# Inconsistent permissions across nodes

**URL:** <https://forum.opensearch.org/t/inconsistent-permissions-across-nodes/1333>\
**Category:** Security\
**Created:** [August 15, 2019, 2:53pm UTC](https://forum.opensearch.org/t/inconsistent-permissions-across-nodes/1333 "2019-08-15T14:53:21Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![kiowajoe](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/kiowajoe/32/109_2.png) [@kiowajoe](https://forum.opensearch.org/u/kiowajoe)\
**Post date:** [August 15, 2019, 2:53pm UTC](https://forum.opensearch.org/t/inconsistent-permissions-across-nodes/1333/1 "2019-08-15T14:53:21Z")

</div>

I was seeing inconsistent access to kibana for ldap users. I tried accessing the .kibana index on multiple nodes with the REST API and saw different behavior across the cluster. Two nodes respond with no permissions and two nodes return the index details. These are using ldap roles and show different results depending on the node that it is connected to. The securityadmin.sh tool was run on es01 node to add and update the ldap configuration. I do have multiple elasticsearch hosts defined in kibana.yml, so a short term solution was to change that to only hosts which return valid ldap queries.

root@test:~# curl -k [https://es01:9200/\_opendistro/\_security/authinfo?pretty](https://es01:9200/_opendistro/_security/authinfo?pretty) -u testuser  
Enter host password for user ‘testuser’:  
{  
“user” : “User [name=Joe, roles=, requestedTenant=null]”,  
“user\_name” : “Joe”,  
“user\_requested\_tenant” : null,  
“remote\_address” : “10.1.1.82:37734”,  
“backend\_roles” : ,  
“custom\_attribute\_names” : [  
“attr.ldap.primaryGroupID”,  
…  
“attr.ldap.lastLogonTimestamp”  
],  
“roles” : [  
“own\_index”  
],  
“tenants” : {  
“Joe” : true  
},  
“principal” : null,  
“peer\_certificates” : “0”,  
“sso\_logout\_url” : null  
}  
root@test:~# curl -k [https://es03:9200/\_opendistro/\_security/authinfo?pretty](https://es03:9200/_opendistro/_security/authinfo?pretty) -u testuser  
Enter host password for user ‘testuser’:  
{  
“user” : “User [name=Joe, roles=[admins, network-rw, net-admins], requestedTenant=null]”,  
“user\_name” : “Joe”,  
“user\_requested\_tenant” : null,  
“remote\_address” : “10.1.1.82:42124”,  
“backend\_roles” : [  
“admins”,  
“network-rw”,  
“net-admins”  
],  
“custom\_attribute\_names” : [  
“attr.ldap.primaryGroupID”,  
…  
“attr.ldap.lastLogonTimestamp”  
],  
“roles” : [  
“kibana\_user”,  
“ldap\_admin”,  
“own\_index”,  
“readall”,  
“security\_rest\_api\_access”  
],  
“tenants” : {  
“Joe” : true,  
“global\_tenant” : true  
},  
“principal” : null,  
“peer\_certificates” : “0”,  
“sso\_logout\_url” : null  
}

---

<div class="post-metadata">

**Author:** ![kiowajoe](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/kiowajoe/32/109_2.png) [@kiowajoe](https://forum.opensearch.org/u/kiowajoe)\
**Post date:** [August 15, 2019, 6:42pm UTC](https://forum.opensearch.org/t/inconsistent-permissions-across-nodes/1333/2 "2019-08-15T18:42:54Z")

</div>

It seems that es01 now sees the correct backend\_roles from ldap. I don’t know if I did something to propogate the changes, but es02 still shows no backend\_roles for the user. I am using puppet and working on getting my manual changes back into our puppet code, but my understanding is that the config.yml has to be applied to one of the nodes with securityadmin.sh and that is all. I have puppet writing out the config.yml, but not executing the securityadmin.sh to apply it.

---

<div class="post-metadata">

**Author:** ![kiowajoe](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/kiowajoe/32/109_2.png) [@kiowajoe](https://forum.opensearch.org/u/kiowajoe)\
**Post date:** [August 15, 2019, 7:50pm UTC](https://forum.opensearch.org/t/inconsistent-permissions-across-nodes/1333/3 "2019-08-15T19:50:50Z")

</div>

Solution: The truststore was incorrectly named on that host. I already filed a bug in the docs that this is required when using ldap for authz. The documentation indicates it is an alternative to key/pem files, but I found that authz requires this to be present.

---

<div class="post-metadata">

**Author:** ![user2111](https://avatars.discourse-cdn.com/v4/letter/u/6bbea6/32.png) [@user2111](https://forum.opensearch.org/u/user2111)\
**Post date:** [October 5, 2022, 12:52pm UTC](https://forum.opensearch.org/t/inconsistent-permissions-across-nodes/1333/4 "2022-10-05T12:52:39Z")

</div>

Good afternoon @kiowajoe .  
I have a similar problem as you. I have a three-node cluster and only one node - the one where I ran securityadmin.sh - responds with index details whereas the other both have no permissions.

Could you provide more details how you solved this issue?

---

<div class="post-metadata">

**Author:** ![user2111](https://avatars.discourse-cdn.com/v4/letter/u/6bbea6/32.png) [@user2111](https://forum.opensearch.org/u/user2111)\
**Post date:** [October 5, 2022, 2:31pm UTC](https://forum.opensearch.org/t/inconsistent-permissions-across-nodes/1333/5 "2022-10-05T14:31:26Z")

</div>

I managed to solve this:

> [@LDAP Authentication: Not able to login; no Permissions for User](https://forum.opensearch.org/t/ldap-authentication-not-able-to-login-no-permissions-for-user/10832/21):
>
> @pablo I think I have a similar problem as here: but unfortunately I don’t really understand the solution.