# LDAP backend group - Opensearch role permissions issue

**URL:** <https://forum.opensearch.org/t/ldap-backend-group-opensearch-role-permissions-issue/14137>\
**Category:** Security\
**Tags:** troubleshoot\
**Created:** [April 28, 2023, 1:29pm UTC](https://forum.opensearch.org/t/ldap-backend-group-opensearch-role-permissions-issue/14137 "2023-04-28T13:29:08Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![denkar](https://avatars.discourse-cdn.com/v4/letter/d/ec9cab/32.png) [@denkar](https://forum.opensearch.org/u/denkar)\
**Post date:** [April 28, 2023, 1:29pm UTC](https://forum.opensearch.org/t/ldap-backend-group-opensearch-role-permissions-issue/14137/1 "2023-04-28T13:29:08Z")

</div>

Hi,

I am using ldap backend groups mapped to different roles which works fine,  
but am having problem with permissions when a specific backend group is mapped to multiple different opensearch roles.

It seems like the opensearch role with most restrictive permissions beats the role which has higher permissions,  
is that by design or is there a way to overcome this ?

Example:

\<roles.yml\>

##### Custom roles

Index Mgmt (view access)

With this role you can view “Discover” and “Stack Mgmt - Index Patterns”,“Index Mgmt - Indices”

view-all-indices:  
reserved: true  
cluster\_permissions:  
- “cluster:monitor\*”  
- “cluster:admin/opendistro/ism\*”  
index\_permissions:  
- index\_patterns:  
- “\*”  
allowed\_actions:  
- “indices:admin/data\_stream/get”  
- “indices:admin/resolve/index”  
- “indices:admin/aliases/get”  
- “indices:monitor/settings/get”  
- “indices:monitor/stats”  
- “indices:monitor/recovery”  
- “indices:data/read/search”

test-app-role  
With this role you can view “Discover” and “Stack Mgmt - Index Patterns”  
But you cannot list Indices within “Index Mgmt - Indices”,  
you get an “indices:admin/aliases/get” permission error, only way to solve this is to change index pattern to “\*”

test-app-role:  
reserved: true  
cluster\_permissions:  
- “cluster:monitor\*”  
- “cluster:admin/opendistro/ism\*”  
index\_permissions:  
- index\_patterns:  
- “_kibana_”  
- “index1\*”  
allowed\_actions:  
- “indices:admin\*”  
- “indices:data\*”  
- “indices:monitor\*”  
tenant\_permissions:  
- tenant\_patterns:  
- “_"  
allowed\_actions:  
- "_”

* * *

* * *

\<roles\_mapping.yml\>

##### Custom roles\_mapping

If group is member of both roles it still does not work.

view-all-indices:  
reserved: true  
backend\_roles:

- “ldap\_test\_app\_group”

test-app-role:  
reserved: true  
backend\_roles:

- “ldap\_test\_app\_group”

Thing is that the “test-app-role” should be able to read/write/search its own index1 AND list all other indices  
Would really appreciate if someone are able to help with this issue

Best Regards  
//Dennis

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [May 5, 2023, 2:47pm UTC](https://forum.opensearch.org/t/ldap-backend-group-opensearch-role-permissions-issue/14137/2 "2023-05-05T14:47:44Z")

</div>

@denkar Have you tried .kibana or .kibana\* as your index pattern in the role?

If you execute the command below, do you see only the described roles?  
Could you share the output?

```auto
curl --insecure -u <test_user> -XGET https://<OpenSearch_node_FQDN_or_IP>:9200/_plugins/_security/authinfo?pretty

```

---

<div class="post-metadata">

**Author:** ![denkar](https://avatars.discourse-cdn.com/v4/letter/d/ec9cab/32.png) [@denkar](https://forum.opensearch.org/u/denkar)\
**Post date:** [May 8, 2023, 11:31am UTC](https://forum.opensearch.org/t/ldap-backend-group-opensearch-role-permissions-issue/14137/3 "2023-05-08T11:31:34Z")

</div>

> [@pablo](#):
>
> `curl --insecure -u <test_user> -XGET https://<OpenSearch_node_FQDN_or_IP>:9200/_plugins/_security/authinfo?pretty`

Hi,

test-app-role:  
Added the index pattern “.kibana\*” to the list and kept the “index1\*” , but the test user still does not have the permission to see/list all indexes.

