Problem with creating roles in open-distro for elasticsearch

Question

I have 2 roles that are assigned to one user. In the first role, I include field name for documents which have _id 1 and 2

{
  "index_permissions": [
    {
      "index_patterns": [
        "test"
      ],
      "dls": "{\n    \"terms\": {\n      \"_id\": [ \"1\", \"2\"] \n    }\n}\n\n",
      "fls": [
        "name"
      ],
      "masked_fields": [],
      "allowed_actions": [
        "get",
        "crud"
      ]
    }
  ],
  "tenant_permissions": [],
  "cluster_permissions": [
    "*"
  ]
}

and in the second role, I include field job_description for document which have _id 3

{
  "index_permissions": [
    {
      "index_patterns": [
        "test"
      ],
      "dls": "{\n    \"terms\": {\n      \"_id\": [\"3\"] \n    }\n}\n",
      "fls": [
        "job_description"
      ],
      "masked_fields": [],
      "allowed_actions": []
    }
  ],
  "tenant_permissions": [],
  "cluster_permissions": []
}

when I try to get data from the index it shows me job_description and name in all documents,

{
  "took" : 237,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 3,
      "relation" : "eq"
    },
    "max_score" : 2.0,
    "hits" : [
      {
        "_index" : "test",
        "_type" : "_doc",
        "_id" : "1",
        "_score" : 2.0,
        "_source" : {
          "name" : "John",
          "job_description" : "Systems administrator and Linux specialist"
        }
      },
      {
        "_index" : "test",
        "_type" : "_doc",
        "_id" : "2",
        "_score" : 2.0,
        "_source" : {
          "name" : "John",
          "job_description" : "Systems administrator and Linux specialist"
        }
      },
      {
        "_index" : "test",
        "_type" : "_doc",
        "_id" : "3",
        "_score" : 2.0,
        "_source" : {
          "name" : "John",
          "job_description" : "Systems administrator and Linux specialist"
        }
      }
    ]
  }
}

but I want to see the only name in two firs records and only job_description in 3 document like that

{
  "took" : 237,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 3,
      "relation" : "eq"
    },
    "max_score" : 2.0,
    "hits" : [
      {
        "_index" : "test",
        "_type" : "_doc",
        "_id" : "1",
        "_score" : 2.0,
        "_source" : {
          "name" : "John",
        }
      },
      {
        "_index" : "test",
        "_type" : "_doc",
        "_id" : "2",
        "_score" : 2.0,
        "_source" : {
          "name" : "John",
        }
      },
      {
        "_index" : "test",
        "_type" : "_doc",
        "_id" : "3",
        "_score" : 2.0,
        "_source" : {
          "job_description" : "Systems administrator and Linux specialist"
        }
      }
    ]
  }
}

does anyone know how to do it?

Answer 1

DLS and FLS do not work in conjunction like that.

DLS is used to only return back a subset of search response based on the DLS query, whereas FLS is used to only include or exclude certain fields from the search response returned from elasticsearch.

All the DLS queries are combined (OR condition) and similarly all FLS input is combined (AND condition) for a user that contains multiple such configurations.

In your case, you have two DLS and two FLS query. The two DLS queries will work as OR conditions, in your case it will return back documents matching 1,2 or 3 doc_id. Similarly, both name and job_description will be returned back.