# Not able to disable global tenant in opensearch

**URL:** <https://forum.opensearch.org/t/not-able-to-disable-global-tenant-in-opensearch/17443>\
**Category:** OpenSearch\
**Created:** [January 16, 2024, 5:58pm UTC](https://forum.opensearch.org/t/not-able-to-disable-global-tenant-in-opensearch/17443 "2024-01-16T17:58:58Z")\
**Posts on this page:** 14\
**Page:** 1

<div class="post-metadata">

**Author:** ![peaky](https://avatars.discourse-cdn.com/v4/letter/p/b4bc9f/32.png) [@peaky](https://forum.opensearch.org/u/peaky)\
**Post date:** [January 16, 2024, 5:58pm UTC](https://forum.opensearch.org/t/not-able-to-disable-global-tenant-in-opensearch/17443/1 "2024-01-16T17:58:58Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser):

**Describe the issue** :  
I tried to disable global tenant in opensearch. But it is not disabling the global tenant. I used  
“opensearch\_security.multitenancy.tenants.enable\_global: false” in opensearch\_dashboard.yml file.  
So can you tell me how to disable global tenant

**Configuration** :

**Relevant Logs or Screenshots** :

---

<div class="post-metadata">

**Author:** ![Eugene7](https://avatars.discourse-cdn.com/v4/letter/e/bbce88/32.png) [@Eugene7](https://forum.opensearch.org/u/Eugene7)\
**Post date:** [January 17, 2024, 2:48pm UTC](https://forum.opensearch.org/t/not-able-to-disable-global-tenant-in-opensearch/17443/2 "2024-01-17T14:48:07Z")

</div>

Hi @peaky

Could you please share your `opensearch_dashboards.yml` and `config.yml` files ?

---

<div class="post-metadata">

**Author:** ![peaky](https://avatars.discourse-cdn.com/v4/letter/p/b4bc9f/32.png) [@peaky](https://forum.opensearch.org/u/peaky)\
**Post date:** [January 18, 2024, 5:06pm UTC](https://forum.opensearch.org/t/not-able-to-disable-global-tenant-in-opensearch/17443/3 "2024-01-18T17:06:47Z")

</div>

Sure!

_opensearch\_dashboards.yml_

```auto
opensearch.hosts: [https://IP:9200]
opensearch.ssl.verificationMode: none
opensearch.username: username
opensearch.password: password
opensearch.requestHeadersWhitelist: [authorization, securitytenant]

opensearch_security.multitenancy.enabled: true
opensearch_security.multitenancy.tenants.enable_private: false
opensearch_security.multitenancy.tenants.enable_global: false
opensearch_security.readonly_mode.roles: [kibana_read_only]

opensearch_security.cookie.secure: false
server.host: '0.0.0.0'

```

---

<div class="post-metadata">

**Author:** ![peaky](https://avatars.discourse-cdn.com/v4/letter/p/b4bc9f/32.png) [@peaky](https://forum.opensearch.org/u/peaky)\
**Post date:** [January 18, 2024, 5:07pm UTC](https://forum.opensearch.org/t/not-able-to-disable-global-tenant-in-opensearch/17443/4 "2024-01-18T17:07:29Z")

