# Open Search Role creation with index with wild card is giving security exception **URL:** \ **Category:** Security\ **Created:** [July 5, 2024, 9:12am UTC](https://forum.opensearch.org/t/open-search-role-creation-with-index-with-wild-card-is-giving-security-exception/20150 "2024-07-05T09:12:05Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![jinoinfo](https://avatars.discourse-cdn.com/v4/letter/j/bcef8e/32.png) [@jinoinfo](https://forum.opensearch.org/u/jinoinfo)\ **Post date:** [July 5, 2024, 9:12am UTC](https://forum.opensearch.org/t/open-search-role-creation-with-index-with-wild-card-is-giving-security-exception/20150/1 "2024-07-05T09:12:05Z")
**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser): Open Search 2.15 version When i create a role for a user to access to see the data only for a specific index by specifying the index name like epcis\_index or epcis\_\* it is giving security exception “[security\_exception] no permissions for [indices:monitor/settings/get”. But if i specify index as “\*” it works, but it will list out all the indexes in the system. How to resolve the issue. **Describe the issue** : **Configuration** : **Relevant Logs or Screenshots** : ---
**Author:** ![Eugene7](https://avatars.discourse-cdn.com/v4/letter/e/bbce88/32.png) [@Eugene7](https://forum.opensearch.org/u/Eugene7)\ **Post date:** [July 5, 2024, 9:36am UTC](https://forum.opensearch.org/t/open-search-role-creation-with-index-with-wild-card-is-giving-security-exception/20150/2 "2024-07-05T09:36:12Z")
Hi @jinoinfo , Have you tried adding the `indices:monitor/settings/get` permission to your role? ---
**Author:** ![jinoinfo](https://avatars.discourse-cdn.com/v4/letter/j/bcef8e/32.png) [@jinoinfo](https://forum.opensearch.org/u/jinoinfo)\ **Post date:** [July 5, 2024, 11:51am UTC](https://forum.opensearch.org/t/open-search-role-creation-with-index-with-wild-card-is-giving-security-exception/20150/3 "2024-07-05T11:51:46Z")
Yes i did… Below is my role structure. { “cluster\_permissions”: [ “cluster:monitor/nodes/info”, “cluster:monitor/health”, “cluster:monitor/state”, “cluster:monitor/main”, “cluster:monitor/settings/get”, “cluster:admin/opendistro/ism/managedindex/explain”, “cluster:admin/opensearch/ql/datasources/read”, “cluster:admin/opensearch/observability/get”, “cluster:admin/opendistro/ism/policy/search” ], “index\_permissions”: [ { “index\_patterns”: [“epcis\__“], “allowed\_actions”: [“read”, “ **indices:monitor/settings/get** ”, “indices:monitor/stats”,“monitor”,“indices:admin/data\_stream/get”,“indices:monitor/recovery”,“indices:data/read/get”,“indices:data/read/search”,“indices:data/write/index”,“indices:data/write/bulk[s]”] } ], “tenant\_permissions”: [ { “tenant\_patterns”: [“global\_tenant”], “allowed\_actions”: [“kibana\_all\_write”, “kibana\_all\_read”] } ] } this works fine if i give index pattern as “index\_patterns”: [”_”], ---
**Author:** ![jinoinfo](https://avatars.discourse-cdn.com/v4/letter/j/bcef8e/32.png) [@jinoinfo](https://forum.opensearch.org/u/jinoinfo)\ **Post date:** [July 8, 2024, 4:06am UTC](https://forum.opensearch.org/t/open-search-role-creation-with-index-with-wild-card-is-giving-security-exception/20150/4 "2024-07-08T04:06:33Z")
Any help/ suggestion will be very much appreciated ---
**Author:** ![Eugene7](https://avatars.discourse-cdn.com/v4/letter/e/bbce88/32.png) [@Eugene7](https://forum.opensearch.org/u/Eugene7)\ **Post date:** [July 8, 2024, 1:02pm UTC](https://forum.opensearch.org/t/open-search-role-creation-with-index-with-wild-card-is-giving-security-exception/20150/5 "2024-07-08T13:02:01Z")
Hi @jinoinfo , When did you receive the exception? Did the user use OpenSearch Dashboards? Could you please run the following command and check if the exception occurs afterward? ```auto curl -k -u "username":"password" -XGET https://localhost:9200/epcis_index/_search ``` ---
**Author:** ![jinoinfo](https://avatars.discourse-cdn.com/v4/letter/j/bcef8e/32.png) [@jinoinfo](https://forum.opensearch.org/u/jinoinfo)\ **Post date:** [July 9, 2024, 12:54pm UTC](https://forum.opensearch.org/t/open-search-role-creation-with-index-with-wild-card-is-giving-security-exception/20150/6 "2024-07-09T12:54:25Z")
Hi @Eugene7 : when i modified the index pattern as below, basically by adding “kibana\*” along with my index(epcis\*) i am able to see the index pattern and corresponding dashboard. This was my major concern and got it resolved. “index\_patterns”: [ “epcis\*”, “.kibana\*” ], Second issue is When i am accessing index management → indexes it is not showing this index to me i can see the error in the console as “response: ‘{“error”:{“root\_cause”:[{“type”:“security\_exception”,“reason”:“no permissions for [indices:monitor/settings/get] and User [name=supplier-user-ro, backend\_roles=[epcis\_Index\_ro], requestedTenant=]”}],“type”:“security\_exception”,“reason”:“no permissions for [indices:monitor/settings/get] and User [name=supplier-user-ro, backend\_roles=[epcis\_Index\_ro], requestedTenant=]”},“status”:403}’” ---
