# Separation of user roles **URL:** \ **Category:** Security\ **Created:** [September 4, 2024, 1:59pm UTC](https://forum.opensearch.org/t/separation-of-user-roles/21131 "2024-09-04T13:59:11Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![Pan-Vad](https://avatars.discourse-cdn.com/v4/letter/p/6de8d8/32.png) [@Pan-Vad](https://forum.opensearch.org/u/Pan-Vad)\ **Post date:** [September 4, 2024, 1:59pm UTC](https://forum.opensearch.org/t/separation-of-user-roles/21131/1 "2024-09-04T13:59:11Z")
**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser): OpenSearch 2.11.1 **Describe the issue** : Please help me set up access. There is a group of users who need to restrict access to display indexes. I created a role, in it I set up “Index Permissions” so that the user group would have access only to a certain index pattern. But the problem is that this user group is part of another group that has more extensive rights. And accordingly, OpenSearch applies the role with more rights. Is it possible to somehow differentiate rights? Set up role priority? **Configuration** : **Relevant Logs or Screenshots** : ---
**Author:** ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)\ **Post date:** [September 4, 2024, 2:48pm UTC](https://forum.opensearch.org/t/separation-of-user-roles/21131/2 "2024-09-04T14:48:26Z")
Hi @Pan-Vad, What about duplicating the original role, restricting the permissions and assigning the group of users with the limited permissions to that role instead of using two roles for the same group? best, mj ---
**Author:** ![Pan-Vad](https://avatars.discourse-cdn.com/v4/letter/p/6de8d8/32.png) [@Pan-Vad](https://forum.opensearch.org/u/Pan-Vad)\ **Post date:** [September 5, 2024, 6:11am UTC](https://forum.opensearch.org/t/separation-of-user-roles/21131/3 "2024-09-05T06:11:04Z")
Perhaps I misunderstand how the role distribution process works. Let me describe my problem in more detail. In AD there is a group GISAP, which is part of the ORIS group. The ORIS group has the role “readall\_AD”, role settings: ```auto reserved: false cluster_permissions: - "cluster_composite_ops_ro" - "cluster:admin/tenants/list" - "cluster:admin/tenants/get" - "cluster:admin/tenants/select" - "cluster:admin/opensearch/ql/datasources/read" index_permissions: - index_patterns: - '*' allowed_actions: - 'read' tenant_permissions: - tenant_patterns: - '*' allowed_actions: - "kibana_all_read" ``` This role grants read rights for all indexes. I created another role “syslog\_only”, here are its parameters: ```auto cluster_permissions: - "cluster_composite_ops_ro" index_permissions: - index_patterns: - "syslog-*" allowed_actions: - "indices:admin/get" - "indices:data/read/*" fls: - "*" ``` I configured mapping of this role for the GISAP group, but it did not help, users of this group still see other indexes. How to configure this role so that all users of the ORIS group, except the GISAP group, can read from all indexes, and users of the GISAP group can read only the “syslog” index? ---
**Author:** ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)\ **Post date:** [September 5, 2024, 11:46am UTC](https://forum.opensearch.org/t/separation-of-user-roles/21131/4 "2024-09-05T11:46:09Z")
@Pan-Vad, I see, you are using nested groups. Have you checked the parameter `resolve_nested_roles` What if you set `resolve_nested_roles: false` ? see more here: [Active Directory and LDAP - OpenSearch Documentation](https://opensearch.org/docs/latest/security/authentication-backends/ldap/#approach-1-query-the-role-subtree) best, mj ---