</div>

_config.yml_

```auto
_meta:
  type: "config"
  config_version: 2

config:
  dynamic:
    # Set filtered_alias_mode to 'disallow' to forbid more than 2 filtered aliases per index
    # Set filtered_alias_mode to 'warn' to allow more than 2 filtered aliases per index but warns about it (default)
    # Set filtered_alias_mode to 'nowarn' to allow more than 2 filtered aliases per index silently
    #filtered_alias_mode: warn
    #do_not_fail_on_forbidden: false
    #kibana:
    # Kibana multitenancy
    #multitenancy_enabled: true
    #private_tenant_enabled: true
    #default_tenant: ""
    #server_username: kibanaserver
    #index: '.kibana'
    http:
      anonymous_auth_enabled: false
      xff:
        enabled: false
        internalProxies: '192\.168\.0\.10|192\.168\.0\.11' # regex pattern
        #internalProxies: '.*' # trust all internal proxies, regex pattern
        #remoteIpHeader: 'x-forwarded-for'
        ###### see https://docs.oracle.com/javase/7/docs/api/java/util/regex/Pattern.html for regex help
        ###### more information about XFF https://en.wikipedia.org/wiki/X-Forwarded-For
        ###### and here https://tools.ietf.org/html/rfc7239
        ###### and https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Remote_IP_Valve
    authc:
      kerberos_auth_domain:
        http_enabled: false
        transport_enabled: false
        order: 6
        http_authenticator:
          type: kerberos
          challenge: true
          config:
            # If true a lot of kerberos/security related debugging output will be logged to standard out
            krb_debug: false
            # If true then the realm will be stripped from the user name
            strip_realm_from_principal: true
        authentication_backend:
          type: noop
      basic_internal_auth_domain:
        description: "Authenticate via HTTP Basic against internal users database"
        http_enabled: true
        transport_enabled: true
        order: 4
        http_authenticator:
          type: basic
          challenge: true
        authentication_backend:
          type: intern
      proxy_auth_domain:
        description: "Authenticate via proxy"
        http_enabled: false
        transport_enabled: false
        order: 3
        http_authenticator:
          type: proxy
          challenge: false
          config:
            user_header: "x-proxy-user"
            roles_header: "x-proxy-roles"
        authentication_backend:
          type: noop
      jwt_auth_domain:
        description: "Authenticate via Json Web Token"
        http_enabled: false
        transport_enabled: false
        order: 0
        http_authenticator:
          type: jwt
          challenge: false
          config:
            signing_key: "base64 encoded HMAC key or public RSA/ECDSA pem key"
            jwt_header: "Authorization"
            jwt_url_parameter: null
            jwt_clock_skew_tolerance_seconds: 30
            roles_key: null
            subject_key: null
        authentication_backend:
          type: noop
      clientcert_auth_domain:
        description: "Authenticate via SSL client certificates"
        http_enabled: false
        transport_enabled: false
        order: 2
        http_authenticator:
          type: clientcert
          config:
            username_attribute: cn #optional, if omitted DN becomes username
          challenge: false
        authentication_backend:
          type: noop
      ldap:
        description: "Authenticate via LDAP or Active Directory"
        http_enabled: false
        transport_enabled: false
        order: 5
        http_authenticator:
          type: basic
          challenge: false
        authentication_backend:
          # LDAP authentication backend (authenticate users against a LDAP or Active Directory)
          type: ldap
          config:
            # enable ldaps
            enable_ssl: false
            # enable start tls, enable_ssl should be false
            enable_start_tls: false
            # send client certificate
            enable_ssl_client_auth: false
            # verify ldap hostname
            verify_hostnames: true
            hosts:
            - localhost:8389
            bind_dn: null
            password: null
            userbase: 'ou=people,dc=example,dc=com'
            # Filter to search for users (currently in the whole subtree beneath userbase)
            # {0} is substituted with the username
            usersearch: '(sAMAccountName={0})'
            # Use this attribute from the user as username (if not set then DN is used)
            username_attribute: null
    authz:
      roles_from_myldap:
        description: "Authorize via LDAP or Active Directory"
        http_enabled: false
        transport_enabled: false
        authorization_backend:
          # LDAP authorization backend (gather roles from a LDAP or Active Directory, you have to configure the above LDAP authentication backend settings too)
          type: ldap
          config:
            # enable ldaps
            enable_ssl: false
            # enable start tls, enable_ssl should be false
            enable_start_tls: false
            # send client certificate
            enable_ssl_client_auth: false
            # verify ldap hostname
            verify_hostnames: true
            hosts:
            - localhost:8389
            bind_dn: null
            password: null
            rolebase: 'ou=groups,dc=example,dc=com'
            # Filter to search for roles (currently in the whole subtree beneath rolebase)
            # {0} is substituted with the DN of the user
            # {1} is substituted with the username
            # {2} is substituted with an attribute value from user's directory entry, of the authenticated user. Use userroleattribute to specify the name of the attribute
            rolesearch: '(member={0})'
            # Specify the name of the attribute which value should be substituted with {2} above
            userroleattribute: null
            # Roles as an attribute of the user entry
            userrolename: disabled
            #userrolename: memberOf
            # The attribute in a role entry containing the name of that role, Default is "name".
            # Can also be "dn" to use the full DN as rolename.
            rolename: cn
            # Resolve nested roles transitive (roles which are members of other roles and so on ...)
            resolve_nested_roles: true
            userbase: 'ou=people,dc=example,dc=com'
            # Filter to search for users (currently in the whole subtree beneath userbase)
            # {0} is substituted with the username
            usersearch: '(uid={0})'
            # Skip users matching a user name, a wildcard or a regex pattern
            #skip_users:
            # - 'cn=Michael Jackson,ou*people,o=TEST'
            # - '/\S*/'
      roles_from_another_ldap:
        description: "Authorize via another Active Directory"
        http_enabled: false
        transport_enabled: false
        authorization_backend:
          type: ldap
          #config goes here ...
  # auth_failure_listeners:
  # ip_rate_limiting:
  # type: ip
  # allowed_tries: 10
  # time_window_seconds: 3600
  # block_expiry_seconds: 600
  # max_blocked_clients: 100000
  # max_tracked_clients: 100000
  # internal_authentication_backend_limiting:
  # type: username
  # authentication_backend: intern
  # allowed_tries: 10
  # time_window_seconds: 3600
  # block_expiry_seconds: 600
  # max_blocked_clients: 100000
  # max_tracked_clients: 100000

```

---

<div class="post-metadata">

**Author:** ![Eugene7](https://avatars.discourse-cdn.com/v4/letter/e/bbce88/32.png) [@Eugene7](https://forum.opensearch.org/u/Eugene7)\
**Post date:** [January 19, 2024, 4:50pm UTC](https://forum.opensearch.org/t/not-able-to-disable-global-tenant-in-opensearch/17443/5 "2024-01-19T16:50:15Z")

</div>

What version of the OpenSearch and OpenSearch Dashboard do you have?

