# Cannot create role through Kibana interface

**URL:** <https://forum.opensearch.org/t/cannot-create-role-through-kibana-interface/318>\
**Category:** Security\
**Created:** [March 29, 2019, 4:57pm UTC](https://forum.opensearch.org/t/cannot-create-role-through-kibana-interface/318 "2019-03-29T16:57:02Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![nickfromdc](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/nickfromdc/32/90_2.png) [@nickfromdc](https://forum.opensearch.org/u/nickfromdc)\
**Post date:** [March 29, 2019, 4:57pm UTC](https://forum.opensearch.org/t/cannot-create-role-through-kibana-interface/318/1 "2019-03-29T16:57:02Z")

</div>

I’m currently testing opendistro, and I’m stuck with creating roles via the Kibana Security GUI. The affect seems to be that the role I create grants no permissions. For example:

Expected Result #1:

> $ curl localhost:9200  
> Unauthorized

Expected Result #2:

> $ curl -u logstash:logstash localhost:9200  
> {  
> “name” : “node-0”,  
> “cluster\_name” : “elasticsearch”,  
> …

Expected Result #3:  
Create new user `user1` in the GUI and give him the role `logstash`

> curl -u user1:password123 localhost:9200  
> {  
> “name” : “node-0”,  
> “cluster\_name” : “elasticsearch”,  
> …

Unexpected Result:  
Copy role `logstash` as role `cloned`. Expect to see the cluster info message, get `403`

> $ curl -u user1:password123 localhost:9200  
> {“error”:{“root\_cause”:[{“type”:“security\_exception”,“reason”:“no permissions for [cluster:monitor/main] and User [name=user1, roles=[cloned], requestedTenant=null]”}],“type”:“security\_exception”,“reason”:“no permissions for [cluster:monitor/main] and User [name=user1, roles=[cloned], requestedTenant=null]”},“status”:403}

I see an ES error when I try to curl the endpoint, but I’m not sure what the issue root issue is:

> [2019-03-29T16:54:47,880][INFO][c.a.o.s.p.PrivilegesEvaluator] [node-0] No cluster-level perm match for User [name=user1, roles=[cloned], requestedTenant=null] Resolved [aliases=, indices=, allIndices=, types=[\*], isAll()=false, isEmpty()=false] [Action [cluster:monitor/main]] [RolesChecked [own\_index]]  
> [2019-03-29T16:54:47,880][INFO][c.a.o.s.p.PrivilegesEvaluator] [node-0] No permissions for [cluster:monitor/main]

Is there something missing in my process?

---

<div class="post-metadata">

**Author:** ![nickfromdc](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/nickfromdc/32/90_2.png) [@nickfromdc](https://forum.opensearch.org/u/nickfromdc)\
**Post date:** [March 29, 2019, 5:38pm UTC](https://forum.opensearch.org/t/cannot-create-role-through-kibana-interface/318/2 "2019-03-29T17:38:55Z")

</div>

Querying the roles API endpoint shows I should have permissions:

> $ curl -u admin:admin [http://localhost:9200/\_opendistro/\_security/api/roles/cloned](http://localhost:9200/_opendistro/_security/api/roles/cloned)  
> {“cloned”:{“cluster”:[“CLUSTER\_MONITOR”,“CLUSTER\_COMPOSITE\_OPS”,“indices:admin/template/get”,“indices:admin/template/put”],“indices”:{“logstash-_“:{”_”:[“CRUD”,“CREATE\_INDEX”]},“_beat_”:{“\*”:[“CRUD”,“CREATE\_INDEX”]}}}}

---

<div class="post-metadata">

**Author:** ![nickfromdc](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/nickfromdc/32/90_2.png) [@nickfromdc](https://forum.opensearch.org/u/nickfromdc)\
**Post date:** [March 29, 2019, 5:56pm UTC](https://forum.opensearch.org/t/cannot-create-role-through-kibana-interface/318/3 "2019-03-29T17:56:04Z")

</div>

Solved. Apparently, creating a `role` also requires creating `rolemapping` for it to have an affect.