Okay, thank you.
But what about this error seen in kibana.log
[ERROR][plugins.dataViews.dataView.hasEsData] ResponseError: forbidden_response
Root causes:
forbidden_response: my_custom_message
when opening Home and accesing data_views(<v. 8.X index_patterns) data?
for “/s/default/app/home#/“ i see in Es Log
[INFO ][t.b.r.a.l.AccessControlListLoggingDecorator] [XXXX] ESC[35mFORBIDDEN by { name: '::Forbid API calls for some specific roles::', policy: FORBID, rules: [ldap_auth, uri_re] req={ ID:XXX#XX, TYP:GetDataStreamAction$Request, CGR:ldap_role, USR:test_user, BRS:true, KDX:null, ACT:indices:admin/data_stream/get, OA:node_ip/32, XFF:node_ip, DA:node_ip/32, IDX:<N/A>, MET:GET, PTH:/_data_stream/logs, CNT:<N/A>, HDR:Host=node_ip:9200, x-opaque-id=unknownId, traceparent=XXX, content-length=0, x-ror-kibana-request-method=get, x-ror-kibana-index=.kibana-X, accept=application/vnd.elasticsearch+json; compatible-with=8,text/plain, x-ror-correlation-id=XXX, x-elastic-product-origin=kibana, tracestate=es=s:0, x-elastic-client-meta=es=8.19.1,js=22.17.1,t=8.9.6,hc=22.17.1, Authorization=<OMITTED>, x-ror-kibana-request-path=/s/default/api/streams/_status, user-agent=Kibana/8.19.7, keep-alive=timeout=10, max=1000, connection=keep-alive, Accept-Charset=utf-8, x-forwarded-for=node_ip, cookie=XX; x-csrf-token-XXX-session_id=XXX; x-csrf-token-XXX, HIS:[Accept all requests from localhost-> RULES:[hosts->false]], [::KIBANA-SRV::-> RULES:[auth_key->false]], [::KIBANA-SYSTEM::-> RULES:[auth_key->false]], [::LOGSTASH-SYSTEM::-> RULES:[auth_key->false]], [::LOGSTASH-USER::-> RULES:[auth_key->false]], [::Forbid API calls for some specific roles::-> RULES:[ldap_auth->true, uri_re->true] RESOLVED:[user=test_user;group=ldap_role;av_groups=ldap_roles]], }ESC[0m
and for ‘/s/default/app/discover#/‘ two logs
[INFO ][t.b.r.a.l.AccessControlListLoggingDecorator] [XXX] ESC[35mFORBIDDEN by default req={ ID:XXX#XXX, TYP:ResolveClusterActionRequest, CGR:<N/A>, USR:test_user (attempted), BRS:true, KDX:null, ACT:indices:admin/resolve/cluster, OA:nodeIP/32, XFF:nodeIP, DA:nodeIP/32, IDX:*,.*,logs-enterprise_search.api-default,logs-enterprise_search.audit-default, MET:GET, PTH:/_resolve/cluster/*,-.*,-logs-enterprise_search.api-default,-logs-enterprise_search.audit-default, CNT:<N/A>, HDR:Host=nodeIP:9200, traceparent=XXX, x-opaque-id=unknownId, content-length=0, user-agent=Kibana/8.19.7, x-ror-kibana-request-method=get, x-ror-kibana-index=.kibana-X, accept=application/vnd.elasticsearch+json; compatible-with=8,text/plain, x-ror-correlation-id=XXX, x-elastic-product-origin=kibana, tracestate=es=s:0, x-elastic-client-meta=es=8.19.1,js=22.17.1,t=8.9.6,hc=22.17.1, Authorization=<OMITTED>, keep-alive=timeout=10, max=1000, connection=keep-alive, Accept-Charset=utf-8, x-forwarded-for=nodeIP, cookie=XXX; X_SESSION=XXX; x-csrf-token-XXX; x-csrf-token-XXX; x-csrf-token-XX-session_id=XX; x-csrf-token-XX; x-csrf-token-XX-session_id=XX; x-csrf-token-XX; 12345-X=Fe26.2**XX; x-csrf-token-XX, x-ror-kibana-request-path=/s/default/internal/data_views/has_es_data, HIS:[Accept all requests from localhost-> RULES:[hosts->false] RESOLVED:[indices=*, .*, logs-enterprise_search.api-default, logs-enterprise_search.audit-default]], [::KIBANA-SRV::-> RULES:[auth_key->false] RESOLVED:[user=test_user;group=XX;av_groups=XXX;indices=*, .*, logs-enterprise_search.api-default, logs-enterprise_search.audit-default]],[::KIBANA-SYSTEM::-> RULES:[auth_key->false] RESOLVED:[indices=*, .*, logs-enterprise_search.api-default, logs-enterprise_search.audit-default]], [::Forbid API calls for some specific roles::-> RULES:[ldap_auth->true, uri_re->false], [::X LDAP::-> RULES:[ldap_auth->true, kibana->true, indices->false] RESOLVED:[user=test_user;group=X;av_groups=X;indices=*, .*, logs-enterprise_search.api-default, logs-enterprise_search.audit-default;kibana_idx=.kibana-X]], }ESC[0m
[INFO ][t.b.r.a.l.AccessControlListLoggingDecorator] [XX] ESC[35mINDEX NOT FOUND req={ ID:XX, TYP:ResolveIndexAction$Request, CGR:<N/A>, USR:test_user (attempted), BRS:true, KDX:null, ACT:indices:admin/resolve/index, OA:nodeIP/32, XFF:nodeIP, DA:nodeIP/32, IDX:*:*, MET:GET, PTH:/_resolve/index/*:*, CNT:<N/A>, HDR:Host=nodeIP:9200, x-ror-kibana-request-path=/s/default/internal/index-pattern-management/resolve_index/*:*, x-opaque-id=unknownId, traceparent=XXX, content-length=0, user-agent=Kibana/8.19.7, x-ror-kibana-request-method=get, x-ror-kibana-index=.kibana-X, accept=application/vnd.elasticsearch+json; compatible-with=8,text/plain, x-ror-correlation-id=XX, x-elastic-product-origin=kibana, tracestate=es=s:0, x-elastic-client-meta=es=8.19.1,js=22.17.1,t=8.9.6,hc=22.17.1, Authorization=<OMITTED>, keep-alive=timeout=10, max=1000, connection=keep-alive, Accept-Charset=utf-8, x-forwarded-for=nodeIP, cookie=12345-XX=XXX; x-csrf-token-XX-session_id=XX; x-csrf-token-XXX, HIS:[Accept all requests from localhost-> RULES:[hosts->false] RESOLVED:[indices=*:*]], [::KIBANA-SRV::-> RULES:[auth_key->false] RESOLVED:[indices=*:*]], [::KIBANA-SYSTEM::-> RULES:[auth_key->false], [::Forbid API calls for some specific roles::-> RULES:[ldap_auth->true, uri_re->false] RESOLVED:[user=test_user;group=X;av_groups=X, XXX;indices=*:*]], [::X LDAP::-> RULES:[ldap_auth->true, kibana->true, indices->false] RESOLVED: user=test_user;group=XX;av_groups=XX;indices=*:*;kibana_idx=.kibana-X]], [::X LDAP::-> RULES:[ldap_auth->true, kibana->true, indices->false] ]], }ESC[0m
What additional permissions should ldap-user have to disable that specific ERROR in kibana log? Currently, the user can see data for permitted indices via ror config without any warnings in kibana GUI(that are generated only as kibana logs)? I cannot find any resolution or example in documentation ;/
