# DLS fails with dynamic variable ${user.attrs.tenant\_id} but works with static values

**URL:** <https://forum.opensearch.org/t/dls-fails-with-dynamic-variable-user-attrs-tenant-id-but-works-with-static-values/26305>\
**Category:** Open Source Elasticsearch and Kibana\
**Created:** [August 11, 2025, 7:24am UTC](https://forum.opensearch.org/t/dls-fails-with-dynamic-variable-user-attrs-tenant-id-but-works-with-static-values/26305 "2025-08-11T07:24:24Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vivek1](https://avatars.discourse-cdn.com/v4/letter/v/839c29/32.png) [@Vivek1](https://forum.opensearch.org/u/Vivek1)\
**Post date:** [August 11, 2025, 7:24am UTC](https://forum.opensearch.org/t/dls-fails-with-dynamic-variable-user-attrs-tenant-id-but-works-with-static-values/26305/1 "2025-08-11T07:24:24Z")

</div>

Hello OpenSearch Community,

I’m trying to implement Document Level Security (DLS) using a tenant\_id claim from our OIDC provider’s JWT, but I’ve run into a specific issue. The DLS works perfectly when I hardcode a value, but fails as soon as I try to use the dynamic variable.

**My Goal:**  
A user logs in via OIDC. Their JWT contains a tenant\_id claim. Their searches should be automatically filtered to only show documents matching their tenant\_id.

**What I’ve Done & Tested:**

I have successfully configured OIDC login. I then created a DLS role with the following query.

**This WORKS:**  
When I set the DLS query with a _static value_ (e.g., 1), the security works as expected. The user can log in, view dashboards, and only sees data where the tenant\_id\_field is 1.

```json
{
  "term": {
    "my_tenant_id_field.keyword": 1 
  }
}

```

**This FAILS:**  
The problem occurs when I switch to the _dynamic variable_ to fetch the tenant\_id from the JWT.

```json
{
  "term": {
    "my_tenant_id_field.keyword": "${user.attrs.tenant_id}"
  }
}

```

and

```json
{
  "term": {
    "my_tenant_id_field.keyword": "${user.attrs.tenant_id}"
  }
}

```

**The Error:**  
When I use the dynamic ${user.attrs.tenant\_id} variable, the user can still log in, but when they try to view data in Discover or on a dashboard, they receive a **“Bad Request”** error from the UI. This leads me to believe the ${user.attrs.tenant\_id} variable is either not being populated or is being populated with a value that breaks the query syntax.

**My Configuration Steps:**

**1. config.yml (Redacted):**  
I’ve configured my OIDC domain to map the tenant\_id claim from the JWT to a user attribute.

```yaml
_meta:
  type: "config"
  config_version: 2

config:
  dynamic:
    http:
      anonymous_auth_enabled: false
    authc:
      oidc_auth_domain:
        description: "Authenticate via OIDC (OpenID Connect)"
        http_enabled: true
        transport_enabled: true
        order: 0
        http_authenticator:
          type: "openid"
          challenge: true
          config:
            subject_key: "preferred_username"
            roles_key: "roles"
            openid_connect_url: "##################"
            client_id: "#############"
            client_secret: "###########" 
            user_mapping.attr_json_path.tenant_id: tenant_id
        authentication_backend:
          type: "noop"
      basic_internal_auth_domain:
        description: "Authenticate via HTTP Basic against internal users database"
        http_enabled: true
        transport_enabled: true
        order: 1
        http_authenticator:
          type: "basic"
          challenge: false
        authentication_backend:
          type: "internal"

```

**2. OpenSearch DLS Role:**  
I created a role in the Dashboards UI with the necessary cluster and index permissions, and the DLS query mentioned above.

**3. Role Mapping:**  
I mapped this DLS role to a “Backend Role” that corresponds to a role claim present in my user’s JWT.

**My Question:**

Since the DLS works with a hardcoded value, my role permissions and mappings seem to be correct. The issue appears to be isolated to the dynamic variable substitution.

Could there be something wrong with my user\_mapping.attr\_json\_path.tenant\_id: tenant\_id configuration, or is there another place I should be looking to debug why ${user.attrs.tenant\_id} is not resolving correctly?

Any help would be greatly appreciated. Thank you

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/3/33547ea01a5b12dcca2958411d3edd97ae2ea8c1.png) [@system](https://forum.opensearch.org/u/system)\
**Post date:** [October 10, 2025, 7:24am UTC](https://forum.opensearch.org/t/dls-fails-with-dynamic-variable-user-attrs-tenant-id-but-works-with-static-values/26305/2 "2025-10-10T07:24:56Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.