My users are unable to login to Kibana (backed by LDAP) intermittently. Below are the two readonlyrest log entries of the same user - one is allowed and the other is not.
[2022-08-31T12:21:07,607][INFO ][t.b.r.a.ACL ] ALLOWED by { name: '::My-Users::', policy: ALLOW, rules: [kibana_access, kibana_index, ldap_auth, indices, kibana_hide_apps]} req={ID:873720829-97692519#271616, TYP:RRAdminRequest, CGR:N/A, USR:ppuski, BRS:false, KDX:.kibana, ACT:cluster:admin/rradmin/refreshsettings, OA:10.211.5.253, DA:0.0.0.0, IDX:<N/A>, MET:GET, PTH:/_readonlyrest/metadata/current_user, CNT:<N/A>, HDR:{authorization=<OMITTED>, Connection=close, content-length=0, Host=es-endpoint.example.com:9200}, HIS:[::KIBANA-SRV::->[auth_key_sha256->false]], [::RO::->[auth_key_sha256->false]], [::RW::->[auth_key_sha256->false]], [::ADMIN::->[auth_key_sha256->false]], [::SUPER ADMIN::->[auth_key_sha256->false]], [::My-Users::->[ldap_authorization->true, kibana_access->true, indices->true, kibana_hide_apps->true, kibana_index->true]] }
[2022-08-31T12:39:39,434][INFO ][t.b.r.a.ACL ] FORBIDDEN by default req={ ID:1528314351-1037796019#277286, TYP:RRAdminRequest, CGR:N/A, USR:ppuski(?), BRS:false, KDX:null, ACT:cluster:admin/rradmin/refreshsettings, OA:10.211.5.253, DA:0.0.0.0, IDX:<N/A>, MET:GET, PTH:/_readonlyrest/metadata/current_user, CNT:<N/A>, HDR:{authorization=<OMITTED>, Connection=close, content-length=0, Host=es-endpoint.example.com:9200}, HIS:[::KIBANA-SRV::->[auth_key_sha256->false]], [::RO::->[auth_key_sha256->false]], [::RW::->[auth_key_sha256->false]], [::ADMIN::->[auth_key_sha256->false]], [::SUPER ADMIN::->[auth_key_sha256->false]], [::My-Users::->[ldap_authentication->false]], [::My-Admins::->[ldap_authentication->false]], [::user-temp::->[auth_key_sha256->false]], [::custom::->[auth_key_sha256->false]], [::MONITORING::->[hosts->true, actions->false]], [::LinkedErrorsApp::->[hosts->true, actions->false]], [::EMR CLUSTERS::->[hosts->true, actions->false]] }
Here's my readonlyrest.yml file:
readonlyrest:
access_control_rules:
- name: "::KIBANA-SRV::"
auth_key_sha256: 12345
verbosity: info
- name: "::RO::"
auth_key_sha256: 12345
kibana_access: ro
indices: [".kibana", ".kibana-devnull", "ies.*", "plithos.*"]
kibana_hide_apps: ["readonlyrest_kbn", "timelion", "kibana:dev_tools", "kibana:management"]
- name: "::RW::"
auth_key_sha256: 12345
kibana_access: rw
indices: [".kibana", ".kibana-devnull", "ies.*", "plithos.*"]
kibana_hide_apps: ["readonlyrest_kbn", "timelion", "kibana:dev_tools", "kibana:management"]
- name: "::ADMIN::"
auth_key_sha256: 12345
# KIBANA ADMIN ACCESS NEEDED TO EDIT SECURITY SETTINGS IN ROR KIBANA APP!
kibana_access: admin
- name: "::SUPER ADMIN::"
auth_key_sha256: 12345
- name: "::My-Users::"
kibana_access: ro_strict
kibana_index: .kibana
ldap_auth:
name: "ldap1"
groups: ["Prod-Kibana-Users"]
indices: [".kibana", ".kibana-devnull", "ies.*", "plithos.*", "opportunities.*" ]
kibana_hide_apps: ["readonlyrest_kbn", "timelion", "kibana:dev_tools", "kibana:management"]
- name: "::My-Admins::"
kibana_index: .kibana
ldap_auth:
name: "ldap1"
groups: ["Prod-Kibana-Admins", "Dev-Kibana-Admins"]
kibana_hide_apps: ["readonlyrest_kbn"]
- name: "::user-temp::"
auth_key_sha256: 60d68d5a5bd0
kibana_index: .kibana
kibana_hide_apps: ["readonlyrest_kbn"]
- name: "::custom::"
auth_key_sha256: 7ebf9f95299
indices: ["dispositiontime", "opportunities.*"]
- name: "::MONITORING::"
type: allow
actions: ["cluster:monitor/*", "indices:monitor/*"]
hosts: ["10.211.4.0/22"]
- name: "::LinkedErrorsApp::"
type: allow
actions: ["indices:data/read/search"]
hosts: ["10.211.4.0/22"]
- name: "::EMR CLUSTERS::"
type: allow
actions: ["cluster:monitor/main", "indices:*"]
hosts: ["10.211.4.0/22"]
ldaps:
- name: ldap1
host: "ldap01.example.com"
port: 389
ssl_enabled: false
ssl_trust_all_certs: true
bind_dn: "CN=my-aws-kibana,OU=ServiceAccounts,OU=ADM,OU=LFC,dc=example,dc=com"
bind_password: "abcdef"
search_user_base_DN: "DC=example,DC=com"
#search_groups_base_DN: "OU=ApplicationAdmins,OU=Groups,OU=LFC,DC=example,DC=com"
search_groups_base_DN: "DC=example,DC=com"
user_id_attribute: "sAMAccountName"
unique_member_attribute: "member"
#group_search_filter: "(objectClass=groupOfNames)(cn=*)"
#group_name_attribute: "cn"
connection_pool_size: 10
connection_timeout_in_sec: 10
request_timeout_in_sec: 10
cache_ttl_in_sec: 60
I have an ElasticSearch cluster and Kibana hosted on other server. Users visit the Kibana portal and login. The request is forward to the ElasticSearch cluster where the readonlyrest ACL rules are defined.
I'm unable to understand what's wrong here. I'm new to Kibana. Please help