Permission for creating OBO Token

Versions (relevant - OpenSearch/Dashboard/Server OS/Browser):
Opensearch 3.0
Server OS - linux
running on k3s cluster
2 nodes (1 Master, 1 warm)
Cluster is green and works fine
Dashboard is healthy too

Describe the issue:
I am trying to set the right permission for creating OBO token by users. not sure what to use from the image below i can see this action security:obo/create but not sure what the permission will look like

Configuration:

Relevant Logs or Screenshots:

@nelson You need to add missing permission security:obo/create to the role’s cluster permissions.

The below role example has the minimal permissions to create OBO token.

pablo:
  reserved: false
  hidden: false
  cluster_permissions:
  - "cluster:admin/opensearch/ql/datasources/read"
  - "indices:admin/template/get"
  - "security:obo/create"
  index_permissions:
  - index_patterns:
    - "*"
    dls: ""
    fls: []
    masked_fields: []
    allowed_actions:
    - "indices:data/read/search"
    - "indices:admin/mappings/get"
    - "indices:admin/aliases/get"
  tenant_permissions: []
  static: false

1 Like