**Author:** ![Pan-Vad](https://avatars.discourse-cdn.com/v4/letter/p/6de8d8/32.png) [@Pan-Vad](https://forum.opensearch.org/u/Pan-Vad)\ **Post date:** [September 5, 2024, 1:16pm UTC](https://forum.opensearch.org/t/separation-of-user-roles/21131/5 "2024-09-05T13:16:36Z")
I changed the attribute “resolve\_nested\_roles: false”, but unfortunately nothing changed ---
**Author:** ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)\ **Post date:** [September 6, 2024, 12:08pm UTC](https://forum.opensearch.org/t/separation-of-user-roles/21131/6 "2024-09-06T12:08:49Z")
@Pan-Vad, can you run the below for each type of user and share the output: `curl --insecure -u : -XGET https://:9200/_plugins/_security/authinfo?pretty` Thanks, mj ---
**Author:** ![Pan-Vad](https://avatars.discourse-cdn.com/v4/letter/p/6de8d8/32.png) [@Pan-Vad](https://forum.opensearch.org/u/Pan-Vad)\ **Post date:** [September 9, 2024, 5:44am UTC](https://forum.opensearch.org/t/separation-of-user-roles/21131/7 "2024-09-09T05:44:19Z")
Here are the results of running the command for two users. This user has access to all indexes: ```auto { "user" : "User [name=yukhnovskiyadm, backend_roles=[GISAP Admins, LinuxAdmin, VMware Admins], requestedTenant=null]", "user_name" : "yukhnovskiyadm", "user_requested_tenant" : null, "remote_address" : "192.168.20.41:37799", "backend_roles" : [ "GISAP Admins", "LinuxAdmin", "VMware Admins" ], "custom_attribute_names" : [ "attr.ldap.primaryGroupID", "attr.ldap.msTSExpireDate", "attr.ldap.lastLogon", "attr.ldap.logonCount", "attr.ldap.badPwdCount", "attr.ldap.objectGUID", "attr.ldap.userAccountControl", "attr.ldap.msTSLicenseVersion3", "attr.ldap.msTSLicenseVersion2", "attr.ldap.whenCreated", "ldap.original.username", "attr.ldap.lastLogoff", "attr.ldap.countryCode", "attr.ldap.instanceType", "attr.ldap.sAMAccountName", "attr.ldap.msTSManagingLS", "attr.ldap.userPrincipalName", "attr.ldap.whenChanged", "attr.ldap.objectClass", "attr.ldap.givenName", "ldap.dn", "attr.ldap.sAMAccountType", "attr.ldap.cn", "attr.ldap.accountExpires", "attr.ldap.dSCorePropagationData", "attr.ldap.lockoutTime", "attr.ldap.name", "attr.ldap.uSNCreated", "attr.ldap.uSNChanged", "attr.ldap.displayName", "attr.ldap.objectSid", "attr.ldap.codePage", "attr.ldap.pwdLastSet", "attr.ldap.adminCount", "attr.ldap.msTSLicenseVersion", "attr.ldap.lastLogonTimestamp" ], "roles" : [ "own_index", "all_access", "admin_AD" ], "tenants" : { "global_tenant" : true, "admin_tenant" : true, "yukhnovskiyadm" : true }, "principal" : null, "peer_certificates" : "0", "sso_logout_url" : null } ``` This user is a member of a group for which I created the syslog\_only role. ```auto { "user" : "User [name=Юхновский Вадим Владимирович, backend_roles=[PRTG BEL1 Read, PRTG MSK4 Read, PRTG MSK1 Read, Пользователи PRTG, ОРИС, RDG Users, August, Пользователи Passwork, PRTG MSK2 Write, WiFi Global, ДИТ, ProxyRB, PRTG MSK3 Read, InternetUsers, WiFi Work, Lansweeper View, Сотрудники Service Desk, ГИSAP, PRTG VRN1 Read, Центральный офис, Пользователи MaxPatrol VM, VPN_Users], requestedTenant=null]", "user_name" : "Юхновский Вадим Владимирович", "user_requested_tenant" : null, "remote_address" : "192.168.20.41:42169", "backend_roles" : [ "PRTG BEL1 Read", "PRTG MSK4 Read", "PRTG MSK1 Read", "Пользователи PRTG", "ОРИС", "RDG Users", "August", "Пользователи Passwork", "PRTG