I guess the kc realm roles propagate to the backend-roles in opensearch (see testrole as a proof)
Now 2 things are an issue here:
If I add me as a user in roles_mapping.yml in e.g. kibana_user or read_all, I rerun securityAdmin.sh, I can NOT see any indices or menu (left pane).
On the other hand, If I were to remove the whole openid connect AND roles_mapping.yml file and I would assign me these same roles (since these are already roles defined in opensearch-dashboard), or I login with user kibanaro for example, I CAN see indices and menu.
This story is different if I put my username in the all_access role in roles_mapping.yml . then I DO get to see indices and menu
If I remove roles_mapping.yml and I assign me these same roles as above through keycloak (as you can see the mapping works through my mapper) I can NOT see indices nor menu.
Issue1: roles_mapping.yml file does not work properly
Issue2: keycloak mapping does not work.
As an example: adding me in the kibana_user role, not seeing anything anymore:
Hi @pablo ,
Seems that when I apply my kc config I had set multivalued already to ‘true’. I guess there is something wrong in the kc api, because it is not picked up.
Now I set it to true and as expected I still don’t see any data:
Seems also the realm role is the only one that is applied as the backend-role.
The client role is not propagated into opensearch-dashboard at all.
With the above settings I have added myself as a user within the role kibana_user in roles_mapping.yml.
When I remove myself from that list I see the exact same settings as above, and also no data.
@Raki Now, with the “Multivalued” set to true, you have backed role kibanauser assigned to kibana_user role. Before, any authenticated user had the all_access role assigned.
Could you share your opensearch_dashboards.yml file?
Now I can see more yes thank you. Only no indices (data) yet.
Which place is the best to give this kibana_user with backendrole kibanauser access to these indices?
@pablo , basically I need to set these index_permissions for this role/user
and I would like to it other than using the api like:
curl --insecure -XGET -k -u <uname:pw> https://opensearch-cluster-data.monitoring.svc:9200/_plugins/_security/api/roles/kibana_user
{"kibana_user":{"reserved":true,"hidden":false,"description":"Provide the minimum permissions for a kibana user","cluster_permissions":["cluster_composite_ops"],"index_permissions":[{"index_patterns":[".kibana",".kibana-6",".kibana_*",".opensearch_dashboards",".opensearch_dashboards-6",".opensearch_dashboards_*"],"fls":[],"masked_fields":[],"allowed_actions":["read","delete","manage","index"]},{"index_patterns":[".tasks",".management-beats","*:.tasks","*:.management-beats"],"fls":[],"masked_fields":[],"allowed_actions":["indices_all"]}],"tenant_permissions":[],"static":true}}
But logging in as admin I dont see the indices added in there.
Also I had already read that page.
What I am missing is to be able to set the allowed indices field in the roles_mapping.yml with a field like for example:
so I overwrote the kibana_user (I tried updating this user but I got an error) and I remapped the kibanauser backend role to a new role op_dashboard_user. I expect to see my filebeat indices, which are visible see when giving myself admin rights, but I still dont. See images. What did i miss?
@Raki You’re mixing index with OpenSearch Dashboards index pattern.
An index contains the data. Index pattern filters existing indices.
Even if you have access to your index it doesn’t mean you’ll be able to create the index pattern.
You must create index permission indices:admin/resolve/index for all indices * and assign it to your custom user to enable index pattern creation.
