# Minimum rights for the user used to connect Kibana with OpenSearch/OpenDistro ES

**URL:** <https://forum.opensearch.org/t/minimum-rights-for-the-user-used-to-connect-kibana-with-opensearch-opendistro-es/7139>\
**Category:** Security\
**Tags:** discuss\
**Created:** [September 29, 2021, 3:22pm UTC](https://forum.opensearch.org/t/minimum-rights-for-the-user-used-to-connect-kibana-with-opensearch-opendistro-es/7139 "2021-09-29T15:22:57Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![antonisnyc](https://avatars.discourse-cdn.com/v4/letter/a/c2a13f/32.png) [@antonisnyc](https://forum.opensearch.org/u/antonisnyc)\
**Post date:** [September 29, 2021, 3:22pm UTC](https://forum.opensearch.org/t/minimum-rights-for-the-user-used-to-connect-kibana-with-opensearch-opendistro-es/7139/1 "2021-09-29T15:22:57Z")

</div>

Hello,

I am trying to have a user in my opendistro kibana 1.13.2 , with minimal rights to be able and connect to Amazon Opensearch 7.10.2. I assigned the user the kibana\_user role but im getting… note that I made copy of the kibana\_user role and assigned it [indices:admin/get] for all “\*” indices and still get the same error

`{"type":"log","@timestamp":"2021-09-29T15:18:58Z","tags":["error","elasticsearch","data"],"pid":20,"message":"[security_exception]: no permissions for [indices:admin/get] and User [name=kibana-user, backend_roles=[], requestedTenant=null]"}`

```auto
{
  "kibana_role" : {
    "reserved" : false,
    "hidden" : false,
    "cluster_permissions" : [
      "cluster_composite_ops",
      "cluster_monitor",
      "indices_monitor",
      "indices:admin/get"
    ],
    "index_permissions" : [
      {
        "index_patterns" : [
          ".kibana",
          ".kibana-6",
          ".kibana_*",
          ".kibana*"
        ],
        "fls" : [],
        "masked_fields" : [],
        "allowed_actions" : [
          "read",
          "delete",
          "manage",
          "index"
        ]
      },
      {
        "index_patterns" : [
          ".tasks",
          ".management-beats"
        ],
        "fls" : [],
        "masked_fields" : [],
        "allowed_actions" : [
          "indices_all"
        ]
      },
      {
        "index_patterns" : [
          "wazuh*"
        ],
        "dls" : "",
        "fls" : [],
        "masked_fields" : [],
        "allowed_actions" : [
          "read",
          "index",
          "manage"
        ]
      },
      {
        "index_patterns" : [
          "*"
        ],
        "dls" : "",
        "fls" : [],
        "masked_fields" : [],
        "allowed_actions" : [
          "read",
          "get",
          "manage",
          "indices_all"
        ]
      }
    ],
    "tenant_permissions" : [],
    "static" : false
  }
}

```

---

<div class="post-metadata">

**Author:** ![Anthony](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/anthony/32/9939_2.png) [@Anthony](https://forum.opensearch.org/u/Anthony)\
**Post date:** [September 29, 2021, 3:55pm UTC](https://forum.opensearch.org/t/minimum-rights-for-the-user-used-to-connect-kibana-with-opensearch-opendistro-es/7139/2 "2021-09-29T15:55:12Z")

</div>

@antonisnyc  
I am not able to reproduce your case.  
Can you please select “View Roles and Identities” and confirm that the user is mapped correctly to this role, it should appear under _ **Roles** _ section.

Can you also confirm when exactly you seeing this error? What are you trying to view/edit, which index?

---

<div class="post-metadata">

**Author:** ![antonisnyc](https://avatars.discourse-cdn.com/v4/letter/a/c2a13f/32.png) [@antonisnyc](https://forum.opensearch.org/u/antonisnyc)\
**Post date:** [September 29, 2021, 6:53pm UTC](https://forum.opensearch.org/t/minimum-rights-for-the-user-used-to-connect-kibana-with-opensearch-opendistro-es/7139/3 "2021-09-29T18:53:40Z")

</div>

Hey @Anthony ,

The kibana is a brand new instance and the user never connected with ES before. The user is mapped to the role as seen below:

GET \_opendistro/\_security/api/rolesmapping/kibana\_role

```auto
{
  "kibana_role" : {
    "hosts" : [],
    "users" : [
      "kibana-user"
    ],
    "reserved" : false,
    "hidden" : false,
    "backend_roles" : [],
    "and_backend_roles" : []
  }
}

```

I am seeing this error under the kibana’s container logs. It’s the same error every 2 seconds…  
`{"type":"log","@timestamp":"2021-09-29T15:18:58Z","tags":["error","elasticsearch","data"],"pid":20,"message":"[security_exception]: no permissions for [indices:admin/get] and User [name=kibana-user, backend_roles=[], requestedTenant=null]"}`

