came back to work after few days ,
sorry, I can’t take a screenshot so I’ll correct the spelling mistakes and try to explain again what the problem is :
so the configuration file looks like this :
readonlyrest:
enable: true
response_if_req_forbidden: Rejected by ROR !!!
audit_collector: true
name " rule for group_a "
vrbosity: error
ldap_auth:
name : “ldap_name”
groups: “GROUP_A”
indices: [“a*”]
actions: [“indices:admin/","indices:data/write/”,“indices:data/read/","cluster:monitor/”,“indices:monitor/*”]
kibana_hide_apps: [“readonlyrest_kbn”,“timelion”]
name " rule for group_b "
vrbosity: error
ldap_auth:
name : “ldap_name”
groups: “GROUP_B”
indices: [“b*”]
actions: [“indices:admin/","indices:data/write/”,“indices:data/read/","cluster:monitor/”,“indices:monitor/*”]
kibana_hide_apps: [“readonlyrest_kbn”,“timelion”]
name “request using kibana enterprise”
verbosity: error
type: allow
ldap_auth:
name : ldap_name
groups: [“GROUP_A”,“GROUP_B”]
indices: [“.kibana*”]
kibana_access: admin
kibana_hide_apps: [“readonlyrest_kbn”,“timelion”]
the question is :
if we logon to kibana with username and password of someone from group_a and go to dev tools , we do GET /_cat/indices and see the indexes of users from GROUP_A.
that’s ok and there are no problems .
if instead of DEV TOOLS we go to DISCOVER then we get an error message on top of the screen -
Discover : [undefined] Rejected by ROR!!!
I guess there is a missing permission which I have to set for this AD group so the users will be able to see data through DISCOVER menu because maybe something is running behind the scenes .
what else do we have to set to work with DISCOVER ?
sorry , but if I click the DISCOVER and look for errors in the cluster_name.log under /var/log/elasticsearch then I still see errors from yesterday . the file is not updated with the current error message or the trace .
is there anywhere else I can look for ?
looks like the readonlyrest-audit has the data.
I’ve just started exploring and I think I found it .
I’m going to run some checks and update later if I succeeded or not .
so, the readonlyrest-audit index showed that the user from group_a wanted to run msearch on indexes of user from group_b.
the problem was that the default index-pattern (when you login to DISCOVER) was something which is forbidden for user_a.
we had to scroll down and choose the correct index-pattern for that user.
after that we didn’t get the error message.