# Security\_exception","reason":"no permissions for \[cluster:monitor/main\]

**URL:** <https://forum.opensearch.org/t/security-exception-reason-no-permissions-for-cluster-monitor-main/22406>\
**Category:** Security\
**Created:** [November 13, 2024, 12:11pm UTC](https://forum.opensearch.org/t/security-exception-reason-no-permissions-for-cluster-monitor-main/22406 "2024-11-13T12:11:33Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![bukola](https://avatars.discourse-cdn.com/v4/letter/b/a698b9/32.png) [@bukola](https://forum.opensearch.org/u/bukola)\
**Post date:** [November 13, 2024, 12:11pm UTC](https://forum.opensearch.org/t/security-exception-reason-no-permissions-for-cluster-monitor-main/22406/1 "2024-11-13T12:11:33Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser):  
opensearch-2.14.0

**Describe the issue** :  
I am trying to create a user for fluent to connect with open search.

I get this error:

```auto
> > 2024-11-13 11:42:12 +0000 [warn]: #0 [out_opens_logs-os-kratos] Could not communicate to OpenSearch, resetting connection and trying again. [403] {"error":{"root_cause":[{"type":"security_exception","reason":"no permissions for [cluster:monitor/main] and User [name=fluentd_internal, backend_roles=[kibana_user, fluentd], requestedTenant=null]"}],"type":"security_exception","reason":"no permissions for [cluster:monitor/main] and User [name=fluentd_internal, backend_roles=[kibana_user, fluentd], requestedTenant=null]"},"status":403}
> > 2024-11-13 11:42:12 +0000 [warn]: #0 [out_opens_logs-os-kratos] Remaining retry: 8. Retry to communicate after 128 second(s).

```

**Configuration** :  
app vars: # static users for Opensearch internal\_users.yml

```auto
opens_static_users:
  admin:
    _password: "{{opens_password[buildenv]}}"
    reserved: true
    backend_roles: ["admin"]
    attributes: { description: "admin user" }

  logstash_internal:
    _password: "{{ logstash_password[buildenv] }}"
    reserved: false
    backend_roles: ["logstash"] 
    attributes:
      description: "logstash internal user for writing logs"

  fluentd_internal:
    _password: "{{ fluentd_password[buildenv] }}"
    reserved: false
    backend_roles: ["fluentd", "kibana_user"]
    attributes:
      description: "Fluentd internal user for writing logs"

```

roles.yml: `

# Task to create custom users with passwords and assign them roles

- name: Create or update custom users with passwords and roles  
uri:  
url: “[https://localhost:9200/\_plugins/\_security/api/internalusers/](https://localhost:9200/_plugins/_security/api/internalusers/){{ item.username }}”  
user: “admin”  
password: “{{ opens\_password[buildenv] }}”  
force\_basic\_auth: yes  
method: PUT  
validate\_certs: no  
body\_format: json  
body: |  
{  
“password”: “{{ item.password }}”,  
“roles”: {{ item.roles | to\_json }}  
}  
headers:  
Content-Type: “application/json”  
with\_items:
  - { username: “logstash\_internal”, password: “{{ logstash\_password[buildenv] }}”, roles: [“logstash”] }
  - { username: “fluentd\_internal”, password: “{{ fluentd\_password[buildenv] }}”, roles: [“fluentd”] }  
register: user\_creation\_response  
debug:  
msg: “Response for creating user {{ item.username }}: {{ user\_creation\_response }}”

# Task to create custom roles for Fluentd

- name: Create custom roles for Fluentd and Logstash  
uri:  
url: “[https://localhost:9200/\_plugins/\_security/api/roles/](https://localhost:9200/_plugins/_security/api/roles/){{ item.name }}”  
user: “admin”  
password: “{{ opens\_password[buildenv] }}”  
force\_basic\_auth: yes  
method: PUT  
validate\_certs: no  
body\_format: json  
body: “{{ item.definition | to\_json }}”  
headers:  
Content-Type: “application/json”  
with\_items:

- debug:  
msg: “Response for creating role {{ item.name }}: {{ role\_creation\_response }}”

# Task to map fluentd\_internal user to fluentd role

- name: Update role mapping for fluentd  
uri:  
url: “[https://localhost:9200/\_plugins/\_security/api/rolesmapping/fluentd](https://localhost:9200/_plugins/_security/api/rolesmapping/fluentd)”  
user: “admin”  
password: “{{ opens\_password[buildenv] }}”  
force\_basic\_auth: yes  
method: PUT  
validate\_certs: no  
body\_format: json  
body: |  
{  
“reserved”: false,  
“hidden”: false,  
“backend\_roles”: [“fluentd”],  
“hosts”: ,  
“users”: [“fluentd\_internal”],  
“roles”: [“kibana\_user”],  
“and\_backend\_roles”: ,  
“\_meta”: {  
“type”: “rolesmapping”,  
“config\_version”: 2  
}  
}  
headers:  
Content-Type: “application/json”  
register: complex\_role\_mapping\_response

- debug:  
msg: “Response for complex-role mapping: {{ complex\_role\_mapping\_response }}”  
`