**Author:** ![Eugene7](https://avatars.discourse-cdn.com/v4/letter/e/bbce88/32.png) [@Eugene7](https://forum.opensearch.org/u/Eugene7)\ **Post date:** [July 9, 2024, 1:03pm UTC](https://forum.opensearch.org/t/open-search-role-creation-with-index-with-wild-card-is-giving-security-exception/20150/7 "2024-07-09T13:03:26Z")
Hi @jinoinfo , If a user needs to work with OpenSearch Dashboards, It will be better to map the user to the predefined `opensearch_dashboards_user` role: > **[Defining users and roles](https://opensearch.org/docs/2.15/security/access-control/users-roles/#predefined-roles)** > > Defining users and roles ---
**Author:** ![jinoinfo](https://avatars.discourse-cdn.com/v4/letter/j/bcef8e/32.png) [@jinoinfo](https://forum.opensearch.org/u/jinoinfo)\ **Post date:** [July 9, 2024, 1:36pm UTC](https://forum.opensearch.org/t/open-search-role-creation-with-index-with-wild-card-is-giving-security-exception/20150/8 "2024-07-09T13:36:27Z")
@Eugene7 : Yes, that simplified my task which i was doing by adding permissions manually to my custom role. But still with opensearch\_dashboard\_user role also same error is happening. This is not an immediate concern for me… but wanted to see whether that security exception is resolvable, so that user will not see any security exception. I really appreciate your constant help on this topic ---
**Author:** ![Eugene7](https://avatars.discourse-cdn.com/v4/letter/e/bbce88/32.png) [@Eugene7](https://forum.opensearch.org/u/Eugene7)\ **Post date:** [July 9, 2024, 4:55pm UTC](https://forum.opensearch.org/t/open-search-role-creation-with-index-with-wild-card-is-giving-security-exception/20150/9 "2024-07-09T16:55:22Z")
Some of the permissions that were added to your role do not exist. I have attached the screenshots below. ![Screenshot 2024-07-09 at 16.57.31](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/0/039f2e47c230c4787f56fefddb13e8aa2e654655.png) ![Screenshot 2024-07-09 at 16.52.42](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/9/9f6291f0616aafc4a3cd61e932dc5748028d89e6.png) Could you please share the output of the following commands? `curl -k -u : -XGET https://localhost:9200/_plugins/_security/api/rolesmapping/` `curl -k -u : -XGET https://localhost:9200/_plugins/_security/api/internalusers/` Also, please try to map your user with the `kibana_user` role. ---
**Author:** ![jinoinfo](https://avatars.discourse-cdn.com/v4/letter/j/bcef8e/32.png) [@jinoinfo](https://forum.opensearch.org/u/jinoinfo)\ **Post date:** [July 9, 2024, 5:18pm UTC](https://forum.opensearch.org/t/open-search-role-creation-with-index-with-wild-card-is-giving-security-exception/20150/10 "2024-07-09T17:18:53Z")
Response for curl -k -u : -XGET [https://localhost:9200/\_plugins/\_security/api/rolesmapping/](https://localhost:9200/_plugins/_security/api/rolesmapping/) { “epcis\_Index\_ro”: { “hosts”: , “users”: [ “supplier-user-ro” ], “reserved”: false, “hidden”: false, “backend\_roles”: [ “epcis\_Index\_ro” ], “and\_backend\_roles”: } } Response for curl -k -u : -XGET [https://localhost:9200/\_plugins/\_security/api/internalusers/](https://localhost:9200/_plugins/_security/api/internalusers/) { “supplier-user-ro”: { “hash”: “”, “reserved”: false, “hidden”: false, “backend\_roles”: [ “epcis\_index\_ro” ], “attributes”: {}, “opendistro\_security\_roles”: , “static”: false } } ---
**Author:** ![Eugene7](https://avatars.discourse-cdn.com/v4/letter/e/bbce88/32.png) [@Eugene7](https://forum.opensearch.org/u/Eugene7)\ **Post date:** [July 9, 2024, 5:43pm UTC](https://forum.opensearch.org/t/open-search-role-creation-with-index-with-wild-card-is-giving-security-exception/20150/11 "2024-07-09T17:43:36Z")
I have noticed a difference between the backend role in the role mapping and the backend role for the user. Can you please change it so that each symbol is the same in the backend\_roles parameter? ---
**Author:** ![jinoinfo](https://avatars.discourse-cdn.com/v4/letter/j/bcef8e/32.png) [@jinoinfo](https://forum.opensearch.org/u/jinoinfo)\ **Post date:** [July 10, 2024, 4:12am UTC](https://forum.opensearch.org/t/open-search-role-creation-with-index-with-wild-card-is-giving-security-exception/20150/12 "2024-07-10T04:12:54Z")
> [@jinoinfo](#): > > \_plugins/\_security/api/rolesmapping/ are you saying the difference is “backend\_roles”: [ “epcis\_Index\_ro” ], **“and\_backend\_roles”:** } I am not sure why it is coming additionally. ---
**Author:** ![Eugene7](https://avatars.discourse-cdn.com/v4/letter/e/bbce88/32.png) [@Eugene7](https://forum.opensearch.org/u/Eugene7)\ **Post date:** [July 10, 2024, 11:53am UTC](https://forum.opensearch.org/t/open-search-role-creation-with-index-with-wild-card-is-giving-security-exception/20150/13 "2024-07-10T11:53:13Z")
The backend role must be the same for both the role mapping and the user. The current value of the backend role for the user is `epcis_index_ro`. The value of the backend role for the role mapping is `epcis_Index_ro`. There is a difference in the “i” character. Could you please change it so that the backend role is the same for both the role mapping and the user?