@Anthony
I’ve done that, and I still can’t load or create any index or index pattern in the Private Tenant.
Since I’m unable to directly edit the reserved kibana_user and own_index roles, I duplicated and combined the two into a single kibana_user_enhanced role, and have mapped it to the AD group “central-logging-users”, then added an index permission set for *syslog* indexes.
Still, when I try to browse the indexes as a basic user (Joe Test) in the Private tenant (the only tenant available to this class of user), I get the following security exception for indices:monitor/settings/get even though the permission is part of the permissions for *syslog* index patterns, via the pf_indices_monitor_all action group.
[security_exception] no permissions for [indices:monitor/settings/get] and User [name=Joe Test, backend_roles=[central-logging-users], requestedTenant=__user__]
I’ve included the users auth, the kibana_user_enhanced role, and the actions groups used below the signature. Perhaps you’ll see something that I’ve missed.
In any case, thank you for your help on this. I know time is valuable.
Jaimie Livingston
#####
GET _opendistro/_security/authinfo/ for Joe Test
{
"user" : "User [name=Joe Test, backend_roles=[central-logging-users], requestedTenant=__user__]",
"user_name" : "Joe Test",
"user_requested_tenant" : "__user__",
"remote_address" : "10.xx.xx.xx:57384",
"backend_roles" : [
"central-logging-users"
],
"custom_attribute_names" : [
"attr.ldap.primaryGroupID",
<snip>
"attr.ldap.lastLogonTimestamp"
],
"roles" : [
"kibana_user_enhanced"
],
"tenants" : {
"Joe Test" : true
},
"principal" : null,
"peer_certificates" : "0",
"sso_logout_url" : null
}
#####
GET _opendistro/_security/api/roles/kibana_user_enhanced
{
"kibana_user_enhanced" : {
"reserved" : false,
"hidden" : false,
"cluster_permissions" : [
"cluster_composite_ops",
"cluster_monitor",
"read"
],
"index_permissions" : [
{
"index_patterns" : [
".kibana",
".kibana-6",
".kibana_*"
],
"fls" : [ ],
"masked_fields" : [ ],
"allowed_actions" : [
"read",
"delete",
"manage",
"index"
]
},
{
"index_patterns" : [
".tasks",
".management-beats",
"*:.tasks",
"*:.management-beats"
],
"fls" : [ ],
"masked_fields" : [ ],
"allowed_actions" : [
"indices_all"
]
},
{
"index_patterns" : [
"*syslog*"
],
"dls" : "",
"fls" : [ ],
"masked_fields" : [ ],
"allowed_actions" : [
"pf_indices_monitor_all",
"pf_indices_data_read_all",
"pf_indices_admin_get"
]
},
{
"index_patterns" : [
"${user_name}"
],
"dls" : "",
"fls" : [ ],
"masked_fields" : [ ],
"allowed_actions" : [
"indices_all"
]
}
],
"tenant_permissions" : [ ],
"static" : false
}
}
#####
GET _opendistro/_security/api/actiongroups/pf_indices_data_read_all
{
"pf_indices_data_read_all" : {
"reserved" : false,
"hidden" : false,
"allowed_actions" : [
"indices:data/read/explain",
"indices:data/read/field_caps",
"indices:data/read/field_caps*",
"indices:data/read/get",
"indices:data/read/mget",
"indices:data/read/mget*",
"indices:data/read/msearch",
"indices:data/read/msearch/template",
"indices:data/read/mtv",
"indices:data/read/mtv*",
"indices:data/read/scroll",
"indices:data/read/scroll/clear",
"indices:data/read/search",
"indices:data/read/search*",
"indices:data/read/search/template",
"indices:data/read/tv"
],
"static" : false
}
}
#####
GET _opendistro/_security/api/actiongroups/pf_indices_monitor_all
{
"pf_indices_monitor_all" : {
"reserved" : false,
"hidden" : false,
"allowed_actions" : [
"indices:monitor/recovery",
"indices:monitor/segments",
"indices:monitor/settings/get",
"indices:monitor/shard_stores",
"indices:monitor/stats",
"indices:monitor/upgrade"
],
"static" : false
}
}
#####
GET _opendistro/_security/api/actiongroups/pf_indices_admin_get
{
"pf_indices_admin_get" : {
"reserved" : false,
"hidden" : false,
"allowed_actions" : [
"indices:admin/aliases",
"indices:admin/aliases/exists",
"indices:admin/aliases/get",
"indices:admin/analyze",
"indices:admin/exists",
"indices:admin/get",
"indices:admin/mappings/fields/get",
"indices:admin/mappings/fields/get*",
"indices:admin/mappings/get",
"indices:admin/open",
"indices:admin/shards/search_shards",
"indices:admin/template/get",
"indices:admin/types/exists",
"indices:admin/validate/query"
],
"static" : false
}
}