# Lock out users from Kibana Management? **URL:** \ **Category:** Security\ **Tags:** discuss\ **Created:** [June 24, 2021, 10:48pm UTC](https://forum.opensearch.org/t/lock-out-users-from-kibana-management/6345 "2021-06-24T22:48:20Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![reshippie](https://avatars.discourse-cdn.com/v4/letter/r/ecd19e/32.png) [@reshippie](https://forum.opensearch.org/u/reshippie)\ **Post date:** [June 24, 2021, 10:48pm UTC](https://forum.opensearch.org/t/lock-out-users-from-kibana-management/6345/1 "2021-06-24T22:48:20Z")
I’m looking for a set of permissions that’s looser than using `opendistro_security.readonly_mode.roles`, but will prevent users from changing things under Stack Management. I haven’t figured out a way to keep people from changing the global settings like the Index Patterns or the timezone for date formatting. Ideally they’d only be able to use Discover, Dashboard, and Visualize under the Kibana app. Using the `readonly_mode` only allows access to Dashboard, which means users can’t (edit: forgot the 't) see the actual loglines as they are coming in to the system. I’d settle for something that just allows access to Discover, or a Dashboard that can show all of the fields parsed from a logline. ---
**Author:** ![Anthony](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/anthony/32/9939_2.png) [@Anthony](https://forum.opensearch.org/u/Anthony)\ **Post date:** [June 25, 2021, 12:32pm UTC](https://forum.opensearch.org/t/lock-out-users-from-kibana-management/6345/2 "2021-06-25T12:32:12Z")
@reshippie can you please elaborate on the requirement. “which means users can see the actual loglines as they are coming in to the system.” You want the users to be able to see these via discovery view or not? Because readonly\_mode doesn’t show that, if I understand you correctly? ---
**Author:** ![reshippie](https://avatars.discourse-cdn.com/v4/letter/r/ecd19e/32.png) [@reshippie](https://forum.opensearch.org/u/reshippie)\ **Post date:** [June 25, 2021, 4:41pm UTC](https://forum.opensearch.org/t/lock-out-users-from-kibana-management/6345/3 "2021-06-25T16:41:48Z")
Correct, readonly\_mode only allows access to Dashboards and I haven’t figured out a way to get a dashboard to display the full logline. Data Table sounded like the most likely option, but it only allows me to display metrics about the data, not the data itself. ---
**Author:** ![Anthony](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/anthony/32/9939_2.png) [@Anthony](https://forum.opensearch.org/u/Anthony)\ **Post date:** [June 28, 2021, 5:25pm UTC](https://forum.opensearch.org/t/lock-out-users-from-kibana-management/6345/4 "2021-06-28T17:25:49Z")
@reshippie It sounds like you are just looking for normal user that just has access to read data and kibana objects. It should be as simple as mapping user to kibana\_user role and additional role below: ![Screenshot 2021-06-28 at 18.24.59](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/0/044e0278036679d1a99051347b85ab27dd172a20.png) ---
**Author:** ![reshippie](https://avatars.discourse-cdn.com/v4/letter/r/ecd19e/32.png) [@reshippie](https://forum.opensearch.org/u/reshippie)\ **Post date:** [June 28, 2021, 9:16pm UTC](https://forum.opensearch.org/t/lock-out-users-from-kibana-management/6345/5 "2021-06-28T21:16:02Z")
Unfortunately, when I tested the `kibana_user` role it allowed a user to add and remove index patterns as well as make changes on the Advanced Settings page. I tried creating a new role with the same permissions as `kibana_user` but that managed to block access to the Discover and Dashboard pages as well as the Stack Management page. The error that I was getting from Kibana was: > {“type”:“log”,“@timestamp”:“2021-06-28T18:21:03Z”,“tags”:[“error”,“elasticsearch”,“data”],“pid”:15917,“message”:“[security\_exception]: no permissions for [indices:data/read/get] and User [name=test, backend\_roles=[kibana], requestedTenant=null]”} ‘kibana’ being an LDAP group that I have mapped to the OpenDistro Security roles. I’m not sure which index it’s complaining about. `kibana_user` grants permissions to several `.kibana` indices along with `.tasks` and `.management` and the other role I created has `read` and `search` on `*` indices. I’m using opendistroforelasticsearch-kibana 1.13.2. ---
**Author:** ![Anthony](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/anthony/32/9939_2.png) [@Anthony](https://forum.opensearch.org/u/Anthony)\ **Post date:** [June 29, 2021, 11:20am UTC](https://forum.opensearch.org/t/lock-out-users-from-kibana-management/6345/6 "2021-06-29T11:20:05Z")
@reshippie You are able to save searches from discovery and add these to dashboard, which can then be accessed by role mapped to kibana\_read\_only (additional role would need to be mapped giving access to right indices and tenants) This way user only has access to dashboards, but the loglines are displayed also. Hope this helps ---
**Author:** ![amirkh81](https://avatars.discourse-cdn.com/v4/letter/a/9e8a1a/32.png) [@amirkh81](https://forum.opensearch.org/u/amirkh81)\ **Post date:** [March 17, 2022, 12:25pm UTC](https://forum.opensearch.org/t/lock-out-users-from-kibana-management/6345/7 "2022-03-17T12:25:44Z")
@reshippie Could you please give me what you have done to solve this issue? I 'm facing the same problem. I have backend role in oidc token, in my case case “ **kibana\_restricted** ” and I mapped to a role which has the same permission like “ **kibana\_user** ”. I get this error: ```auto {"statusCode":403,"error":"Forbidden","message":"no permissions for [indices:data/read/search] and User [name=demo.demo, backend_roles=[kibana_restricted], requestedTenant=null]: security_exception"} ``` I can not see an Discover or Dashboard page. which permissions did you granted? thanks in advance Amir ---
**Author:** ![Anthony](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/anthony/32/9939_2.png) [@Anthony](https://forum.opensearch.org/u/Anthony)\ **Post date:** [March 17, 2022, 1:21pm UTC](https://forum.opensearch.org/t/lock-out-users-from-kibana-management/6345/8 "2022-03-17T13:21:46Z")
@amirkh81 In the role, which has the same permission like “ **kibana\_user** ”, can you try to add tenant permission for global tenant (and/or any other tenant you are using). This should get rid of the error you are seeing. This permission seems to be hardcoded to role kibana\_user and needs to be added manually. ---
**Author:** ![amirkh81](https://avatars.discourse-cdn.com/v4/letter/a/9e8a1a/32.png) [@amirkh81](https://forum.opensearch.org/u/amirkh81)\ **Post date:** [March 17, 2022, 1:38pm UTC](https://forum.opensearch.org/t/lock-out-users-from-kibana-management/6345/9 "2022-03-17T13:38:53Z")
Oh you saved my day. thanks @reshippie ---
**Author:** ![tibz7](https://avatars.discourse-cdn.com/v4/letter/t/a8b319/32.png) [@tibz7](https://forum.opensearch.org/u/tibz7)\ **Post date:** [March 28, 2023, 3:30pm UTC](https://forum.opensearch.org/t/lock-out-users-from-kibana-management/6345/10 "2023-03-28T15:30:22Z")
> [@Anthony](#): > > You are able to save searches from discovery and add these to dashboard, which can then be accessed by role mapped to kibana\_read\_only (additional role would need to be mapped giving access to right indices and tenants) I’m facing the same issue, but I cannot make it work. Does some one has an example of a working role where users are able to read/save queries in dashboard but not change advanced settings? seems they also renamed some indices in the meanwhile, because i see some `.kibana_admin` but no `.tasks` or `.management`. should not be that complicated