# Document-level security - Multiple attributes based access

**URL:** <https://forum.opensearch.org/t/document-level-security-multiple-attributes-based-access/1187>\
**Category:** Security\
**Created:** [July 22, 2019, 8:33pm UTC](https://forum.opensearch.org/t/document-level-security-multiple-attributes-based-access/1187 "2019-07-22T20:33:37Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![stmx38](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/stmx38/32/4354_2.png) [@stmx38](https://forum.opensearch.org/u/stmx38)\
**Post date:** [July 22, 2019, 8:33pm UTC](https://forum.opensearch.org/t/document-level-security-multiple-attributes-based-access/1187/1 "2019-07-22T20:33:37Z")

</div>

Hello,

We just installed lates Open Distro for Elasticsearch - 1.0.0 with Security plugin and Kibana.  
And we are started to configure ABAC based on the example: [https://opendistro.github.io/for-elasticsearch-docs/docs/security-access-control/document-level-security/](https://opendistro.github.io/for-elasticsearch-docs/docs/security-access-control/document-level-security/)

We have a user with attributes: ID: “1234”, “12345”  
We have a role: User-ID  
With the following DLSQ:

```auto
{
  "terms_set": {
    "ID": {
      "terms": [
      	"${attr.internal.ID}"
      ],
      "minimum_should_match_script": {
        "source": "1"
      }
    }
  }
}

```

And it shows the data only when we set only one user attribute and without quotes: `ID: 123`, or `ID: 456` but not both.  
It dowesn’t work with the:  
`ID: 123, 456` - 0 hits  
`ID: "123"` - Discover: failed to wrap searcher  
`ID: "123", "456"` - Discover: failed to wrap searcher

```
Error: Request to Elasticsearch failed: {"error":{"root_cause":[{"type":"exception","reason":"failed to wrap searcher"}],"type":"search_phase_execution_exception","reason":"all shards failed","phase":"query","grouped":true,"failed_shards":[{"shard":0,"index":"user-log-2019-07-22","node":"IoqM6u52Q8SJBFkgfTe3SZ","reason":{"type":"exception","reason":"failed to wrap searcher","caused_by":{"type":"i_o_exception","reason":"java.util.concurrent.ExecutionException: com.fasterxml.jackson.core.JsonParseException: Unexpected character ('2' (code 50)): was expecting comma to separate Array entries\n at [Source: java.io.StringReader@4875e49a; line: 5, column: 11]","caused_by":{"type":"execution_exception","reason":"execution_exception: com.fasterxml.jackson.core.JsonParseException: Unexpected character ('2' (code 50)): was expecting comma to separate Array entries\n at [Source: java.io.StringReader@4875e49a; line: 5, column: 11]","caused_by":{"type":"i_o_exception","reason":"Unexpected character ('2' (code 50)): was expecting comma to separate Array entries\n at [Source: java.io.StringReader@4875e49a; line: 5, column: 11]"}}}}}]},"status":500}

KbnError@https://kibana.dev/bundles/commons.bundle.js:12:40128
RequestFailure@https://kibana.dev/bundles/commons.bundle.js:12:40632
callResponseHandlers/<@https://kibana.dev/bundles/commons.bundle.js:68:977057
Promise.try@https://kibana.dev/bundles/commons.bundle.js:20:3027968
Promise.map/<@https://kibana.dev/bundles/commons.bundle.js:20:3027334
Promise.map@https://kibana.dev/bundles/commons.bundle.js:20:3027295
callResponseHandlers@https://kibana.dev/bundles/commons.bundle.js:68:976069
fetchSearchResults/<@https://kibana.dev/bundles/commons.bundle.js:68:958029
processQueue@https://kibana.dev/built_assets/dlls/vendors.bundle.dll.js:293:199687
scheduleProcessQueue/<@https://kibana.dev/built_assets/dlls/vendors.bundle.dll.js:293:200650
$digest@https://kibana.dev/built_assets/dlls/vendors.bundle.dll.js:293:210412
$evalAsync/<@https://kibana.dev/built_assets/dlls/vendors.bundle.dll.js:293:212944
completeOutstandingRequest@https://kibana.dev/built_assets/dlls/vendors.bundle.dll.js:293:64425
Browser/self.defer/timeoutId<@https://kibana.dev/built_assets/dlls/vendors.bundle.dll.js:293:67267

```

But it works fine if we place IDs in the DLSQ:

```auto
{
  "terms_set": {
    "ID": {
      "terms": [
      	"123",
      	"456"
      ],
      "minimum_should_match_script": {
        "source": "1"
      }
    }
  }
}

```

What may be wrong?

Thank you!

---

<div class="post-metadata">

**Author:** ![stmx38](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/stmx38/32/4354_2.png) [@stmx38](https://forum.opensearch.org/u/stmx38)\
**Post date:** [July 23, 2019, 9:25am UTC](https://forum.opensearch.org/t/document-level-security-multiple-attributes-based-access/1187/2 "2019-07-23T09:25:28Z")

</div>

As a workaround we now use it in the following way:

```auto
{
  "terms_set": {
    "ID": {
      "terms": [
        "${attr.internal.ID1}",
        "${attr.internal.ID2}"
      ],
      "minimum_should_match_script": {
        "source": "1"
      }
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![stmx38](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/stmx38/32/4354_2.png) [@stmx38](https://forum.opensearch.org/u/stmx38)\
**Post date:** [July 24, 2019, 5:46am UTC](https://forum.opensearch.org/t/document-level-security-multiple-attributes-based-access/1187/3 "2019-07-24T05:46:03Z")

</div>

And is there any way to use some kind of regexp/wildcard?:  
In order to replace:

```auto
      "terms": [
        "${attr.internal.ID1}",
        "${attr.internal.ID2}"
      ]

```

with:

```auto
      "terms": [
        "${attr.internal.ID*}"
      ]

```

Where `*` in our case is `{[0-9]{1,2}}`

---

<div class="post-metadata">

**Author:** ![faham](https://avatars.discourse-cdn.com/v4/letter/f/5daacb/32.png) [@faham](https://forum.opensearch.org/u/faham)\
**Post date:** [February 14, 2020, 8:31pm UTC](https://forum.opensearch.org/t/document-level-security-multiple-attributes-based-access/1187/4 "2020-02-14T20:31:35Z")

</div>

If you’re comparing against numbers won’t need the quotations then the following would work:

```auto
"terms": [${attr.internal.IDs}]

```

and on the other side `IDs = 1,2,3,4`

---

<div class="post-metadata">

**Author:** ![stmx38](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/stmx38/32/4354_2.png) [@stmx38](https://forum.opensearch.org/u/stmx38)\
**Post date:** [February 23, 2020, 5:22pm UTC](https://forum.opensearch.org/t/document-level-security-multiple-attributes-based-access/1187/5 "2020-02-23T17:22:48Z")

</div>

@faham, I got the message about invalid JSON:

```
{
  "terms_set": {
    "IDs": {
      "terms": [${attr.internal.IDs}],
      "minimum_should_match_script": {
        "source": "1"
      }
    }
  }
}

```

 ![Screen Shot 2020-02-23 at 19.14.45](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/1X/8180c794d02b51bb65e2b3a40fc6360018304968.png)

It accepts value only with quotes:

 ![Screen Shot 2020-02-23 at 19.20.59](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/1X/8f6973ebaf595bd4574869a5d0105e85ce016882.png)

Do you have and example of the full query?

---

<div class="post-metadata">

**Author:** ![faham](https://avatars.discourse-cdn.com/v4/letter/f/5daacb/32.png) [@faham](https://forum.opensearch.org/u/faham)\
**Post date:** [March 2, 2020, 6:07pm UTC](https://forum.opensearch.org/t/document-level-security-multiple-attributes-based-access/1187/6 "2020-03-02T18:07:05Z")

</div>

I know about the `Invalid JSON` warning, that’s only a frontend message, ignore and use it without the quotations. It did work for me. I don’t remember if I did create the doc through kibana interface or `curled` elastic server directly but I did use it without quotations (invalid json) and worked just as intended.

---

<div class="post-metadata">

**Author:** ![stmx38](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/stmx38/32/4354_2.png) [@stmx38](https://forum.opensearch.org/u/stmx38)\
**Post date:** [March 2, 2020, 9:18pm UTC](https://forum.opensearch.org/t/document-level-security-multiple-attributes-based-access/1187/7 "2020-03-02T21:18:12Z")

</div>

@faham, yes Interface permitted me to save an ‘Invalid JSON’ but it seems that it works. Will continue to test it.

Thank you!

---

<div class="post-metadata">

**Author:** ![robmartin](https://avatars.discourse-cdn.com/v4/letter/r/3ec8ea/32.png) [@robmartin](https://forum.opensearch.org/u/robmartin)\
**Post date:** [November 30, 2020, 12:46pm UTC](https://forum.opensearch.org/t/document-level-security-multiple-attributes-based-access/1187/8 "2020-11-30T12:46:28Z")

</div>

Was there ever a solution for this if comparing strings? I have a JWT claim named groups (containing a list of strings) I want to compare against

---

<div class="post-metadata">

**Author:** ![danielhabenicht](https://avatars.discourse-cdn.com/v4/letter/d/5f8ce5/32.png) [@danielhabenicht](https://forum.opensearch.org/u/danielhabenicht)\
**Post date:** [March 15, 2021, 2:26pm UTC](https://forum.opensearch.org/t/document-level-security-multiple-attributes-based-access/1187/9 "2021-03-15T14:26:56Z")

</div>

Yes, the error with the documentation is documented here: [https://github.com/opendistro-for-elasticsearch/security/issues/863](https://github.com/opendistro-for-elasticsearch/security/issues/863)

Just found the solution and might update the documentation.

---

<div class="post-metadata">

**Author:** ![jathin12](https://avatars.discourse-cdn.com/v4/letter/j/c2a13f/32.png) [@jathin12](https://forum.opensearch.org/u/jathin12)\
**Post date:** [November 4, 2021, 9:10pm UTC](https://forum.opensearch.org/t/document-level-security-multiple-attributes-based-access/1187/10 "2021-11-04T21:10:52Z")

</div>

maybe you want to check this blog out

> **[Document Level Security in Elasticsearch — Part 2](https://medium.com/@alon.aizenberg/document-level-security-in-elasticsearch-part-2-d08783b58738)**
>
> Document Level Security in Elasticsearch — a production like setup