# Role applied when login with openId doesn't give permission to specified index

**URL:** <https://forum.opensearch.org/t/role-applied-when-login-with-openid-doesnt-give-permission-to-specified-index/15183>\
**Category:** Security\
**Tags:** troubleshoot\
**Created:** [July 20, 2023, 7:41pm UTC](https://forum.opensearch.org/t/role-applied-when-login-with-openid-doesnt-give-permission-to-specified-index/15183 "2023-07-20T19:41:59Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![tcronin](https://avatars.discourse-cdn.com/v4/letter/t/e9bcb4/32.png) [@tcronin](https://forum.opensearch.org/u/tcronin)\
**Post date:** [July 20, 2023, 7:41pm UTC](https://forum.opensearch.org/t/role-applied-when-login-with-openid-doesnt-give-permission-to-specified-index/15183/1 "2023-07-20T19:41:59Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser):

Opensearch/Dashboards 2.7.0  
Deploy on K8s version 1.24.2

**Describe the issue** :  
I have created a role that gets mapped to a backend\_role through keycloak, the roles should give read and write privileges to specific index.  
However, the role is not working right when I put specific index patterns the user gets a blank page in the discovery pages. It doesn’t show any other error not even in the logs.  
If I give the user access to all the index but using the while `*`, everything works the discovery page works fine.

**Configuration** :  
This configurations does not work:

```auto
{
  "test-role": {
    "reserved": false,
    "hidden": false,
    "cluster_permissions": [
      "cluster_composite_ops",
      "indices_monitor",
      "cluster_manage_index_templates"
    ],
    "index_permissions": [{
      "index_patterns": [
        "logs*"
      ],
      "dls": "",
      "fls": [],
      "masked_fields": [],
      "allowed_actions": [
        "read",
        "indices_monitor",
        "create_index",
        "index",
         "manage",
         "write",
         "search"
      ]
    }],
    "tenant_permissions": [{
      "tenant_patterns": [
        "global_tenant"
      ],
      "allowed_actions": [
        "kibana_all_read"
      ]
    }],
    "static": false
  }
}

```

Working configuration

```auto
{
  "test-role": {
    "reserved": false,
    "hidden": false,
    "cluster_permissions": [
      "cluster_composite_ops",
      "indices_monitor",
      "cluster_manage_index_templates"
    ],
    "index_permissions": [{
      "index_patterns": [
        "*"
      ],
      "dls": "",
      "fls": [],
      "masked_fields": [],
      "allowed_actions": [
        "read",
        "indices_monitor",
        "create_index",
        "index",
         "manage",
         "write",
         "search"
      ]
    }],
    "tenant_permissions": [{
      "tenant_patterns": [
        "global_tenant"
      ],
      "allowed_actions": [
        "kibana_all_read"
      ]
    }],
    "static": false
  }
}

```

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [July 21, 2023, 4:47pm UTC](https://forum.opensearch.org/t/role-applied-when-login-with-openid-doesnt-give-permission-to-specified-index/15183/2 "2023-07-21T16:47:09Z")

</div>

@tcronin The blank screen in the Discovery is caused by the lack of permissions to .kibana indices.

All OpenSearch Dashboards’ objects (i.e. searches, visualisations, dashboards, OSD config etc. ) are kept in the .kibana index. If you enabled tenancy then you’ll notice that the .kibana index is created per user.

The `*` pattern includes all .(dot) indices including .kibana

Please have a look at the kibana\_user role.

 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/4/428cbc34643b5e2fada44f6f1f8da1c68d512628.png)

---

<div class="post-metadata">

**Author:** ![tcronin](https://avatars.discourse-cdn.com/v4/letter/t/e9bcb4/32.png) [@tcronin](https://forum.opensearch.org/u/tcronin)\
**Post date:** [July 27, 2023, 7:31pm UTC](https://forum.opensearch.org/t/role-applied-when-login-with-openid-doesnt-give-permission-to-specified-index/15183/3 "2023-07-27T19:31:24Z")

</div>

Thank you very much. This solved my problem.