# Document-level security - String array filter

**URL:** <https://forum.opensearch.org/t/document-level-security-string-array-filter/5811>\
**Category:** Security\
**Created:** [May 1, 2021, 9:18pm UTC](https://forum.opensearch.org/t/document-level-security-string-array-filter/5811 "2021-05-01T21:18:29Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![oadt](https://avatars.discourse-cdn.com/v4/letter/o/ea666f/32.png) [@oadt](https://forum.opensearch.org/u/oadt)\
**Post date:** [May 1, 2021, 9:18pm UTC](https://forum.opensearch.org/t/document-level-security-string-array-filter/5811/1 "2021-05-01T21:18:29Z")

</div>

I am trying to setup document level security in Kibana to restrict documents access to specific user IDs.

If I use the following query in plain text, everything is fine :

```json
{
  "query": {
    "ids": {
      "values": ["dkolDnkBy3prm6DJqjkr", "jkolDnkBy3prm6DJuzlJ"]
    }
  }
}

```

But as soon as I use the following parameter substitution :

```json
{
  "query": {
    "ids": {
      "values": ${attr.jwt.IDs}
    }
  }
}

```

I get this json\_parse\_exception : “[ids] failed to parse field [values]”

```json
{
  \"query\": {
    \"ids\": {
      \"values\": [dkolDnkBy3prm6DJqjkr, jkolDnkBy3prm6DJuzlJ]
    }
}

```

However, my JWT contains the following data :

```json
"IDs": [
  "dkolDnkBy3prm6DJqjkr",
  "jkolDnkBy3prm6DJuzlJ"
]

```

I understand why Elasticsearch returns the json\_parse\_exception, but I would like to know why my JWT’s string array is misinterpreted.

Do you have any clue, or know a way to get around this problem?

---

<div class="post-metadata">

**Author:** ![ralph](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/ralph/32/1194_2.png) [@ralph](https://forum.opensearch.org/u/ralph)\
**Post date:** [May 3, 2021, 6:18am UTC](https://forum.opensearch.org/t/document-level-security-string-array-filter/5811/2 "2021-05-03T06:18:39Z")

</div>

as you can see in the 2nd example your values are not quoted.

see here: [Setting up field and document level security | Elasticsearch Guide [7.10] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/7.10/field-and-document-access-control.html#templating-role-query)

> If your metadata field contains an object or array, you can access it using the `{{#toJson}}parameter{{/toJson}}` function.

so that means you have to write:

```
{
  "query": {
    "ids": {
      "values": {{#toJson}}attr.jwt.IDs{{/toJson}}
    }
}

```

and then it _should_ work.

---

<div class="post-metadata">

**Author:** ![oadt](https://avatars.discourse-cdn.com/v4/letter/o/ea666f/32.png) [@oadt](https://forum.opensearch.org/u/oadt)\
**Post date:** [May 3, 2021, 9:21am UTC](https://forum.opensearch.org/t/document-level-security-string-array-filter/5811/3 "2021-05-03T09:21:55Z")

</div>

I have already tried it, without success 😕

```json
{
  "query": {
    "ids": {
      "values": {{#toJson}}attr.jwt.IDs{{/toJson}}
    }
}

```

results in

```json
[ids] values doesn't support values of type: START_OBJECT

```

I understand that the parsing exception is caused by the missing quotes when the query is interpreted.

I do not understand why the quotes, which are present in the JWT, are stripped away when passed as a variable.

I am quite new to ES. Is there any way to see the output of `{{#toJson}}attr.jwt.IDs{{/toJson}}` to understand where the error occurs?