ES 7.4.2 - RoR 1.18.9 entreprise - upgraded from 6.8.4 - issue with ro user


after migration, i meet the behavior of users as ro role cannot do a search in discover in kibana

my user match this rule

    - name: elkg aaa bbb(R)
      kibana_access: ro
      ldap_authentication: "aaaldap"
       name: "aaaldap"
       groups: ["L_elkg_bbb_R"]
      kibana_index: ".kibana_bbb"
      indices: [".kibana_bbb*", "log_lu_ec*","xlm_*",".reporting.kibana_bbb*",".kibana_xlm*"]
      kibana_hide_apps: ["readonlyrest_kbn", "kibana:dev_tools", "kibana:management"]
      verbosity: info      

I get access to discover interface , from the good tenant, but I cannot do a search.
it is not clickable at all.

once i switch from

      kibana_access: ro


      kibana_access: rw

i can search.
it acts a ro_strict Oo

any idea ?

of course no strange thing in logs, every is allowed , no forbiddden .

I made some gif to explain better the behavior :

this one is as a kibana_access: ro

and this one as a kibana_access: rw

is it intended in the new version of RoR ?

maybe it is related to the introduction of KQL?

anyone made some kibana_access: ro and meet the same behavior ??

Oh now I understand the issue. The gifs are a great idea! Good job :slight_smile:

I tested it in 7.5.0 and it’s working fine, with 7.4.2 is not. Will need to review our CSS that ROR uses to hide save/delete/edit controls from RO sessions.

Yep. Else i Can go to kibana 7.5.
But is kibana 7.5 compatible with elasticsearch 7.4.2?
Need to check that

By the way, since you are upgrading now, why did you target 7.4.2 instead of 7.5.0? We will fix this anyways even in 7.4.2.

well, it is because i already finished to upgrade last week wednesday, when these +"**"%ç guys of elasticsearch team released the 7.5.0 …

it cost so much to me to negociate with my management to upgrade …

then i will have to stick with 7.4.2 for 1-3 months

do you an eta for the fix of the css ?

will have a look tomorrow.

Hi and happy new year!

i push up this subject , as the 1.18.10 is out :slight_smile:does the fix is integrated into ?



yes it should be there! Happy new year Fred! :partying_face: