# How can I remove access permission to global tenant for an user?

**URL:** <https://forum.opensearch.org/t/how-can-i-remove-access-permission-to-global-tenant-for-an-user/6948>\
**Category:** Security\
**Created:** [September 7, 2021, 3:16pm UTC](https://forum.opensearch.org/t/how-can-i-remove-access-permission-to-global-tenant-for-an-user/6948 "2021-09-07T15:16:40Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![simonverbois](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/simonverbois/32/2040_2.png) [@simonverbois](https://forum.opensearch.org/u/simonverbois)\
**Post date:** [September 7, 2021, 3:16pm UTC](https://forum.opensearch.org/t/how-can-i-remove-access-permission-to-global-tenant-for-an-user/6948/1 "2021-09-07T15:16:40Z")

</div>

Hi everyone,

I have several tenants on my cluster :

- custom\_tenant\_1 (for user\_1)

- custom\_tenant\_2 (for user\_1)

- global\_tenant

- private\_tenant

I also have 2 users :

- user\_1
- user\_2

These users can access to their tenants with the right index, but I don’ know how to deny access on the global tenant…  
Someone have an idea ?

Sorry for my bad english…

Thanks you all 😛  
Simon

---

<div class="post-metadata">

**Author:** ![Anthony](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/anthony/32/9939_2.png) [@Anthony](https://forum.opensearch.org/u/Anthony)\
**Post date:** [September 7, 2021, 3:36pm UTC](https://forum.opensearch.org/t/how-can-i-remove-access-permission-to-global-tenant-for-an-user/6948/2 "2021-09-07T15:36:23Z")

</div>

@simonverbois What other roles are the users in question being mapped to?

The access to global tenant is included in kibana\_user role, if you remove this role\_mapping and provide the necessary access via the custom roles, this should fix the issue you are having.

---

<div class="post-metadata">

**Author:** ![simonverbois](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/simonverbois/32/2040_2.png) [@simonverbois](https://forum.opensearch.org/u/simonverbois)\
**Post date:** [September 8, 2021, 6:56am UTC](https://forum.opensearch.org/t/how-can-i-remove-access-permission-to-global-tenant-for-an-user/6948/3 "2021-09-08T06:56:33Z")

</div>

Hi Anthony,

Thank you for your reply,

I have only 2 roles on my users:

- A custom role who assign to an user read permission on is tenant (this tenant allow a read access to a specific index)
- And a bakend role, kibanauser

My final objectif is the creation of an user who have full access on his private tenant (I would like it to be able to create its own index based on that of the custom tenant) and read access on a custom tenant (he can also create some items, like dashboard, saved search, etc.)

I gonna try your solution,

Thanks  
Simon

---

<div class="post-metadata">

**Author:** ![simonverbois](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/simonverbois/32/2040_2.png) [@simonverbois](https://forum.opensearch.org/u/simonverbois)\
**Post date:** [September 8, 2021, 7:50am UTC](https://forum.opensearch.org/t/how-can-i-remove-access-permission-to-global-tenant-for-an-user/6948/4 "2021-09-08T07:50:13Z")

</div>

Finally I have fix this,

I have create a backend role with my custom role, and i have remove kibanauser backend.

In my custom i have add : read, manger and index permissions  
and also : cluster\_composite\_ops on cluster permissions

Thanks you