# The built in doesn't have sufficient permission in OpensearchDashboard?

**URL:** <https://forum.opensearch.org/t/the-built-in-doesnt-have-sufficient-permission-in-opensearchdashboard/22889>\
**Category:** OpenSearch Dashboards\
**Tags:** troubleshoot\
**Created:** [December 23, 2024, 7:33am UTC](https://forum.opensearch.org/t/the-built-in-doesnt-have-sufficient-permission-in-opensearchdashboard/22889 "2024-12-23T07:33:34Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![latituder](https://avatars.discourse-cdn.com/v4/letter/l/b19c9b/32.png) [@latituder](https://forum.opensearch.org/u/latituder)\
**Post date:** [December 23, 2024, 7:33am UTC](https://forum.opensearch.org/t/the-built-in-doesnt-have-sufficient-permission-in-opensearchdashboard/22889/1 "2024-12-23T07:33:34Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser):  
2.18.0

**Describe the issue** :  
I enabled the multi-tenant in OS-dashboard, and use the built in “kibanaserver” user in the configuration of opensearch-dashboard.yml to connect to the backend.

I observe some warnings in the os-dashboard log, they seems relate to kibanaserver user permission issue.

{“type”:“log”,“@timestamp”:“2024-12-23T07:29:42Z”,“tags”:[“error”,“plugins”,“securityDashboards”],“pid”:1,“message”:“StatusCodeError: Authorization Exception\n at respond (/usr/share/opensearch-dashboards/node\_modules/elasticsearch/src/lib/transport.js:349:15)\n at checkRespForFailure (/usr/share/opensearch-dashboards/node\_modules/elasticsearch/src/lib/transport.js:306:7)\n at HttpConnector. (/usr/share/opensearch-dashboards/node\_modules/elasticsearch/src/lib/connectors/http.js:173:7)\n at IncomingMessage.wrapper (/usr/share/opensearch-dashboards/node\_modules/lodash/lodash.js:4991:19)\n at IncomingMessage.emit (node:events:529:35)\n at IncomingMessage.emit (node:domain:489:12)\n at endReadableNT (node:internal/streams/readable:1400:12)\n at processTicksAndRejections (node:internal/process/task\_queues:82:21) {\n status: 403,\n displayName: ‘AuthorizationException’,\n path: ‘/\_plugins/\_security/tenantinfo’,\n query: {},\n body: undefined,\n statusCode: 403,\n response: ‘’,\n toString: [Function (anonymous)],\n toJSON: [Function (anonymous)]\n}”}

i don’t know what permission I shall assign to the kibanaserver user to meet the auth requirement.

by the way, the os-dashboard log also shows many “[agentkeepalive:deprecated] options.freeSocketKeepAliveTimeout is deprecated, please use options.freeSocketTimeout instead” warning.  
This is a config issue or it is something need to be update i os-dashboard code?

**Configuration** :

**Relevant Logs or Screenshots** :

---

<div class="post-metadata">

**Author:** ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)\
**Post date:** [December 30, 2024, 3:25pm UTC](https://forum.opensearch.org/t/the-built-in-doesnt-have-sufficient-permission-in-opensearchdashboard/22889/2 "2024-12-30T15:25:50Z")

</div>

Have you checked this: [[BUG] 403 on `/_plugins/_security/tenantinfo` · Issue #3058 · opensearch-project/security · GitHub](https://github.com/opensearch-project/security/issues/3058) (I’m not sure if it’s related, as the bug seems to be fixed)?

best,  
mj

---

<div class="post-metadata">

**Author:** ![cwperks](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/cwperks/32/4968_2.png) [@cwperks](https://forum.opensearch.org/u/cwperks)\
**Post date:** [December 30, 2024, 3:47pm UTC](https://forum.opensearch.org/t/the-built-in-doesnt-have-sufficient-permission-in-opensearchdashboard/22889/3 "2024-12-30T15:47:49Z")

</div>

What is the value of `config.dynamic.kibana.server_username` in opensearch-security’s `config.yml` file? The value for this username should match the username of `opensearch.username` in `opensearch_dashboards.yml`

---

<div class="post-metadata">

**Author:** ![latituder](https://avatars.discourse-cdn.com/v4/letter/l/b19c9b/32.png) [@latituder](https://forum.opensearch.org/u/latituder)\
**Post date:** [January 2, 2025, 3:44am UTC](https://forum.opensearch.org/t/the-built-in-doesnt-have-sufficient-permission-in-opensearchdashboard/22889/4 "2025-01-02T03:44:50Z")

</div>

yes, the user name are match:

```auto
kc exec -it ssdl-app-logging-opensearch-manager-0 -- cat /usr/share/opensearch/config/opensearch-security/config.yml | grep kibana
Defaulted container "opensearch" out of: opensearch, init (init), keystore (init)
    kibana:
      server_username: kibanaserver

```

```auto
$ kc exec -it ssdl-app-logging-opensearch-dashboards-64488cdb76-jgv88 -- cat ./config/opensearch_dashboards.yml | grep -- opensearch.username
opensearch.username: kibanaserver

```