This is the kibana.yaml in case it helps.

```auto
            server.host: '0.0.0.0'

            elasticsearch.hosts: ['https://${ELASTICSEARCH_HOST}:443']
            kibana.index: ".kibana"

            elasticsearch.ssl.verificationMode: full # if not using HTTPS

            opendistro_security.auth.type: basicauth
            opendistro_security.auth.anonymous_auth_enabled: false
            opendistro_security.cookie.secure: false # set to true when using HTTPS
            opendistro_security.cookie.ttl: 3600000
            opendistro_security.session.ttl: 3600000
            opendistro_security.session.keepalive: false
            opendistro_security.readonly_mode.roles: ['kibana_read_only']
            opendistro_security.auth.unauthenticated_routes: []
            opendistro_security.basicauth.login.title: 'Please log in using your user name and password'
            opendistro_security.multitenancy.enabled: true
            opendistro_security.multitenancy.tenants.enable_global: true
            opendistro_security.multitenancy.tenants.enable_private: true
            opendistro_security.multitenancy.tenants.preferred: ["Global", "Private"]
            opendistro_security.multitenancy.enable_filter: false

            elasticsearch.username: '${kibana_user}'
            elasticsearch.password: '${kibana_pass}'
            elasticsearch.requestHeadersWhitelist: [authorization, securitytenant, security_tenant,]

```

---

<div class="post-metadata">

**Author:** ![Anthony](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/anthony/32/9939_2.png) [@Anthony](https://forum.opensearch.org/u/Anthony)\
**Post date:** [September 29, 2021, 7:14pm UTC](https://forum.opensearch.org/t/minimum-rights-for-the-user-used-to-connect-kibana-with-opensearch-opendistro-es/7139/4 "2021-09-29T19:14:30Z")

</div>

@antonisnyc  
The line below should refer to kibanaserver user, not kibana-user.

Kibana\_server role is design for kibana to connect to elasticsearch/opensearch, kibana\_user is for giving users access to use kibana.

Apart from the logs, are you seeing any errors in UI?

---

<div class="post-metadata">

**Author:** ![antonisnyc](https://avatars.discourse-cdn.com/v4/letter/a/c2a13f/32.png) [@antonisnyc](https://forum.opensearch.org/u/antonisnyc)\
**Post date:** [September 29, 2021, 8:27pm UTC](https://forum.opensearch.org/t/minimum-rights-for-the-user-used-to-connect-kibana-with-opensearch-opendistro-es/7139/5 "2021-09-29T20:27:05Z")

</div>

@Anthony  
Hmm I was looking for a role to be able and connect the kibana instance to Opensearch… Would you have anything in mind? I cant connect to the UI, it just says “Kibana is loading”

Regards,  
Tony

---

<div class="post-metadata">

**Author:** ![Anthony](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/anthony/32/9939_2.png) [@Anthony](https://forum.opensearch.org/u/Anthony)\
**Post date:** [September 29, 2021, 9:27pm UTC](https://forum.opensearch.org/t/minimum-rights-for-the-user-used-to-connect-kibana-with-opensearch-opendistro-es/7139/6 "2021-09-29T21:27:55Z")

</div>

@antonisnyc there should already be a default kibana\_server role that you can map the login to. By default any user with backend\_role “kibanaserver” is mapped to it.

The role itself consists of the below:

```auto
kibana_server_copy:
  reserved: false
  hidden: false
  cluster_permissions:
  - "cluster_monitor"
  - "cluster_composite_ops"
  - "indices:admin/template*"
  - "indices:data/read/scroll*"
  index_permissions:
  - index_patterns:
    - ".kibana"
    fls: []
    masked_fields: []
    allowed_actions:
    - "indices_all"
  - index_patterns:
    - ".kibana-6"
    fls: []
    masked_fields: []
    allowed_actions:
    - "indices_all"
  - index_patterns:
    - ".kibana_*"
    fls: []
    masked_fields: []
    allowed_actions:
    - "indices_all"
  - index_patterns:
    - ".tasks"
    fls: []
    masked_fields: []
    allowed_actions:
    - "indices_all"
  - index_patterns:
    - ".management-beats*"
    fls: []
    masked_fields: []
    allowed_actions:
    - "indices_all"
  - index_patterns:
    - "*"
    fls: []
    masked_fields: []
    allowed_actions:
    - "indices:admin/aliases*"
  tenant_permissions: []
  static: false

```

You would need a separate username and password for this access, and map it to this role.

