# Opensearch Security - Read only Role **URL:** \ **Category:** Security\ **Created:** [September 15, 2021, 11:56am UTC](https://forum.opensearch.org/t/opensearch-security-read-only-role/7019 "2021-09-15T11:56:24Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![guhan](https://avatars.discourse-cdn.com/v4/letter/g/f9ae1b/32.png) [@guhan](https://forum.opensearch.org/u/guhan)\ **Post date:** [September 15, 2021, 11:56am UTC](https://forum.opensearch.org/t/opensearch-security-read-only-role/7019/1 "2021-09-15T11:56:24Z")
Hello, I am trying to setup Opensearch to study feasibility of implementing read only access to couple of dashboards. I followed the steps as given here but I get “Application Not found” error. > **[Users and roles](https://opensearch.org/docs/latest/security-plugin/access-control/users-roles/)** > > Users and roles Even some of the forum topics discuss that but the file they refer in github does not exist. Here is the snippet of what i tried. 1. logged with admin/admin 2. created a sample dashboard with Ecommerce Revenue dashboard 3. created read only role “osreader” with below parameters/mapping **cluster-permissions** : all read permissions(indices:read, get, search\* etc\*) including cluster\_composite\_ops\_ro **index permissions** : opensearch\* (which is the default index for the ecommerce dashboard and available in index patterns page) 4. No Tenant selected 5 .mapped role to “osviewer” user for which i have selected osreader as backend role. and added osviewer user to other read only roles(kibana\_user, kibana\_read\_only, readall) 5. I login with “osviewer” user 6. login successful, gets only dashboard in the menu 7. when I click dashboard, I get “Application Not Found” error. 8. when I view the roles and Identities for the user from the UI, it lists below **Roles(5)** osreader own\_index kibana\_user kibana\_read\_only readall **Backend roles(1)** osreader Still i get Application Not found error, what is the process to get this corrected? what all other permissions/roles am I missing here? Is it possible for readonly user to view a dashboard created by admin? Even if it displays, is there a option to **NOT** to have “Edit” button for the dashboard? Using the latest Opensearch version Thanks Guhan ---
**Author:** ![searchymcsearchface](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/searchymcsearchface/32/868_2.png) [@searchymcsearchface](https://forum.opensearch.org/u/searchymcsearchface)\ **Post date:** [September 15, 2021, 1:26pm UTC](https://forum.opensearch.org/t/opensearch-security-read-only-role/7019/2 "2021-09-15T13:26:04Z")
Moving this to the security category. ---
**Author:** ![Anthony](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/anthony/32/9939_2.png) [@Anthony](https://forum.opensearch.org/u/Anthony)\ **Post date:** [September 15, 2021, 2:44pm UTC](https://forum.opensearch.org/t/opensearch-security-read-only-role/7019/3 "2021-09-15T14:44:05Z")
@guhan Do you have multitenancy enabled? If so, in order to achieve what you are looking for, you would need to make sure that: 1. dashboards are saved by admin in global tenant 2. osreader role includes tenant read permission for global tenant. 3. unmap the kibana\_user from osviewer. osreader role is now enough. The edit button will still appear (this is a limitation), but the user will not be able to save any changes. N.B. If you see “Application Not Found” error, please post the url bar here. ---
**Author:** ![guhan](https://avatars.discourse-cdn.com/v4/letter/g/f9ae1b/32.png) [@guhan](https://forum.opensearch.org/u/guhan)\ **Post date:** [September 16, 2021, 5:36am UTC](https://forum.opensearch.org/t/opensearch-security-read-only-role/7019/4 "2021-09-16T05:36:26Z")
@Anthony , My responses below 1. Have not enabled multi tenancy after installation. I can see the current tenant selected is global in Security → Tenants. When i clicke View Dashboard in global tenant I can see the sample dashboard I can see another tenant admin\_tenant listed but not sure if it is created by default 2. Is there a tenant read permission that I have to enable\> 3. ok sure I get below in the URL when hitting dashboard using osviewer login banner message = To visualize and explore data, you must create index pattern to retrieve data osviewer is listed as private user when I click “roles and Identities”, should be be global user? if yes, how? UPDATE: Interestingly, when I share the dashboard as snapshot / permalink , they can login with osviewer credential and view the dashboard and playaround. They were not able to save the changes if they do EDIT, which is fine. but when they log out and log back in with osviewer and click dashboard → they get Application not found error again. ---