---

<div class="post-metadata">

**Author:** ![peaky](https://avatars.discourse-cdn.com/v4/letter/p/b4bc9f/32.png) [@peaky](https://forum.opensearch.org/u/peaky)\
**Post date:** [January 22, 2024, 9:51am UTC](https://forum.opensearch.org/t/not-able-to-disable-global-tenant-in-opensearch/17443/6 "2024-01-22T09:51:55Z")

</div>

Opensearch - 2.9.0  
Opensearch Dashboard - 2.9.0

---

<div class="post-metadata">

**Author:** ![Eugene7](https://avatars.discourse-cdn.com/v4/letter/e/bbce88/32.png) [@Eugene7](https://forum.opensearch.org/u/Eugene7)\
**Post date:** [January 22, 2024, 3:15pm UTC](https://forum.opensearch.org/t/not-able-to-disable-global-tenant-in-opensearch/17443/7 "2024-01-22T15:15:10Z")

</div>

Hi @peaky

I couldn’t reproduce your issue with global tenant in my lab.

 ![Screenshot 2024-01-22 at 15.14.08](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/0/0bb008236bb97adf49fa70cbcc3a58214e18b7c7.jpeg)

---

<div class="post-metadata">

**Author:** ![Eugene7](https://avatars.discourse-cdn.com/v4/letter/e/bbce88/32.png) [@Eugene7](https://forum.opensearch.org/u/Eugene7)\
**Post date:** [January 22, 2024, 3:15pm UTC](https://forum.opensearch.org/t/not-able-to-disable-global-tenant-in-opensearch/17443/8 "2024-01-22T15:15:17Z")

</div>

Could you share a screenshot from the OpenSearch Dashboard that shows the Global tenant available for switching?

---

<div class="post-metadata">

**Author:** ![peaky](https://avatars.discourse-cdn.com/v4/letter/p/b4bc9f/32.png) [@peaky](https://forum.opensearch.org/u/peaky)\
**Post date:** [January 22, 2024, 3:40pm UTC](https://forum.opensearch.org/t/not-able-to-disable-global-tenant-in-opensearch/17443/9 "2024-01-22T15:40:51Z")

</div>

Is the above same opensearch dashboard configuration that you applied for reproducing the issue?  
Can you share the opensearch dashboard configuration

---

<div class="post-metadata">

**Author:** ![peaky](https://avatars.discourse-cdn.com/v4/letter/p/b4bc9f/32.png) [@peaky](https://forum.opensearch.org/u/peaky)\
**Post date:** [January 22, 2024, 3:44pm UTC](https://forum.opensearch.org/t/not-able-to-disable-global-tenant-in-opensearch/17443/10 "2024-01-22T15:44:42Z")

</div>

![Screenshot from 2024-01-22 21-11-34-1](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/3/366c80c8550097419eacf967e9d9705e6aad04f5.png)

---

<div class="post-metadata">

**Author:** ![Eugene7](https://avatars.discourse-cdn.com/v4/letter/e/bbce88/32.png) [@Eugene7](https://forum.opensearch.org/u/Eugene7)\
**Post date:** [January 22, 2024, 4:10pm UTC](https://forum.opensearch.org/t/not-able-to-disable-global-tenant-in-opensearch/17443/11 "2024-01-22T16:10:16Z")

</div>

How did you deploy the cluster? Did you restart OpenSearch Dashboards after editing opensearch\_dashboards.yml ?

---

<div class="post-metadata">

**Author:** ![peaky](https://avatars.discourse-cdn.com/v4/letter/p/b4bc9f/32.png) [@peaky](https://forum.opensearch.org/u/peaky)\
**Post date:** [January 22, 2024, 4:34pm UTC](https://forum.opensearch.org/t/not-able-to-disable-global-tenant-in-opensearch/17443/12 "2024-01-22T16:34:25Z")

</div>

Deployed the cluster using docker. I have restarted both the containers(opensearch\_dashboard and opensearch node) after editing the config

---

<div class="post-metadata">

**Author:** ![Eugene7](https://avatars.discourse-cdn.com/v4/letter/e/bbce88/32.png) [@Eugene7](https://forum.opensearch.org/u/Eugene7)\
**Post date:** [January 22, 2024, 9:42pm UTC](https://forum.opensearch.org/t/not-able-to-disable-global-tenant-in-opensearch/17443/13 "2024-01-22T21:42:14Z")

</div>

Could you confirm that `opensearch_security.multitenancy.tenants.enable_global` parameter is set to` false` in the OpenSearch Docker container ?

---

<div class="post-metadata">

**Author:** ![peaky](https://avatars.discourse-cdn.com/v4/letter/p/b4bc9f/32.png) [@peaky](https://forum.opensearch.org/u/peaky)\
**Post date:** [January 23, 2024, 11:21am UTC](https://forum.opensearch.org/t/not-able-to-disable-global-tenant-in-opensearch/17443/14 "2024-01-23T11:21:06Z")

</div>

Thanks for noticing me this. unfortunately i have disabled the tenant in config which currently not used by. anyway i updated the dasboard yml file in container and its worked.

Thanks!!