[2023-05-08T13:04:20,031][INFO][o.o.s.p.PrivilegesEvaluator] [opensearch] No index-level perm match for User [name=api-test, backend\_roles=[api-test]  
[2023-05-08T13:04:20,031][INFO][o.o.s.p.PrivilegesEvaluator] [opensearch] No permissions for [indices:admin/data\_stream/get]

Here is the result from the above command:

“user” : “User [name=api-test, backend\_roles=[api-test], requestedTenant=null]”,  
“user\_name” : “api-test”,  
“user\_requested\_tenant” : null,  
“remote\_address” : “10.126.2.158:58850”,  
“backend\_roles” : [  
“api-test”  
],  
“custom\_attribute\_names” : [  
“ldap.dn”,  
“attr.ldap.hasSubordinates”,  
“attr.ldap.entryUUID”,  
“attr.ldap.subschemaSubentry”,  
“attr.ldap.createTimestamp”,  
“attr.ldap.modifyTimestamp”,  
“ldap.original.username”,  
“attr.ldap.creatorsName”,  
“attr.ldap.structuralObjectClass”,  
“attr.ldap.objectClass”,  
“attr.ldap.uid”,  
“attr.ldap.modifiersName”  
],  
“roles” : [  
“own\_index”,  
“api-test-indices”  
],  
“tenants” : {  
“global\_tenant” : false,  
“admin\_tenant” : false,  
“api-test-indices” : true  
},  
“principal” : null,  
“peer\_certificates” : “0”,  
“sso\_logout\_url” : null  
}

Maybe it has something to do with the tenant config ?

Best Regards  
//Dennis

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [May 9, 2023, 6:28pm UTC](https://forum.opensearch.org/t/ldap-backend-group-opensearch-role-permissions-issue/14137/4 "2023-05-09T18:28:01Z")

</div>

@denkar

I’ve tested your roles and when I use api-test role then I can’t list the indices in “Index Mgmt - Indices”. However, when both are assigned then I can list indices.

Could you share your opensearch\_dashbaords.yml file?

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [May 9, 2023, 6:37pm UTC](https://forum.opensearch.org/t/ldap-backend-group-opensearch-role-permissions-issue/14137/5 "2023-05-09T18:37:33Z")

</div>

@denkar Please also share opensearch.yml.

---

<div class="post-metadata">

**Author:** ![denkar](https://avatars.discourse-cdn.com/v4/letter/d/ec9cab/32.png) [@denkar](https://forum.opensearch.org/u/denkar)\
**Post date:** [May 15, 2023, 12:06pm UTC](https://forum.opensearch.org/t/ldap-backend-group-opensearch-role-permissions-issue/14137/6 "2023-05-15T12:06:51Z")

</div>

Hi,

Here are the files.

opensearch.yml

cluster.name: opensearch  
path.logs: /var/log/opensearch

network.host: localhost  
http.host: 0.0.0.0  
http.port: 9200

plugins.security.ssl.transport.pemcert\_filepath: ./cert/chain.pem  
plugins.security.ssl.transport.pemkey\_filepath: ./cert/privatekey.pem  
plugins.security.ssl.transport.pemtrustedcas\_filepath: ./cert/ca.pem  
plugins.security.ssl.transport.enforce\_hostname\_verification: false  
plugins.security.ssl.http.enabled: true  
plugins.security.ssl.http.pemcert\_filepath: ./cert/chain.pem  
plugins.security.ssl.http.pemkey\_filepath: ./cert/privatekey.pem  
plugins.security.ssl.http.pemtrustedcas\_filepath: ./cert/ca.pem  
plugins.security.ssl.http.clientauth\_mode: OPTIONAL  
plugins.security.allow\_default\_init\_securityindex: true  
plugins.security.authcz.admin\_dn:

- CN=opensearch.xxxxx.xx  
plugins.security.nodes\_dn:
- CN=opensearch.xxxxx.xx  
plugins.security.audit.type: internal\_opensearch  
plugins.security.enable\_snapshot\_restore\_privilege: true  
plugins.security.check\_snapshot\_restore\_write\_privileges: true  
plugins.security.restapi.roles\_enabled: [“all\_access”, “security\_rest\_api\_access”]  
plugins.security.system\_indices.enabled: true  
plugins.security.system\_indices.indices: [“.plugins-ml-model”, “.plugins-ml-task”, “.opendistro-alerting-config”, “.opendistro-alerting-alert\*”, “.opendistro-anomaly-results\*”, “.opendistro-anomaly-detector\*”, “.opendistro-anomaly-checkpoints”, “.opendistro-anomaly-detection-state”, “.opendistro-reports-_", ".opensearch-notifications-_”, “.opensearch-notebooks”, “.opensearch-observability”, “.opendistro-asynchronous-search-response\*”, “.replication-metadata-store”]  
node.max\_local\_storage\_nodes: 3  
plugins.security.disabled: false

opensearch\_dashboards.yml

server.host: “127.0.0.1”

