# How to hide field from all users except some

**URL:** <https://forum.opensearch.org/t/how-to-hide-field-from-all-users-except-some/13392>\
**Category:** Security\
**Tags:** discuss\
**Created:** [March 20, 2023, 7:29am UTC](https://forum.opensearch.org/t/how-to-hide-field-from-all-users-except-some/13392 "2023-03-20T07:29:41Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![asfoorial](https://avatars.discourse-cdn.com/v4/letter/a/3da27b/32.png) [@asfoorial](https://forum.opensearch.org/u/asfoorial)\
**Post date:** [March 20, 2023, 7:29am UTC](https://forum.opensearch.org/t/how-to-hide-field-from-all-users-except-some/13392/1 "2023-03-20T07:29:41Z")

</div>

Hi all,

I was wondering if it is possible to hide an index field from all users except for some. Currently there is FLS which enables hiding an index field for a list of users. I was wonder if we can flip the behaviour so that the field is hidden from all except for the supplied list of users.

Thanks

---

<div class="post-metadata">

**Author:** ![jasonrojas](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/jasonrojas/32/4902_2.png) [@jasonrojas](https://forum.opensearch.org/u/jasonrojas)\
**Post date:** [March 20, 2023, 4:29pm UTC](https://forum.opensearch.org/t/how-to-hide-field-from-all-users-except-some/13392/2 "2023-03-20T16:29:28Z")

</div>

Basically if you are doing auth with roles spread out in groups, you duplicate the role, normal users group includes the masked field option so the field is always masked, the “privileged” users go into the other group that maps to a different role that does not have field masking…

ie:  
Normal role with field masked for all

```auto
roleaname:
  reserved: false
  hidden: false
  cluster_permissions:
  - "indices_monitor"
  index_permissions:
  - index_patterns:
    - "*"
    fls: []
    masked_fields: 
     - "secretField"

```

And then the other:

```auto
privileged_role:
  reserved: false
  hidden: false
  cluster_permissions:
  - "indices_monitor"
  index_permissions:
  - index_patterns:
    - "*"
    fls: []
    masked_fields []

```

---

<div class="post-metadata">

**Author:** ![Eugene7](https://avatars.discourse-cdn.com/v4/letter/e/bbce88/32.png) [@Eugene7](https://forum.opensearch.org/u/Eugene7)\
**Post date:** [March 20, 2023, 4:53pm UTC](https://forum.opensearch.org/t/how-to-hide-field-from-all-users-except-some/13392/3 "2023-03-20T16:53:17Z")

</div>

FLS restricts access to the fields in the document. FLS is a part of the role that controls user access.  
That means the FLS is not user aware.

As @jasonrojas said you should separate these users at the IDP group level and assign them to separate roles.

---

<div class="post-metadata">

**Author:** ![asfoorial](https://avatars.discourse-cdn.com/v4/letter/a/3da27b/32.png) [@asfoorial](https://forum.opensearch.org/u/asfoorial)\
**Post date:** [March 20, 2023, 5:31pm UTC](https://forum.opensearch.org/t/how-to-hide-field-from-all-users-except-some/13392/4 "2023-03-20T17:31:43Z")

</div>

Thanks @jasonrojas and @Eugene7, allow me to rephrase my question as follows:

Can we have a role mapping apply to all users except for some? Currently I can use the “\*” to map a role to all users. But there is no way use in conjunction with an exclusion list.

Create two roles may work but can become an overhead when there too many indices.

---

<div class="post-metadata">

**Author:** ![jasonrojas](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/jasonrojas/32/4902_2.png) [@jasonrojas](https://forum.opensearch.org/u/jasonrojas)\
**Post date:** [March 20, 2023, 10:49pm UTC](https://forum.opensearch.org/t/how-to-hide-field-from-all-users-except-some/13392/5 "2023-03-20T22:49:17Z")

</div>

I think two roles is the only way to go, however with index patterns you can apply it to only the indices that match those patterns so some of the overhead can be reduced there. In my example above the index pattern fields I defined will cover all indices.