# How to use roles parameter substitution for DLS

**URL:** <https://forum.opensearch.org/t/how-to-use-roles-parameter-substitution-for-dls/7969>\
**Category:** Security\
**Created:** [December 12, 2021, 4:41pm UTC](https://forum.opensearch.org/t/how-to-use-roles-parameter-substitution-for-dls/7969 "2021-12-12T16:41:33Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![qcoumes](https://avatars.discourse-cdn.com/v4/letter/q/53a042/32.png) [@qcoumes](https://forum.opensearch.org/u/qcoumes)\
**Post date:** [December 12, 2021, 4:41pm UTC](https://forum.opensearch.org/t/how-to-use-roles-parameter-substitution-for-dls/7969/1 "2021-12-12T16:41:34Z")

</div>

I’m trying to set up Document-Level Security using roles parameter substitution, but I can’t get it to work.

I have the following roles :

```json
{
  "document-level-security": {
    "reserved": false,
    "hidden": false,
    "cluster_permissions": ["*"],
    "index_permissions": [
      {
        "index_patterns": ["*"],
        "dls": "{\"bool\": {\"filter\": [{\"terms\": {\"origin_roles\": [${user.roles}]}}, {\"terms\": {\"department_roles\": [${user.roles}]}}]}}"
      }
    ]
  },

  "all_departments": {
    "reserved": false,
    "hidden": false,
    "cluster_permissions": ["*"],
    "index_permissions": [
      {
        "index_patterns": ["*"],
        "fls": [],
        "masked_fields": [],
        "allowed_actions": ["read"]
      }
    ],
  },

  "origin-character": {
    "reserved": false,
    "hidden": false,
    "cluster_permissions": ["*"],
    "index_permissions": [
      {
        "index_patterns": ["*"],
        "fls": [],
        "masked_fields": [],
        "allowed_actions": ["read"]
      }
    ],
  }
}

```

And the following document :

```json
{
  "id": 1090,
  "title": "A title",
  "origin_roles": ["origin-character"],
  "department_roles": ["all_departments"]
}

```

I’m trying to search this document using the following user:

```json
{
  "myuser": {
    "hash": "",
    "reserved": false,
    "hidden": false,
    "backend_roles": [],
    "attributes": {},
    "opendistro_security_roles": ["all_departments", "document-level-security", "origin-character"],
    "static": false
  }
}

```

I expected the search to work since the user has both the roles `"all_departments"` and `"origin-character"` to match the DLS query in `"document-level-security"`, but I got no result.

Any idea ?

---

<div class="post-metadata">

**Author:** ![jathin12](https://avatars.discourse-cdn.com/v4/letter/j/c2a13f/32.png) [@jathin12](https://forum.opensearch.org/u/jathin12)\
**Post date:** [December 13, 2021, 3:25pm UTC](https://forum.opensearch.org/t/how-to-use-roles-parameter-substitution-for-dls/7969/2 "2021-12-13T15:25:46Z")

</div>

the terms query is trying to match all the all the role array elements in each of the fields.

you may want to update your dls based on the example here

> **[Document-level security](https://opensearch.org/docs/latest/security-plugin/access-control/document-level-security/#attribute-based-security)**
>
> Document-level security (DLS)

---

<div class="post-metadata">

**Author:** ![Anthony](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/anthony/32/9939_2.png) [@Anthony](https://forum.opensearch.org/u/Anthony)\
**Post date:** [December 14, 2021, 2:11pm UTC](https://forum.opensearch.org/t/how-to-use-roles-parameter-substitution-for-dls/7969/3 "2021-12-14T14:11:16Z")

</div>

@qcoumes I’m not sure if the above is clear, but the dls query needs to be set for a specific index that it refers to. So for example:

```auto
"index_permissions": [{
    "index_patterns": [
      "pub*"
    ],
    "dls": "{\"term\": { \"readable_by\": \"${user.name}\"}}",
    "allowed_actions": [
      "read"
    ]

```

Otherwise the dls limitation is applied to other system indices and fails to work correctly. Hope this helps