opensearch.hosts: [[https://opensearch.xxxxx.xx:9200](https://opensearch.xxxxx.xx:9200)]  
opensearch.ssl.verificationMode: none  
opensearch.username: kibanaserver  
opensearch.password: xxxxx  
opensearch.requestHeadersAllowlist: [authorization,securitytenant]

logging.dest: /var/log/opensearch-dashboard/opensearch-dashboard.log  
logging.quiet: false

opensearch\_security.multitenancy.enabled: true  
opensearch\_security.multitenancy.tenants.enable\_global: true  
opensearch\_security.multitenancy.tenants.enable\_private: true  
opensearch\_security.multitenancy.tenants.preferred: [“Global”]  
opensearch\_security.readonly\_mode.roles: [kibana\_read\_only]  
opensearch.ssl.certificateAuthorities: [“/usr/opensearch/config/cert/ca.pem”]

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [May 15, 2023, 1:37pm UTC](https://forum.opensearch.org/t/ldap-backend-group-opensearch-role-permissions-issue/14137/7 "2023-05-15T13:37:49Z")

</div>

> [@denkar](#):
>
> plugins.security.ssl.http.clientauth\_mode: OPTIONAL

Do you use client certificate authentication?

Why do you need this in the opensearch\_dashboards.yml? This is not required when you  
have `verificationMode` set to `none`.

```auto
opensearch.ssl.certificateAuthorities: [“/usr/opensearch/config/cert/ca.pem”]

```

---

<div class="post-metadata">

**Author:** ![denkar](https://avatars.discourse-cdn.com/v4/letter/d/ec9cab/32.png) [@denkar](https://forum.opensearch.org/u/denkar)\
**Post date:** [May 15, 2023, 10:04pm UTC](https://forum.opensearch.org/t/ldap-backend-group-opensearch-role-permissions-issue/14137/8 "2023-05-15T22:04:29Z")

</div>

Nope, I dont use client cert. auth.

Misplaced config…will disable it right away and try again,  
thanks for helping out

Best Regards  
//Dennis

---

<div class="post-metadata">

**Author:** ![denkar](https://avatars.discourse-cdn.com/v4/letter/d/ec9cab/32.png) [@denkar](https://forum.opensearch.org/u/denkar)\
**Post date:** [May 16, 2023, 11:20am UTC](https://forum.opensearch.org/t/ldap-backend-group-opensearch-role-permissions-issue/14137/9 "2023-05-16T11:20:20Z")

</div>

Hi again,

Issue still remains even though I removed the line,  
opensearch.ssl.certificateAuthorities: [“/usr/opensearch/config/cert/ca.pem”] from opensearch\_dashboards.yml

When the user logs into the GUI and tries to view all the Indices under Index Mgmt the following error occurs:  
“[security\_exception] no permissions for [indices:monitor/recovery] and User [name=api-test, backend\_roles=[api-test], requestedTenant=]”

Config from roles.yml is below:

api-test:  
reserved: true  
cluster\_permissions:  
- “cluster:monitor\*”  
- “cluster:admin/opendistro/ism\*”  
index\_permissions:  
- index\_patterns:  
- “.kibana\*”  
- “index1\*”  
allowed\_actions:  
- “indices:admin\*”  
- “indices:data\*”  
- “indices:monitor\*”  
tenant\_permissions:  
- tenant\_patterns:  
- “_"  
allowed\_actions:  
- "_”

Seems like that you really need to have the  
- index\_patterns:  
- “\*”  
In order to view all indexes ?

Best Regards  
//Dennis

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [May 19, 2023, 5:16pm UTC](https://forum.opensearch.org/t/ldap-backend-group-opensearch-role-permissions-issue/14137/11 "2023-05-19T17:16:47Z")

</div>

@denkar If I use only `api-test` role I won’t be able to see the indices no matter if I have or not ‘\*’ in index\_patters.

However, I’ve found that your index allowed actions didn’t work for me.

> [@denkar](#):
>
> allowed\_actions:
> 
> - “indices:admin\*”
> - “indices:data\*”
> - “indices:monitor\*”

OpenSearch didn’t recognize them. I had to set the exact permissions as you had in `view-all-indices` role.

```auto
    allowed_actions:
    - "indices:admin/data_stream/get"
    - "indices:admin/resolve/index"
    - "indices:admin/aliases/get"
    - "indices:monitor/settings/get"
    - "indices:monitor/stats"
    - "indices:monitor/recovery"
    - "indices:data/read/search"

```

Then only the role with \* could list the indices.

You could report it as a bug in [GitHub OpenSearch security](https://github.com/opensearch-project/security/issues).  
If you do, please share the link to the bug here.