Restricting access to indices within `kibana_access` about elasticsearch-readonlyrest-plugin HOT 14 CLOSED

Found my issue : When creating a markdown widget, Kibana tries to query the default index (kibana settings) even if no data is returned !
The workaround we used is to create an empty index, defined as default in kibana that every user can read.

Thanks for your help !

from elasticsearch-readonlyrest-plugin.

Hello @dcoueron, I just released the new build and updated the documentation with the new link.

By the way, please share your experience using this plugin! What's good, what should be better, what new features you'd like to see and so on.

Enjoy!

from elasticsearch-readonlyrest-plugin.

Thanks for the quick release!
What I want to do is to allow readonly access through Kibana to my users but not for all indices.
I did not manage to do that, is it possible ?

I tried this:

    - name: Kibana access + some indices
      type: allow
      kibana_access: ro
      indices: [my_index]
      auth_key: user:passwd

from elasticsearch-readonlyrest-plugin.

Sorry I can't give you a tested solution for this as I'm travelling right now, I'm not even sure what goes wrong, but for now I'd try using the wildcard indices:

- name Kibana access + some indices 
    type: allow
    kibana_access: ro
    indices: [my_index, .kibana*]
    auth_key: user:passwd

[edit: fixed fucked up email quoting that prevented the snippet from showing]

from elasticsearch-readonlyrest-plugin.

any success with this @dcoueron?

from elasticsearch-readonlyrest-plugin.

Sorry, I'm not in office this week :-)
I'll get back to you as soon as I have a chance to try it.

Le mer. 13 avr. 2016 10:41, Simone Scarduzio [email protected] a
écrit :

any success with this @dcoueron https://github.com/dcoueron?

—
You are receiving this because you were mentioned.
Reply to this email directly or view it on GitHub
#45 (comment)

from elasticsearch-readonlyrest-plugin.

Hello @sscarduzio
It seems to work but not when my Kibana Dashboard includes some markdown widgets. It's strange because such widgets don't query any data from kibana

from elasticsearch-readonlyrest-plugin.

@dcoueron BTW, you can get a lot of info from the logs: when the plugin blocks a request, it logs all the request context (including the action field). If you see something that should pass and is blocked send it to me and I can include it in the Kibana passthrough rule.

from elasticsearch-readonlyrest-plugin.

Hi, In which log should I look ? Is there some kind of log level to set somewhere ?

from elasticsearch-readonlyrest-plugin.

Set the whole ES to debug mode, you can grep for "{ action: "

Example:

[2016-04-21 11:28:28,427][DEBUG][plugin.readonlyrest.acl.blocks.rules.impl] KIBANA ACCESS DENIED { action: indices:admin/create OA:/0:0:0:0:0:0:0:1:65503 M: PUT}

from elasticsearch-readonlyrest-plugin.

If you want to see all the request contexts (not only the blocked ones) put ES in trace mode and the grep is the same.

from elasticsearch-readonlyrest-plugin.

@dcoueron wait, the default index = ".kibana" ? as opposed to what index? (supper happy you figured it out btw!)

from elasticsearch-readonlyrest-plugin.

.kibana is the "internal" index used by kibana to store its data. By "default index" I mean the index that will be searched by default when a user opens kibana.

from elasticsearch-readonlyrest-plugin.

@dcoueron are you all right with this? can we close this issue?
BTW: I'd like your opinion on a new feature I was thinking of adding: how about I let the users (optionally) write two javascript call backs: i.e. onRequest and onResponse where people can write custom business logic to accept/reject requests according to action, indices, method, etc. or even modify the request/response body, add/remove headers on the fly?
What do you think? :)

from elasticsearch-readonlyrest-plugin.