Hope this helps

---

<div class="post-metadata">

**Author:** ![antonisnyc](https://avatars.discourse-cdn.com/v4/letter/a/c2a13f/32.png) [@antonisnyc](https://forum.opensearch.org/u/antonisnyc)\
**Post date:** [September 29, 2021, 11:13pm UTC](https://forum.opensearch.org/t/minimum-rights-for-the-user-used-to-connect-kibana-with-opensearch-opendistro-es/7139/7 "2021-09-29T23:13:56Z")

</div>

@Anthony

Thank you so much for your response!! Unfortunately, I still have the same error as before. Here you can see the role changes.

```auto
{
  "kibana_role" : {
    "reserved" : false,
    "hidden" : false,
    "cluster_permissions" : [
      "cluster_monitor",
      "cluster_composite_ops_ro",
      "indices:admin/template/get",
      "indices:admin/template/put",
      "indices:admin/template/delete",
      "indices:data/read/scroll",
      "indices:admin/get"
    ],
    "index_permissions" : [
      {
        "index_patterns" : [
          ".kibana",
          ".kibana-6",
          ".kibana_*",
          ".kibana*"
        ],
        "fls" : [],
        "masked_fields" : [],
        "allowed_actions" : [
          "indices_all"
        ]
      },
      {
        "index_patterns" : [
          ".tasks",
          ".management-beats"
        ],
        "fls" : [],
        "masked_fields" : [],
        "allowed_actions" : [
          "indices_all"
        ]
      },
      {
        "index_patterns" : [
          "wazuh*"
        ],
        "dls" : "",
        "fls" : [],
        "masked_fields" : [],
        "allowed_actions" : [
          "read",
          "index",
          "manage"
        ]
      },
      {
        "index_patterns" : [
          "*"
        ],
        "dls" : "",
        "fls" : [],
        "masked_fields" : [],
        "allowed_actions" : [
          "indices:admin/aliases",
          "indices:admin/get"
        ]
      }
    ],
    "tenant_permissions" : [],
    "static" : false
  }
}

```

---

<div class="post-metadata">

**Author:** ![antonisnyc](https://avatars.discourse-cdn.com/v4/letter/a/c2a13f/32.png) [@antonisnyc](https://forum.opensearch.org/u/antonisnyc)\
**Post date:** [September 29, 2021, 11:32pm UTC](https://forum.opensearch.org/t/minimum-rights-for-the-user-used-to-connect-kibana-with-opensearch-opendistro-es/7139/8 "2021-09-29T23:32:27Z")

</div>

Also as you can see the kibanaserver role isn’t present… Note: the kibana with the screenshot is the one which comes with Amazon Opensearch

 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/0/0ff918e9597f9efba1676aa5dcaa6f58f030393f.png)

---

<div class="post-metadata">

**Author:** ![Anthony](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/anthony/32/9939_2.png) [@Anthony](https://forum.opensearch.org/u/Anthony)\
**Post date:** [September 30, 2021, 7:25am UTC](https://forum.opensearch.org/t/minimum-rights-for-the-user-used-to-connect-kibana-with-opensearch-opendistro-es/7139/9 "2021-09-30T07:25:08Z")

</div>

@antonisnyc  
It seems the tenant permissions are hardcoded somewhere in the code.

The role that you should use for kibana is:

```auto
kibana_server_new:
  reserved: false
  hidden: false
  cluster_permissions:
  - "cluster_monitor"
  - "cluster_composite_ops"
  - "indices:admin/template*"
  - "indices:data/read/scroll*"
  index_permissions:
  - index_patterns:
    - ".kibana"
    fls: []
    masked_fields: []
    allowed_actions:
    - "indices_all"
  - index_patterns:
    - ".kibana-6"
    fls: []
    masked_fields: []
    allowed_actions:
    - "indices_all"
  - index_patterns:
    - ".kibana_*"
    fls: []
    masked_fields: []
    allowed_actions:
    - "indices_all"
  - index_patterns:
    - ".tasks"
    fls: []
    masked_fields: []
    allowed_actions:
    - "indices_all"
  - index_patterns:
    - ".management-beats*"
    fls: []
    masked_fields: []
    allowed_actions:
    - "indices_all"
  - index_patterns:
    - "*"
    fls: []
    masked_fields: []
    allowed_actions:
    - "indices:admin/aliases*"
  tenant_permissions: 
    - tenant_patterns:
      - '*'
      allowed_actions:
        - 'kibana_all_read'
  static: false

```

Can you try this and confirm he result?

---

<div class="post-metadata">

**Author:** ![antonisnyc](https://avatars.discourse-cdn.com/v4/letter/a/c2a13f/32.png) [@antonisnyc](https://forum.opensearch.org/u/antonisnyc)\
**Post date:** [September 30, 2021, 9:38am UTC](https://forum.opensearch.org/t/minimum-rights-for-the-user-used-to-connect-kibana-with-opensearch-opendistro-es/7139/10 "2021-09-30T09:38:33Z")

</div>

Thank you so much @Anthony that solved the problem!