We have added this setting in the opensearch.yml file to filter out the alerts or monitors created by tenant. Now we are running into another issue with the channel name itself. If as an admin, I create a channel in each & every tenant space, the user that belongs to a tenant space, cannot see it because we do not have a common backend role. So, in other words, we are kind of blocked.
# Limit access by backend role
plugins.alerting.filter_by_backend_roles: true
What is the potential solution ? We were thinking about creating a common ADOM group but this will become a maintenance nightmare, as we will have to keep track of adding 1000s of users to this ADOM by application.
@muraliv this setting applies uniformly to all alerting resources: monitors and channels alike. There is no way to isolate monitors by role, but keep channels globally visible, as OpenSearch Dashboards multi-tenancy (the tenant switcher in the UI) isolates Dashboards objects (visualizations, dashboards, index patterns) in separate .kibana_<hash>_<tenant> indices. Each tenant is a silo at the Dashboards layer.
Alerting monitors and notification channels live in cluster-level system indices (.opendistro-alerting-config, .opensearch-notifications-config) and are fundamentally not scoped per tenant. The only access control applied to them is the backend role filter.
Therefore if this setting is used, the user will need to share at least one role with the user that created a channel.
This would be a good candidate for a feature request, that you can raise here
@Anthony - Thank you, I will submit a FR. If we do enable that setting, then, the alerts itself becomes visible and the potential risk of other tenants modifying an alert.
@muraliv The GitHub issue covers users whose monitors are too visible across tenants, ie. if two users share AD/LDAP backend roles but work in different tenants, they bleed into each other’s monitors despite being on separate tenants.
The limitation you described is the reverse, the channels are too invisible, channels created by an admin aren’t visible to tenant users because they don’t share a backend role with the admin. Therefore a separate issue might be a good idea. Alternatively you can leave a comment on the existing one.