I have a strange behavior,
When setting the new cluster kibana created the index: .kibana-8.7.1_001 and my user can access that (not using LDAP groups), however another user is coming (using LDAP groups) and when he logs he get an empty space selection.
After looking at the audit logs, it seems that this user is trying to create the index .kibana_8.7.1 and then try to access it (first action is Denied, and the one after return a non existent index).