretty)

```auto
(No output). 

```

$ curl --insecure -u admin:\*\*\*\*\*\*\*\*\* [https://localhost:9200/\_plugins/\_security/api/securityconfig?pretty](https://localhost:9200/_plugins/_security/api/securityconfig?pretty)

```auto
{
  "config" : {
    "dynamic" : {
      "filtered_alias_mode" : "warn",
      "disable_rest_auth" : false,
      "disable_intertransport_auth" : false,
      "respect_request_indices_options" : false,
      "kibana" : {
        "multitenancy_enabled" : true,
        "private_tenant_enabled" : true,
        "default_tenant" : "",
        "server_username" : "kibanaserver",
        "index" : ".kibana"
      },
      "http" : {
        "anonymous_auth_enabled" : false,
        "xff" : {
          "enabled" : false,
          "internalProxies" : "192\\.168\\.0\\.10|192\\.168\\.0\\.11",
          "remoteIpHeader" : "X-Forwarded-For"
        }
      },
      "authc" : {
        "jwt_auth_domain" : {
          "http_enabled" : false,
          "order" : 0,
          "http_authenticator" : {
            "challenge" : false,
            "type" : "jwt",
            "config" : {
              "signing_key" : "base64 encoded HMAC key or public RSA/ECDSA pem key",
              "jwt_header" : "Authorization",
              "jwt_clock_skew_tolerance_seconds" : 30
            }
          },
          "authentication_backend" : {
            "type" : "noop",
            "config" : { }
          },
          "description" : "Authenticate via Json Web Token"
        },
        "ldap" : {
          "http_enabled" : false,
          "order" : 5,
          "http_authenticator" : {
            "challenge" : false,
            "type" : "basic",
            "config" : { }
          },
          "authentication_backend" : {
            "type" : "ldap",
            "config" : {
              "enable_ssl" : false,
              "enable_start_tls" : false,
              "enable_ssl_client_auth" : false,
              "verify_hostnames" : true,
              "hosts" : [
                "localhost:8389"
              ],
              "userbase" : "ou=people,dc=example,dc=com",
              "usersearch" : "(sAMAccountName={0})"
            }
          },
          "description" : "Authenticate via LDAP or Active Directory"
        },
        "basic_internal_auth_domain" : {
          "http_enabled" : true,
          "order" : 4,
          "http_authenticator" : {
            "challenge" : true,
            "type" : "basic",
            "config" : { }
          },
          "authentication_backend" : {
            "type" : "intern",
            "config" : { }
          },
          "description" : "Authenticate via HTTP Basic against internal users database"
        },
        "proxy_auth_domain" : {
          "http_enabled" : false,
          "order" : 3,
          "http_authenticator" : {
            "challenge" : false,
            "type" : "proxy",
            "config" : {
              "user_header" : "x-proxy-user",
              "roles_header" : "x-proxy-roles"
            }
          },
          "authentication_backend" : {
            "type" : "noop",
            "config" : { }
          },
          "description" : "Authenticate via proxy"
        },
        "clientcert_auth_domain" : {
          "http_enabled" : false,
          "order" : 2,
          "http_authenticator" : {
            "challenge" : false,
            "type" : "clientcert",
            "config" : {
              "username_attribute" : "cn"
            }
          },
          "authentication_backend" : {
            "type" : "noop",
            "config" : { }
          },
          "description" : "Authenticate via SSL client certificates"
        },
        "kerberos_auth_domain" : {
          "http_enabled" : false,
          "order" : 6,
          "http_authenticator" : {
            "challenge" : true,
            "type" : "kerberos",
            "config" : {
              "krb_debug" : false,
              "strip_realm_from_principal" : true
            }
          },
          "authentication_backend" : {
            "type" : "noop",
            "config" : { }
          }
        }
      },
      "authz" : {
        "roles_from_another_ldap" : {
          "http_enabled" : false,
          "authorization_backend" : {
            "type" : "ldap",
            "config" : { }
          },
          "description" : "Authorize via another Active Directory"
        },
        "roles_from_myldap" : {
          "http_enabled" : false,
          "authorization_backend" : {
            "type" : "ldap",
            "config" : {
              "enable_ssl" : false,
              "enable_start_tls" : false,
              "enable_ssl_client_auth" : false,
              "verify_hostnames" : true,
              "hosts" : [
                "localhost:8389"
              ],
              "rolebase" : "ou=groups,dc=example,dc=com",
              "rolesearch" : "(member={0})",
              "userrolename" : "disabled",
              "rolename" : "cn",
              "resolve_nested_roles" : true,
              "userbase" : "ou=people,dc=example,dc=com",
              "usersearch" : "(uid={0})"
            }
          },
          "description" : "Authorize via LDAP or Active Directory"
        }
      },
      "auth_failure_listeners" : { },
      "do_not_fail_on_forbidden" : false,
      "multi_rolespan_enabled" : true,
      "hosts_resolver_mode" : "ip-only",
      "do_not_fail_on_forbidden_empty" : false,
      "on_behalf_of" : {
        "enabled" : false
      }
    }
  }
}

```

Cheers,  
Eddie.

---

<div class="post-metadata">

**Author:** ![big-edd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/big-edd/32/6282_2.png) [@big-edd](https://forum.opensearch.org/u/big-edd)\
**Post date:** [April 26, 2024, 3:03am UTC](https://forum.opensearch.org/t/anonymous-dashboard-access/18876/13 "2024-04-26T03:03:27Z")

</div>

> [@pablo](#):
>
> You must use either OpenSearch Dashboards or securityadmin.sh.

> [@big-edd](#):
>
> How do people automate it?

Maybe the question re automation is beyond the scope of this forum?

Tried via the Dashboards Web UI, but did not have any luck that way. Are there instructions/documentation stepping through this?

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [April 26, 2024, 6:50pm UTC](https://forum.opensearch.org/t/anonymous-dashboard-access/18876/14 "2024-04-26T18:50:51Z")

</div>

@big-edd You cannot change security configuration with OpenSearch Dashboards as the change requires a super admin user defined in admin\_dn in opensearch.yml.

> **[Applying changes to configuration files](https://opensearch.org/docs/latest/security/configuration/security-admin/)**
>
> Applying changes to configuration files

According to your output, the OpenSearch security plugin configuration wasn’t updated with your settings. That’s why your anonymous authentication doesn’t work.

What kind of automation do you expect?

---

<div class="post-metadata">

**Author:** ![big-edd](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/big-edd/32/6282_2.png) [@big-edd](https://forum.opensearch.org/u/big-edd)\
**Post date:** [April 29, 2024, 6:13am UTC](https://forum.opensearch.org/t/anonymous-dashboard-access/18876/15 "2024-04-29T06:13:12Z")

</div>

> [@pablo](#):
>
> What kind of automation do you expect?

In the future we are hoping to automatically build and deploy with CI/CD pipelines, without the need to manually administer before users can just go ahead and use it.

So I guess something (config and/or script) during the “docker build”?  
Or maybe a script and/or “docker-compose” cleverness as it is deployed?

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [April 29, 2024, 8:25am UTC](https://forum.opensearch.org/t/anonymous-dashboard-access/18876/16 "2024-04-29T08:25:35Z")

</div>

@big-edd When the fresh cluster deployment is executed, the index with security plugin configuration doesn’t exist. Then plugin imports configuration from `/usr/share/opensearch/config/opensearch-security`. If you’d like to use a custom security configuration during the deployment, then you can map config files in docker-compose.yml file.