**Author:** ![Anthony](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/anthony/32/9939_2.png) [@Anthony](https://forum.opensearch.org/u/Anthony)\ **Post date:** [September 16, 2021, 8:36am UTC](https://forum.opensearch.org/t/opensearch-security-read-only-role/7019/5 "2021-09-16T08:36:07Z")
@guhan if you see multiple tenants it would indicate you have multitenancy enabled, can you share your config.yml and kibana.yml, can you also confirm which odfe/opensearch version you are using. ---
**Author:** ![guhan](https://avatars.discourse-cdn.com/v4/letter/g/f9ae1b/32.png) [@guhan](https://forum.opensearch.org/u/guhan)\ **Post date:** [September 16, 2021, 8:51am UTC](https://forum.opensearch.org/t/opensearch-security-read-only-role/7019/6 "2021-09-16T08:51:14Z")
Hi Antony, Will check and let you know. Is there a command that I can run to check the version? I pulled it from our org repository. ---
**Author:** ![Anthony](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/anthony/32/9939_2.png) [@Anthony](https://forum.opensearch.org/u/Anthony)\ **Post date:** [September 16, 2021, 9:10am UTC](https://forum.opensearch.org/t/opensearch-security-read-only-role/7019/7 "2021-09-16T09:10:22Z")
@guhan you can “cat plugin-descriptor.properties” in /usr/share/elasticsearch/plugins/opendistro\_security, assuming you are running opendistro. ---
**Author:** ![guhan](https://avatars.discourse-cdn.com/v4/letter/g/f9ae1b/32.png) [@guhan](https://forum.opensearch.org/u/guhan)\ **Post date:** [September 20, 2021, 7:24am UTC](https://forum.opensearch.org/t/opensearch-security-read-only-role/7019/8 "2021-09-20T07:24:51Z")
@Anthony , Sorry for the late reply as I got into some issues. I could not find /usr/share/opensearch or /usr/share/elasticsearch, but I see in the opensearch log with this path, is the folder hidden? ---
**Author:** ![Anthony](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/anthony/32/9939_2.png) [@Anthony](https://forum.opensearch.org/u/Anthony)\ **Post date:** [September 20, 2021, 8:07am UTC](https://forum.opensearch.org/t/opensearch-security-read-only-role/7019/9 "2021-09-20T08:07:42Z")
@guhan How are you running openSearch, is it via docker-compose, Kubernetes or an tar.gz? If you are using docker/k8s the path should be as mentioned above, however if you are running tar.gz, then naturally the path will be based on your current working directory. ---
**Author:** ![guhan](https://avatars.discourse-cdn.com/v4/letter/g/f9ae1b/32.png) [@guhan](https://forum.opensearch.org/u/guhan)\ **Post date:** [September 20, 2021, 8:30am UTC](https://forum.opensearch.org/t/opensearch-security-read-only-role/7019/10 "2021-09-20T08:30:48Z")
@Anthony , I followed the same steps as given in the Opensearch installation page, and ran it via docker-compose up command when I ran this command, I copy pasteed the log and there I can see this path for open search node, eg: [opensearch-node2] JVM home [/usr/share/opensearch/jdk], ---
**Author:** ![Anthony](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/anthony/32/9939_2.png) [@Anthony](https://forum.opensearch.org/u/Anthony)\ **Post date:** [September 20, 2021, 8:33am UTC](https://forum.opensearch.org/t/opensearch-security-read-only-role/7019/11 "2021-09-20T08:33:14Z")
@guhan You will need to connect to the container and view the file in the path I supplied. ```auto docker exec -it opensearch-node2 bash cat /usr/share/elasticsearch/plugins/opendistro_security/plugin-descriptor.properties ``` ---
**Author:** ![guhan](https://avatars.discourse-cdn.com/v4/letter/g/f9ae1b/32.png) [@guhan](https://forum.opensearch.org/u/guhan)\ **Post date:** [September 20, 2021, 9:50am UTC](https://forum.opensearch.org/t/opensearch-security-read-only-role/7019/12 "2021-09-20T09:50:54Z")
@Anthony , Ah thanks, I am newbie to all these stuff, thanks for the command ---
**Author:** ![guhan](https://avatars.discourse-cdn.com/v4/letter/g/f9ae1b/32.png) [@guhan](https://forum.opensearch.org/u/guhan)\ **Post date:** [September 20, 2021, 9:58am UTC](https://forum.opensearch.org/t/opensearch-security-read-only-role/7019/13 "2021-09-20T09:58:53Z")
> [@Anthony](#): > > ```auto > docker exec -it opensearch-node2 bash > cat /usr/share/elasticsearch/plugins/opendistro_security/plugin-descriptor.properties > > ``` @Anthony , I ran the command but I get file or directory not found, when I run ls I get below folders/files inside the docker config jdk logs plugins bin data lib modules ---
