# Using PKI certificate for kibanaserver user: 'Tenant global\_tenant is not allowed for this user' **URL:** \ **Category:** Security\ **Created:** [May 29, 2021, 7:35pm UTC](https://forum.opensearch.org/t/using-pki-certificate-for-kibanaserver-user-tenant-global-tenant-is-not-allowed-for-this-user/6064 "2021-05-29T19:35:55Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![justme](https://avatars.discourse-cdn.com/v4/letter/j/f0a364/32.png) [@justme](https://forum.opensearch.org/u/justme)\ **Post date:** [May 29, 2021, 7:35pm UTC](https://forum.opensearch.org/t/using-pki-certificate-for-kibanaserver-user-tenant-global-tenant-is-not-allowed-for-this-user/6064/1 "2021-05-29T19:35:55Z")
I have been making progress in getting ODFE configured (1.13.2) with respect to security. I have successfully setup LDAP and been able to map a user (testadmin) who is in a specific group (odfe-admins) to be able to get mapped to the “all\_access” built in role. By successful, I mean that I can see the kibana webpage, login, and see the UI as well as use the security admin tool to apply the security settings. My next step is to move the kibana connection to elasticsearch to use PKI. For the moment, I have kibana and elasticsearch (both installed from the ODFE repos on Centos 8) on the same machine. That seems to have gone pretty well after a few not too hard to fix issues. (NOTE: I have replaced my actual domain with [testdomain.com](http://testdomain.com) in the rest, but I am using the ‘real’ domain in my configs). I have changed in kibana.yml: ```auto elasticsearch.username: kibanaserver elasticsearch.password: kibanaserver ``` to ```auto elasticsearch.ssl.certificate: /etc/kibana/ssl/kibana.crt elasticsearch.ssl.key: /etc/kibana/ssl/kibana.key elasticsearch.ssl.certificateAuthorities: ["/etc/kibana/ssl/ca.crt"] ``` The cn of the certificate issues above is [testodfe.testdomain.com](http://testodfe.testdomain.com). In roles\_mapping.yml, I have changed the kibana\_server role to the following: ```auto kibana_server: reserved: true hosts: ['testodfe.testdomain.com'] users: - "kibanaserver" - "testodfe.testdomain.com" ``` When I restart kibana with the above settings applied (and of course, with the securityadmin.sh being applied), I immediately start getting this in the cluster log for ES: ```auto [2021-05-29T15:16:25,938][WARN][c.a.o.s.c.PrivilegesInterceptorImpl] [testodfe.testdomain.com] Tenant global_tenant is not allowed for user testodfe.testdomain.com [2021-05-29T15:16:28,439][WARN][c.a.o.s.c.PrivilegesInterceptorImpl] [testodfe.testdomain.com] Tenant global_tenant is not allowed for user testodfe.testdomain.com [2021-05-29T15:16:30,942][WARN][c.a.o.s.c.PrivilegesInterceptorImpl] [testodfe.testdomain.com] Tenant global_tenant is not allowed for user testodfe.testdomain.com ``` It seems like it is finding the right user, as the log appears to correctly identify the user ‘[testodfe.testdomain.com](http://testodfe.testdomain.com)’. As a test, I tried seeing what error I get if I use simple authentication and specify a bad user (I get: ‘Authentication finally failed for kibanaserver2’ instead). If attempt to do the same in intentionally skewing the config for PKI and intentionally change the roles\_mapping to some other host ([testodfe2.testdomain.com](http://testodfe2.testdomain.com), for example), I get: ```auto No cluster-level perm match for User [name=testodfe2.testdomain.com, backend_roles=[], requestedTenant=null] Resolved [aliases=[*], allIndices=[*], types=[*], originalRequested=[*], remoteIndices=[]] [Action [cluster:monitor/nodes/info]] [RolesChecked []]. No permissions for [cluster:monitor/nodes/info] ``` So, it seems like it is correctly reading in the cn from the cert and matching the role in roles\_mapping. However, I still get the ‘Tenant global\_tenant is not allowed for user’, even though I think it is matching the same exact mapping that the simple authentication kibanaserver user is. For reference, my authc in config.yml looks like this: ```auto clientcert_auth_domain: description: "Authenticate via SSL client certificates" http_enabled: true transport_enabled: true order: 2 http_authenticator: type: clientcert config: username_attribute: cn #optional, if omitted DN becomes username challenge: false authentication_backend: type: noop ``` I am running out of ideas as to what is causing the issue. Does anyone have any suggestions? Thanks! ---
**Author:** ![Anthony](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/anthony/32/9939_2.png) [@Anthony](https://forum.opensearch.org/u/Anthony)\ **Post date:** [June 8, 2021, 3:41pm UTC](https://forum.opensearch.org/t/using-pki-certificate-for-kibanaserver-user-tenant-global-tenant-is-not-allowed-for-this-user/6064/2 "2021-06-08T15:41:57Z")
Hi @justme it seems some usernames are perhaps hardcoded somewhere because I tried your use case and managed to get the same error. The workaround was to create a role and map user [testodfe2.testdomain.com](http://testodfe2.testdomain.com) to it. See below: ```auto test: tenant_permissions: - tenant_patterns: - '*' allowed_actions: - 'kibana_all_write' ``` Hope this helps ---
**Author:** ![justme](https://avatars.discourse-cdn.com/v4/letter/j/f0a364/32.png) [@justme](https://forum.opensearch.org/u/justme)\ **Post date:** [June 8, 2021, 7:54pm UTC](https://forum.opensearch.org/t/using-pki-certificate-for-kibanaserver-user-tenant-global-tenant-is-not-allowed-for-this-user/6064/3 "2021-06-08T19:54:23Z")
Thanks for the help! I tried to see if I could get that to work, but I am still having issues. To see if I could get it to work at all, I first just went overboard and tried to see if I added user ‘[testodfe.testdomain.com](http://testodfe.testdomain.com)’ to all\_access in roles\_mapping.yml if that would work and it appeared to (or at least the error dropped from the log). However, when I added your suggestion to roles.yml (and a matching ‘test’ in roles\_mapping), I still get a repetitive error on restart of kibana: ```auto [2021-06-08T15:52:21,277][INFO][c.a.o.s.p.PrivilegesEvaluator] [testodfe.testdomain.com] No cluster-level perm match for User [name=testodfe.testdomain.com, backend_roles=[], requestedTenant=null] Resolved [aliases=[*], allIndices=[*], types=[*], originalRequested=[*], remoteIndices=[]] [Action [cluster:monitor/nodes/info]] [RolesChecked [test]]. No permissions for [cluster:monitor/nodes/info] ``` Is there a chance that the test role you gave needs extra permissions? Since the kibana\_server role was hard coded, I can’t find the exact permissions it actually was loaded up with originally since it wasn’t in roles.yml. ---
**Author:** ![Anthony](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/anthony/32/9939_2.png) [@Anthony](https://forum.opensearch.org/u/Anthony)\ **Post date:** [June 8, 2021, 8:24pm UTC](https://forum.opensearch.org/t/using-pki-certificate-for-kibanaserver-user-tenant-global-tenant-is-not-allowed-for-this-user/6064/4 "2021-06-08T20:24:50Z")
Did you map [testodfe.testdomain.com](http://testodfe.testdomain.com) to kibana\_server _ **and** _ the test role I sent? The additional permissions should be added on top kibana\_server access. ---
**Author:** ![justme](https://avatars.discourse-cdn.com/v4/letter/j/f0a364/32.png) [@justme](https://forum.opensearch.org/u/justme)\ **Post date:** [June 8, 2021, 8:54pm UTC](https://forum.opensearch.org/t/using-pki-certificate-for-kibanaserver-user-tenant-global-tenant-is-not-allowed-for-this-user/6064/5 "2021-06-08T20:54:01Z")
That did it! Thanks for the help. I had replaced, not augmented, the role\_mapping.