MSK2 Write", "WiFi Global", "ДИТ", "ProxyRB", "PRTG MSK3 Read", "InternetUsers", "WiFi Work", "Lansweeper View", "Сотрудники Service Desk", "ГИSAP", "PRTG VRN1 Read", "Центральный офис", "Пользователи MaxPatrol VM", "VPN_Users" ], "custom_attribute_names" : [ "attr.ldap.msRTCSIP-PrimaryUserAddress", "attr.ldap.msTSExpireDate", "attr.ldap.logonCount", "attr.ldap.lastLogon", "attr.ldap.badPwdCount", "attr.ldap.msExchUserCulture", "attr.ldap.userAccountControl", "attr.ldap.whenCreated", "ldap.original.username", "attr.ldap.msExchDumpsterQuota", "attr.ldap.physicalDeliveryOfficeName", "attr.ldap.lastLogoff", "attr.ldap.msRTCSIP-FederationEnabled", "attr.ldap.sAMAccountName", "attr.ldap.homeDrive", "attr.ldap.msExchTextMessagingState", "attr.ldap.userPrincipalName", "attr.ldap.whenChanged", "attr.ldap.msExchMailboxAuditEnable", "attr.ldap.msRTCSIP-InternetAccessEnabled", "attr.ldap.description", "attr.ldap.msExchAuditAdmin", "attr.ldap.lockoutTime", "attr.ldap.msExchMailboxAuditLastAdminAccess", "attr.ldap.displayName", "attr.ldap.objectSid", "attr.ldap.codePage", "attr.ldap.msRTCSIP-Line", "attr.ldap.msExchAuditDelegate", "attr.ldap.extensionAttribute1", "attr.ldap.mail", "attr.ldap.msExchUMDtmfMap", "attr.ldap.lastLogonTimestamp", "attr.ldap.primaryGroupID", "attr.ldap.msExchArchiveQuota", "attr.ldap.msExchMailboxGuid", "attr.ldap.proxyAddresses", "attr.ldap.objectGUID", "attr.ldap.msTSLicenseVersion3", "attr.ldap.msTSLicenseVersion2", "attr.ldap.msRTCSIP-UserPolicies", "attr.ldap.company", "attr.ldap.countryCode", "attr.ldap.department", "attr.ldap.instanceType", "attr.ldap.msRTCSIP-UserEnabled", "attr.ldap.telephoneNumber", "attr.ldap.msTSManagingLS", "attr.ldap.objectClass", "attr.ldap.msExchVersion", "attr.ldap.givenName", "attr.ldap.msRTCSIP-DeploymentLocator", "attr.ldap.msRTCSIP-OptionFlags", "ldap.dn", "attr.ldap.sAMAccountType", "attr.ldap.cn", "attr.ldap.accountExpires", "attr.ldap.msExchMobileMailboxFlags", "attr.ldap.msExchAuditDelegateAdmin", "attr.ldap.title", "attr.ldap.dSCorePropagationData", "attr.ldap.initials", "attr.ldap.name", "attr.ldap.uSNCreated", "attr.ldap.uSNChanged", "attr.ldap.msExchCalendarLoggingQuota", "attr.ldap.msExchRecipientTypeDetails", "attr.ldap.pwdLastSet", "attr.ldap.msExchUserAccountControl", "attr.ldap.msRTCSIP-UserRoutingGroupId", "attr.ldap.msExchRecipientDisplayType", "attr.ldap.sn", "attr.ldap.msExchWhenMailboxCreated", "attr.ldap.mDBUseDefaults", "attr.ldap.msExchArchiveWarnQuota", "attr.ldap.mailNickname", "attr.ldap.msExchELCMailboxFlags", "attr.ldap.msExchDumpsterWarningQuota", "attr.ldap.msTSLicenseVersion" ], "roles" : [ "syslog_only", "own_index" ], "tenants" : { "global_tenant" : false, "admin_tenant" : false, "Юхновский Вадим Владимирович" : true }, "principal" : null, "peer_certificates" : "0", "sso_logout_url" : null } ``` ---
**Author:** ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)\ **Post date:** [September 9, 2024, 11:01am UTC](https://forum.opensearch.org/t/separation-of-user-roles/21131/8 "2024-09-09T11:01:18Z")
Can you also share the output of the `curl -XGET "http://localhost:9200/_plugins/_security/api/rolesmapping"` thanks, mj ---