**Author:** ![Anthony](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/anthony/32/9939_2.png) [@Anthony](https://forum.opensearch.org/u/Anthony)\ **Post date:** [September 20, 2021, 10:03am UTC](https://forum.opensearch.org/t/opensearch-security-read-only-role/7019/14 "2021-09-20T10:03:35Z")
Sorry the path for opensearch is: /usr/share/opensearch/plugins/opensearch-security/plugin-descriptor.properties ---
**Author:** ![guhan](https://avatars.discourse-cdn.com/v4/letter/g/f9ae1b/32.png) [@guhan](https://forum.opensearch.org/u/guhan)\ **Post date:** [September 20, 2021, 10:08am UTC](https://forum.opensearch.org/t/opensearch-security-read-only-role/7019/15 "2021-09-20T10:08:46Z")
> [@Anthony](#): > > opensearch-security But I dont see the /usr path at all, here is the snapshot of ls inside docker ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/optimized/2X/7/7c39ac612a825dad4957e4b8563faa36e168d677_2_690x32.png) ---
**Author:** ![guhan](https://avatars.discourse-cdn.com/v4/letter/g/f9ae1b/32.png) [@guhan](https://forum.opensearch.org/u/guhan)\ **Post date:** [September 20, 2021, 10:11am UTC](https://forum.opensearch.org/t/opensearch-security-read-only-role/7019/16 "2021-09-20T10:11:18Z")
> [@Anthony](#): > > plugin-descriptor.properties ok I got the info inside plugins folder ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/b/b4e33631c9890107a0e309b8ba04ffdbe0a4758c.png) ---
**Author:** ![guhan](https://avatars.discourse-cdn.com/v4/letter/g/f9ae1b/32.png) [@guhan](https://forum.opensearch.org/u/guhan)\ **Post date:** [September 20, 2021, 10:19am UTC](https://forum.opensearch.org/t/opensearch-security-read-only-role/7019/17 "2021-09-20T10:19:20Z")
@Anthony , I was also going through setting up ldap/ad auth from page and it says we have to modify config.yml file for authx and authz. Even if we modify it, will saving inside docker reflect the change? If we run docker-compose up command again, will it be reverted back to original state? ---
**Author:** ![Anthony](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/anthony/32/9939_2.png) [@Anthony](https://forum.opensearch.org/u/Anthony)\ **Post date:** [September 20, 2021, 10:24am UTC](https://forum.opensearch.org/t/opensearch-security-read-only-role/7019/18 "2021-09-20T10:24:08Z")
@guhan The files need to be modified and mapped via volumes in docker-compose.yml, see example below: ```auto ulimits: memlock: soft: -1 hard: -1 nofile: soft: 65536 hard: 65536 volumes: - opensearch-data2:/usr/share/opensearch/data - ./node1-key.pem:/usr/share/opensearch/config/node-key.pem - ./node1.pem:/usr/share/opensearch/config/node.pem - ./admin-key.pem:/usr/share/opensearch/config/admin-key.pem - ./admin.pem:/usr/share/opensearch/config/admin.pem - ./root-ca.pem:/usr/share/opensearch/config/root-ca.pem - ./internal_users.yml:/usr/share/opensearch/plugins/opensearch-security/securityconfig/internal_users.yml - ./roles_mapping.yml:/usr/share/opensearch/plugins/opensearch-security/securityconfig/roles_mapping.yml - ./tenants.yml:/usr/share/opensearch/plugins/opensearch-security/securityconfig/tenants.yml - ./roles.yml:/usr/share/opensearch/plugins/opensearch-security/securityconfig/roles.yml - ./config.yml:/usr/share/opensearch/plugins/opensearch-security/securityconfig/config.yml - ./opensearch.yml:/usr/share/opensearch/config/opensearch.yml ``` PM me for further details and examples of complete files. ---
**Author:** ![guhan](https://avatars.discourse-cdn.com/v4/letter/g/f9ae1b/32.png) [@guhan](https://forum.opensearch.org/u/guhan)\ **Post date:** [September 20, 2021, 10:28am UTC](https://forum.opensearch.org/t/opensearch-security-read-only-role/7019/19 "2021-09-20T10:28:27Z")
Sure, thanks, Is the version info correct? What is the id to send PM? is all the files mentioned here are required to be mounted? ---
**Author:** ![Anthony](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/anthony/32/9939_2.png) [@Anthony](https://forum.opensearch.org/u/Anthony)\ **Post date:** [September 20, 2021, 2:47pm UTC](https://forum.opensearch.org/t/opensearch-security-read-only-role/7019/20 "2021-09-20T14:47:18Z")
I sent you another PM