Empty document-level security statement causes filtering of results

Security
,
1

Versions:
OpenSearch 1.3 on AWS
OpenSearchDashboards 1.3.2

Describe the issue:

I have a question or maybe an issue regarding document-level security statement in role definitons.

I have a user mapped to a role. The role allows read (and more) on an index pattern. The role has no document level security statement defined. As this is optional I expect to have full read access to the indices matching the pattern, but rather to opposite is the case. There is no hit when executing a simple search.

Only if adding a document level security statement that matches all documents, like so:

{ 
  "wildcard":
  {
    "project": "*"
   }
}

where project is a field in my documents, I get the expected results.

From documentation I would always expect that non existing document level security statement does mean no filtering at all and not that everything is filtered. Or not?

2

@Faiglindra Would you mind sharing roles.yml and roles_mapping.yml?
Please also share the roles assigned to the test user.