**Author:** ![Pan-Vad](https://avatars.discourse-cdn.com/v4/letter/p/6de8d8/32.png) [@Pan-Vad](https://forum.opensearch.org/u/Pan-Vad)\ **Post date:** [September 9, 2024, 12:47pm UTC](https://forum.opensearch.org/t/separation-of-user-roles/21131/9 "2024-09-09T12:47:40Z")
Of course I can: ```auto % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 1268 100 1268 0 0 91984 0 --:--:-- --:--:-- --:--:-- 97538 { "manage_snapshots": { "hosts": [], "users": [], "reserved": false, "hidden": false, "backend_roles": [ "snapshotrestore" ], "and_backend_roles": [] }, "logstash": { "hosts": [], "users": [], "reserved": false, "hidden": false, "backend_roles": [ "logstash" ], "and_backend_roles": [] }, "own_index": { "hosts": [], "users": [ "*" ], "reserved": false, "hidden": false, "backend_roles": [], "and_backend_roles": [], "description": "Allow full access to an index named like the username" }, "kibana_user": { "hosts": [], "users": [], "reserved": false, "hidden": false, "backend_roles": [ "kibanauser" ], "and_backend_roles": [], "description": "Maps kibanauser to kibana_user" }, "readall_AD": { "hosts": [], "users": [], "reserved": false, "hidden": false, "backend_roles": [ "ГИSAP" ], "and_backend_roles": [] }, "all_access": { "hosts": [], "users": [], "reserved": true, "hidden": false, "backend_roles": [ "admin", "GISAP Admins" ], "and_backend_roles": [], "description": "Maps admin to all_access" }, "readall": { "hosts": [], "users": [], "reserved": false, "hidden": false, "backend_roles": [ "readall" ], "and_backend_roles": [] }, "kibana_server": { "hosts": [], "users": [ "kibanaserver" ], "reserved": true, "hidden": false, "backend_roles": [], "and_backend_roles": [] }, "admin_AD": { "hosts": [], "users": [], "reserved": false, "hidden": false, "backend_roles": [ "GISAP Admins" ], "and_backend_roles": [] } } ``` I will add: I tried to delete the role that I created for the original ORIS group, instead I left the syslog\_only role, which is applied to the GISAP group: ```auto syslog_only: cluster_permissions: - "cluster_all" index_permissions: - index_patterns: - "syslog-*" allowed_actions: - "indices_all" tenant_permissions: - tenant_patterns: - "*" allowed_actions: - "kibana_all_read" ``` When I authorized under a user account from the GISAP group, to check the result, I entered the “Discover” menu, the display window did not return any results to me. ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/a/a48ed11f4eff04fc0695763fe285057840a08de4.png) ---
**Author:** ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)\ **Post date:** [September 13, 2024, 1:18pm UTC](https://forum.opensearch.org/t/separation-of-user-roles/21131/10 "2024-09-13T13:18:22Z")
> [@Pan-Vad](#): > > ```auto > "roles" : [ > "syslog_only", > "own_index" > ], > > ``` If I haven’t missed anything (Ill have a closer look) permisions and assumed roles looks all good. Can you run a search in **Dev Tools** on `syslog-*` index? something like: ```auto GET /syslog-*_search ``` Do you get an expected result if not, what does the log say? can you share the: ```auto curl -XGET "http://localhost:9200/_plugins/_security/api/roles/" ``` best, mj ---
**Author:** ![Pan-Vad](https://avatars.discourse-cdn.com/v4/letter/p/6de8d8/32.png) [@Pan-Vad](https://forum.opensearch.org/u/Pan-Vad)\ **Post date:** [September 16, 2024, 1:54pm UTC](https://forum.opensearch.org/t/separation-of-user-roles/21131/11 "2024-09-16T13:54:13Z")
I have redone the configuration, applied roles for each subgroup. Thanks for the help! ---
**Author:** ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)\ **Post date:** [September 16, 2024, 1:56pm UTC](https://forum.opensearch.org/t/separation-of-user-roles/21131/12 "2024-09-16T13:56:59Z")
@Pan-Vad, glad it helped!