Hello,
I tested v 1.49.1. I changed the ROR configuration with the following:
readonlyrest:
prompt_for_basic_auth: false
access_control_rules:
- name: "Client Admin Group Kibana"
groups: ["client_admin"]
indices: ["kibana_client_admin", "*"]
kibana_index: "kibana_client_admin"
kibana_access: "rw"
- name: "Client Admin Group"
groups: ["client_admin"]
indices: ["*"]
actions: ["*"]
- name: "rwgroup Kibana"
groups: ["rwgroup"]
indices: ["kibana_rwgroup", "diana*", "elast*"]
kibana_access: "rw"
kibana_index: "kibana_rwgroup"
- name: "rwgroup 0"
groups: ["rwgroup"]
indices: ["diana*", "elast*"]
actions: ["indices:data/read/*", "indices:data/write/*", "indices:admin/*"]
proxy_auth_configs:
- name: "px1"
user_id_header: "x-forwarded-user"
users:
- username: "diana"
groups: ["client_admin","rwgroup"]
proxy_auth:
proxy_auth_config: "px1"
users: ["diana"]
In the rwgroup tenant, i create a data stream from Kibana dev tools console:
PUT _data_stream/diana2
i get the following answer:
{
"acknowledged": true
}
but when i go in Kibana to Data Streams tab, i am not able to see any data stream. If i go to index management, i can see the backing index of the data stream i just created. If i switch to the client_admin tenant, i am able to see this data stream(which is normal as i have access to all indices). This was not happening in the previous ROR version.
Also, in the logs i do not see any forbidden errors, but i was able to catch the part below, not sure if relevant:
[2023-07-05T09:57:24,435][INFO ][tech.beshu.ror.accesscontrol.logging.AccessControlLoggingDecorator] [localhost]INDEX NOT FOUND req={ ID:1609501493-976119418#37230, TYP:GetIndexTemplatesRequest, CGR:<N/A>, USR:_ (attempted), BRS:false, KDX:null, ACT:indices:admin/template/get, OA:x.x.x.x/32, XFF:127.0.0.1, DA:x.x.x.x/32, IDX:<N/A>, MET:GET, PTH:/_template, CNT:<N/A>, HDR:Accept-Charset=utf-8, Authorization=<OMITTED>, Host=localhost:9200, connection=close, content-length=0, content-type=application/json, cookie=mellon-cookie=xxx, elastic-apm-traceparent=00-7120e5512b31060456d20254022b2a2b-12faf7553325f76c-00, traceparent=00-7120e5512b31060456d20254022b2a2b-12faf7553325f76c-00, tracestate=es=s:0, x-forwarded-for=127.0.0.1, x-forwarded-host=localhost:5601, x-forwarded-port=60860, x-forwarded-proto=http, x-forwarded-user=diana, x-ror-correlation-id=32f79091-7b7a-4f4d-8eb5-4e67be1d48e9, x-ror-current-group=rwgroup, x-ror-kibana-request-method=get, x-ror-kibana-request-path=/s/default/api/console/autocomplete_entities, HIS:[Full Admin Kibana-> RULES:[groups_or->false] RESOLVED:[group=rwgroup;template=GET(*)]], [Full Admin Users-> RULES:[groups_or->false] RESOLVED:[group=rwgroup;template=GET(*)]], [Client Admin Group Kibana-> RULES:[groups_or->false] RESOLVED:[group=rwgroup;template=GET(*)]], [Client Admin Group 0-> RULES:[groups_or->false] RESOLVED:[group=rwgroup;template=GET(*)]], [ffgroup Kibana-> RULES:[groups_or->false] RESOLVED:[group=rwgroup;template=GET(*)]], [ffgroup Kibana 1-> RULES:[groups_or->false] RESOLVED:[group=rwgroup;template=GET(*)]], [rogroup Kibana-> RULES:[groups_or->false] RESOLVED:[group=rwgroup;template=GET(*)]], [rogroup 0-> RULES:[groups_or->false] RESOLVED:[group=rwgroup;template=GET(*)]], [rwgroup Kibana-> RULES:[groups_or->true, kibana_index->true, kibana_access->true, indices->false] RESOLVED:[user=hwzr5420;group=rwgroup;av_groups=rwgroup;kibana_idx=kibana_rwgroup;template=GET(*)]], [rwgroup 0-> RULES:[groups_or->true, actions->true, indices->false] RESOLVED:[user=diana;group=rwgroup;av_groups=rwgroup;template=GET(*)]], }
Could you please help with this also?
Thanks