Global tenant and private tenant

OpenSearch
1

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):
OpenSearch: 2.7.0
OpenSearch Dashboard: 2.7.0

Describe the issue:
Hello for everyone
There is a problem: the transition to the tenant does not work, all users always remain within the global tenant.

Description of the bug:

  1. All index patterns are created in the global tenant, even if you first switch to the context of another tenant.

  2. The user always stays within the global tenant. If the user is not granted rights to the global tenant, then nothing will be available for viewing, even when choosing his tenant, because the index patterns in the global tenant

2

@Ruslan Could you share your config.yml and opensearch_dashboards.yml files? Also please share entries related to the users and custom tenants from tenants.yml, roles.yml and roles_mapping.yml files.

3

We had the same issue and pinned the problem down to the Dashboards configuration file.
Thing is, we migrated over from ES/SearchGuard, and one of the critical elements was renamed. So we replaced this opensearch-dashboards.yml snippet :

opensearch.requestHeadersAllowlist:
- sgtenant

with:

opensearch.requestHeadersAllowlist:
- securitytenant

The thing that’s misleading is that the opensearch dashboards page is reporting that everything is okay and that the user is in tenant foo, while in fact the server never accepts the http header for the tenant.

1 Like