Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):
Describe the issue:
I’m running into a pretty frustrating issue with OpenSearch when using Docker. After creating a custom role with DLS and setting up role mappings, the OpenSearch Dashboards container fails to start after the cluster is stopped and restarted. The entire cluster becomes unusable until I completely delete everything and start fresh.
Steps to Reproduce
-
Download the latest official
docker-composefile from OpenSearch (example: https://github.com/opensearch-project/opensearch-build/blob/main/docker/release/dockercomposefiles/docker-compose-default.x.yml). -
Run the cluster:
OPENSEARCH_INITIAL_ADMIN_PASSWORD=YourPasswordHere docker compose up -dThis will start a basic 2-node cluster.
-
Create a script called
test.shwith the following content and run it to create the custom role and role mapping:#!/bin/bash echo "Creating special_role role" curl -X PUT "https://localhost:9200/_plugins/_security/api/roles/special_role?pretty" -H "Content-Type: application/json" -d '{ "cluster_permissions": ["cluster_composite_ops_ro"], "index_permissions": [ { "index_patterns" : ["*"], "dls": "{\"bool\":{\"should\":[{\"bool\":{\"must_not\":{\"exists\":{\"field\":\"_acls\"}}}},{\"terms\":{\"_acls.keyword\":[\"${user.name}\", ${user.securityRoles},${user.roles}]}}]}}", "allowed_actions": ["read"] } ], "tenant_permissions": [] }' --insecure -u admin:"${OPENSEARCH_INITIAL_ADMIN_PASSWORD}" echo "Creating mappings for special_role role" curl -X PUT "https://localhost:9200/_plugins/_security/api/rolesmapping/special_role?pretty" \ -H "Content-Type: application/json" \ -d '{ "users": ["*"], "backend_roles": [], "hosts": [] }' --insecure -u admin:"${OPENSEARCH_INITIAL_ADMIN_PASSWORD}" echo "Verifying creation of special_role role..." curl -X GET "https://localhost:9200/_plugins/_security/api/roles/special_role" \ --insecure -u "admin:${OPENSEARCH_INITIAL_ADMIN_PASSWORD}" -
Stop the OpenSearch cluster using Docker Desktop and restart it.
Problem
Immediately after restart, OpenSearch Dashboards logs the following errors and exits with a fatal failure:
{"type":"log","@timestamp":"2025-12-11T15:08:17Z","tags":["info","savedobjects-service"],"pid":1,"message":"Starting saved objects migrations"}
{"type":"log","@timestamp":"2025-12-11T15:08:17Z","tags":["error","opensearch","data"],"pid":1,"message":"[security_exception]: Error while evaluating DLS/FLS privileges"}
{"type":"log","@timestamp":"2025-12-11T15:08:17Z","tags":["warning","savedobjects-service"],"pid":1,"message":"Unable to connect to OpenSearch. Error: security_exception: [security_exception] Reason: Error while evaluating DLS/FLS privileges"}
{"type":"log","@timestamp":"2025-12-11T15:08:17Z","tags":["fatal","root"],"pid":1,"message":"ResponseError: security_exception: [security_exception] Reason: Error while evaluating DLS/FLS privileges\n at onBody (/usr/share/opensearch-dashboards/node_modules/@opensearch-project/opensearch/lib/Transport.js:426:23)\n at IncomingMessage.onEnd (/usr/share/opensearch-dashboards/node_modules/@opensearch-project/opensearch/lib/Transport.js:341:11)\n at IncomingMessage.emit (node:events:530:35)\n at endReadableNT (node:internal/streams/readable:1698:12)\n at processTicksAndRejections (node:internal/process/task_queues:82:21) {\n meta: {\n body: { error: [Object], status: 500 },\n statusCode: 500,\n headers: {\n 'x-opensearch-version': 'OpenSearch/3.2.0 (opensearch)',\n 'content-type': 'application/json; charset=UTF-8',\n 'content-length': '203'\n },\n meta: {\n context: null,\n request: [Object],\n name: 'opensearch-js',\n connection: [Object],\n attempts: 0,\n aborted: false\n }\n }\n}"}
{"type":"log","@timestamp":"2025-12-11T15:08:17Z","tags":["info","plugins-system"],"pid":1,"message":"Stopping all plugins."}
FATAL {"error":{"root_cause":[{"type":"security_exception","reason":"Error while evaluating DLS/FLS privileges"}],"type":"security_exception","reason":"Error while evaluating DLS/FLS privileges"},"status":500}
Impact
At this point the only fix is to run:
docker compose down -v
…which deletes all data, including any indices or dashboards I’ve created.
This makes it basically impossible to use DLS with Docker without risking data loss.
Question
Is this a known OpenSearch bug?
Is there any workaround that prevents Dashboards from crashing on restart after defining a DLS-enabled role?
Configuration:
Relevant Logs or Screenshots:
