Asynchronous_search permissions

OpenSearch
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): 3.7.0

Describe the issue: cluster:admin/opensearch/asynchronous_search/* permissions not available to update the role. I have checked admin/opensearch and admin/opendistro

Configuration:

Relevant Logs or Screenshots: Invoke-RestMethod : {“error”:{“root_cause”:[{“type”:“security_exception”,“reason”:“no permissions for [cluster:admin/opendistro/asynchronous_search/submit] and User
, requestedTenant=null]”}],“type”:“security_exception”,“reason”:"no permissions for
[cluster:admin/opendistro/asynchronous_search/submit] and User , backend_roles=,“status”:403:

2

@hitesh303 Have you tried with securityadmin.sh tool?

3

Hi Pablo,

No, but We tried from devtools and it works. The UI side can’t update permissions directly on roles.

Thanks!

Hitesh

4

@hitesh303 If the permission isn’t listed under the cluster permissions, then you must use securityadmin.sh and roles.yaml file.

What do you mean by “it works in DevTools”? Could you share the query you ran when you encountered this error?

5

Hi Pablo,

This is API call from devtools we ran:

PATCH _plugins/_security/api/roles/test_role
[
  {
    "op": "add",
    "path": "/cluster_permissions",
    "value": [
      "cluster:admin/opensearch/asynchronous_search/submit",
      "cluster:admin/opensearch/asynchronous_search/get",
      "cluster:admin/opensearch/asynchronous_search/delete"
    ]
  }
]
6

@hitesh303 Thanks for sharing. Yes, that’s the other way to update the role with custom permissions.
Please also consider using securityadmin.sh as a backup of all your security configuration.