**Relevant Logs or Screenshots** :

---

<div class="post-metadata">

**Author:** ![DmitriiKuvshinov](https://avatars.discourse-cdn.com/v4/letter/d/c2a13f/32.png) [@DmitriiKuvshinov](https://forum.opensearch.org/u/DmitriiKuvshinov)\
**Post date:** [November 14, 2024, 7:25am UTC](https://forum.opensearch.org/t/security-exception-reason-no-permissions-for-cluster-monitor-main/22406/2 "2024-11-14T07:25:42Z")

</div>

U have a same issue

> [@Filebeat permissions](https://forum.opensearch.org/t/filebeat-permissions/22402):
>
> Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): 2.13.0 Describe the issue: I want to use no admin user for filebeat (7.10) When i try to launch daemon - i have a error talk to server... ERROR 403 Forbidden: {"error":{"root\_cause":[{"type":"security\_exception","reason":"no permissions for [cluster:monitor/main] and User [name=filebeat, backend\_roles=[develop], requestedTenant=null]"}],"type":"security\_exception","reason":"no permissions for [cluster:monitor/main] and User [name…

For temp solution i provide admin backend role for service user

---

<div class="post-metadata">

**Author:** ![bukola](https://avatars.discourse-cdn.com/v4/letter/b/a698b9/32.png) [@bukola](https://forum.opensearch.org/u/bukola)\
**Post date:** [November 14, 2024, 9:03am UTC](https://forum.opensearch.org/t/security-exception-reason-no-permissions-for-cluster-monitor-main/22406/3 "2024-11-14T09:03:21Z")

</div>

Thank you so much, I mapped the roles logstash and kibana to my fluentd user. It worked but hopefully there are no further problems with ingestion

---

<div class="post-metadata">

**Author:** ![bukola](https://avatars.discourse-cdn.com/v4/letter/b/a698b9/32.png) [@bukola](https://forum.opensearch.org/u/bukola)\
**Post date:** [November 20, 2024, 1:07pm UTC](https://forum.opensearch.org/t/security-exception-reason-no-permissions-for-cluster-monitor-main/22406/4 "2024-11-20T13:07:47Z")

</div>

I was unable to write, still error 403. This is really sad. does this mean you cannot assign specific roles to connect fluentd to opensearch

---

<div class="post-metadata">

**Author:** ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)\
**Post date:** [November 21, 2024, 1:33pm UTC](https://forum.opensearch.org/t/security-exception-reason-no-permissions-for-cluster-monitor-main/22406/5 "2024-11-21T13:33:23Z")

</div>

Hi @bukola,

Could you share the output of the following:

`curl --insecure -u <admin_username>:<admin_password> -XGET https://<OS_node>:9200/_plugins/_security/api/rolesmapping?pretty`

thanks,  
mj

---

<div class="post-metadata">

**Author:** ![bukola](https://avatars.discourse-cdn.com/v4/letter/b/a698b9/32.png) [@bukola](https://forum.opensearch.org/u/bukola)\
**Post date:** [November 25, 2024, 1:15pm UTC](https://forum.opensearch.org/t/security-exception-reason-no-permissions-for-cluster-monitor-main/22406/6 "2024-11-25T13:15:20Z")

</div>

Thank you MJ, the output thus:

```auto
{
  "manage_snapshots" : {
    "hosts" : [],
    "users" : [],
    "reserved" : false,
    "hidden" : false,
    "backend_roles" : [
      "snapshotrestore"
    ],
    "and_backend_roles" : []
  },
  "logstash" : {
    "hosts" : [],
    "users" : [],
    "reserved" : false,
    "hidden" : false,
    "backend_roles" : [
      "logstash"
    ],
    "and_backend_roles" : []
  },
  "own_index" : {
    "hosts" : [],
    "users" : [
      "*"
    ],
    "reserved" : false,
    "hidden" : false,
    "backend_roles" : [],
    "and_backend_roles" : [],
    "description" : "Allow full access to an index named like the username"
  },
  "kibana_user" : {
    "hosts" : [],
    "users" : [],
    "reserved" : false,
    "hidden" : false,
    "backend_roles" : [
      "kibanauser"
    ],
    "and_backend_roles" : [],
    "description" : "Maps kibanauser to kibana_user"
  },
  "all_access" : {
    "hosts" : [],
    "users" : [],
    "reserved" : false,
    "hidden" : false,
    "backend_roles" : [
      "admin"
    ],
    "and_backend_roles" : [],
    "description" : "Maps admin to all_access"
  },
  "readall" : {
    "hosts" : [],
    "users" : [],
    "reserved" : false,
    "hidden" : false,
    "backend_roles" : [
      "readall"
    ],
    "and_backend_roles" : []
  },
  "kibana_server" : {
    "hosts" : [],
    "users" : [
      "kibanaserver"
    ],
    "reserved" : true,
    "hidden" : false,
    "backend_roles" : [],
    "and_backend_roles" : []
  }
}

```

---

<div class="post-metadata">

**Author:** ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)\
**Post date:** [November 25, 2024, 3:57pm UTC](https://forum.opensearch.org/t/security-exception-reason-no-permissions-for-cluster-monitor-main/22406/7 "2024-11-25T15:57:06Z")

</div>

> [@bukola](#):
>
> `backend_roles=[kibana_user, fluentd]`

Hi @bukola,

It does not look like the fluent roles are being mapped to any of the backend roles above.

Would you mind sharing your roles as well by running:

`curl --insecure -u <admin_username>:<admin_password> -XGET https://<OS_node>:9200/_plugins/_security/api/roles/`

thanks,  
mj