CODEWITHSUNDEEP
elasticsearch
chx
chx

Reputation: 11790

Elasticsearch read only user

I wanted to add a read only user to my cluster, my app prefixes all its indexes with myapp_.

Following https://www.elastic.co/blog/user-impersonation-with-x-pack-integrating-third-party-auth-with-kibana (what a strange title for the only actually usable blog post on this...) I have first added a role with

curl -XPOST '$ELASTIC_URL:9200/_xpack/security/role/name_of_readonly_role' \
-H 'Content-Type: application/json' \
-d'{"indices":[{"names":"myapp_*","privileges":["read"]}]}'

and then added it to a user:

curl -XPOST $ELASTIC_URL:9200/_xpack/security/user/name_of_user \
-H 'Content-Type: application/json' \
-d'{"roles":["name_of_readonly_role"],"password":"some_password"}'

but when opening $ELASTIC_URL:9200 I got

action [cluster:monitor/main] is unauthorized for user

what's next?

Upvotes: 8

Views: 8667

Answers (1)

chx
chx

Reputation: 11790

There's a complete dearth of examples for this as far as I can see, to fix this problem the role command needs to be re-run with -d'{"cluster":["monitor"], "indices":[{"names":"myapp_*","privileges":["read"]}]}' (same curl command works for creating or updating roles). This seems to leak the name of all indexes but not much else aside from their names and I was fine with that. And even that seems to be not enough for some apps like the ElasticSearch Head brower extension, I needed to add the index level monitor privilege as well: -d'{"cluster":["monitor"], "indices":[{"names":"myapp_*","privileges":["read", "monitor"]}]}'. Role changes are automatically applied to users.

I still have no idea what the "/main" relates to in the error message but this works.

Upvotes: 3

Related Questions