False Negative - Incorrect HTTP Method

Security
1

We’re trying to GET a url programmatically (/_opendistro/_alerting/destinations) and we’re receiving a 405. When we try the same url in Kibana’s dev tools, it works as expected. We are accessing the URLs using two different identities, which is likely the problem, but not sure what the problem is since usually missing roles are returned. This is the response instead:

{"error":"Incorrect HTTP method for uri [/_opendistro/_alerting/destinations] and method [GET], allowed: [POST]","status":405}
2

Can you recreate the issue using cURL with the same identity?

3

Unfortunately this is in production and the user running it (ironically with seemingly lower permissions) cannot be used directly.

4

Turns out we were unintentionally pointed to a different/old cluster that did have the wrong permissions. False false negative :slight_smile:

5

Thanks for the update! I suspected something along these lines.