How to get only dashboards access from opensearch_dashboards_overview as well as from Dashboard menu in case of kibana_read_only user

Security
1

Hi,

I have given user a backend role as kibana_ready_only, because of which he can only able to access. Refer below image. When I click on dashboards, it takes me to dashboard list page correctly.

image
image641×760 12.5 KB

But when I try to open dashboard from home page, it gives me Application not found error.

image
image977×454 4.29 KB

image
image1474×737 9.72 KB

How to have access to dahsboards list from dashboards as well as from opensearch_dashboards_overview. But user should not have access to any other action than viewing the dashboards as he is having dashboard reader role

2

Hi @sayalipatil9689,

Which version of OpenSearch and OpenSearch Dashboards are you using? Could you share the list of roles mapped to the user?

3

Hi,

Below is the custom role I have created which is mapped with kibana_read_only role.

roles.yml

reader:
reserved: false
hidden: false
cluster_permissions:

  • cluster_composite_ops_ro
  • ‘cluster:admin/opensearch/ql/datasources/read’
    index_permissions:
  • index_patterns:
    - “test_index”
    dls: “”
    allowed_actions:
    • ‘indices:admin/resolve/index’
    • ‘indices:data/read/field_caps’
    • ‘indices:data/read/search’
    • ‘indices:data/read/get’
    • ‘indices:admin/mappings/get’
    • ‘indices:monitor/settings/get’
    • ‘indices:admin/aliases/get’
    • ‘indices:data/read/search*’
    • ‘search’
    • ‘read’
  • index_patterns:
    - “.kibana*”
    allowed_actions:
    • ‘indices:data/read/search’
    • ‘indices:data/write/update’
    • ‘indices:data/write/index’
    • ‘indices:data/write/bulk’
    • ‘indices:data/read/get’
    • ‘indices:data/read/mget[shard]’
      tenant_permissions:
    • tenant_patterns:
      • “*”
        allowed_actions:
      • ‘read’
      • ‘write’
        static: false

image
image822×909 16.3 KB

roles_mapping.yml
kibana_read_only:
reserved: false
backend_roles:

  • “reader”
    description: “Maps kibanauser to kibana_user”

reader:
reserved: false
backend_roles:

  • “reader”

image
image606×249 4.04 KB

4

Please share the output of the following commands:

GET _plugins/_security/api/internalusers/<your-username>

GET _plugins/_security/api/roles/reader

5

Sorry, but I am not having access to execute these two GET APIs in my project. I am having access to only yml files to add roles and map them. Hence shared the yml configurations for the same.

6

@sayalipatil9689 ,

Have you applied changes for your configuration files?

7

Yes I checked that. But it is still giving an error and I think this is technical limitation of OpenSearch.