ElasticSearch no permissions for [indices:data/read/msearch] despite having the permission

Question

I'm running into the weirdest permission issue for _msearch.

When running simple _search with the same query, everything runs perfectly.

POST /job/_search

{"query":{"bool":{"must":[{"bool":{"must":{"bool":{"should":[{"multi_match":{"query":"s","fields":["title"],"type":"best_fields","operator":"or","fuzziness":2}},{"multi_match":{"query":"s","fields":["title"],"type":"phrase","operator":"or"}},{"multi_match":{"query":"s","fields":["title"],"type":"phrase_prefix","operator":"or"}}],"minimum_should_match":"1"}}}}]}},"size":10,"_source":{"includes":["*"],"excludes":[]}}

When running it with _msearch I get the permission error

POST /job/_msearch

{}
{"query":{"bool":{"must":[{"bool":{"must":{"bool":{"should":[{"multi_match":{"query":"s","fields":["title"],"type":"best_fields","operator":"or","fuzziness":2}},{"multi_match":{"query":"s","fields":["title"],"type":"phrase","operator":"or"}},{"multi_match":{"query":"s","fields":["title"],"type":"phrase_prefix","operator":"or"}}],"minimum_should_match":"1"}}}}]}},"size":10,"_source":{"includes":["*"],"excludes":[]}}

{
    "error": {
        "root_cause": [
            {
                "type": "security_exception",
                "reason": "no permissions for [indices:data/read/msearch] and User [name=public_api, backend_roles=[], requestedTenant=null]"
            }
        ],
        "type": "security_exception",
        "reason": "no permissions for [indices:data/read/msearch] and User [name=public_api, backend_roles=[], requestedTenant=null]"
    },
    "status": 403
}

Here are my permissions in Kibana:

I am running an OpenDistro in AWS ElasticSearch Service.

please [refer](https://stackoverflow.com/a/68943777/3303074) — Prasanth Rajendran, Mar 24 '22 at 08:30

score 13 · Answer 1 · answered Aug 26 '21 at 18:35

I have solved the above permission problem using the following steps

Login to Kibana using admin or user with higher previledges

Click security option
Click roles option and then select the desired role for your user based on your requirement. In my case, the user requires all access so selected all_access role
Click Mapped users then click Manage mapping option.
In the Users section type/paste the IAM-arn/internal-user and then press enter
Finally, click the map

That's all, the user will be mapped to the role and corresponding permissions, thereafter you will not face the permission issue mentioned in the question

score 4 · Accepted Answer · answered Mar 24 '21 at 05:22

4

Fixed by setting the following cluster permissions:

answered Mar 24 '21 at 05:22

Bolein95

2,947
2
26
31

score 2 · Answer 3 · answered Mar 14 '22 at 06:21

2

I solved this by not using fine-grained access control.

answered Mar 14 '22 at 06:21

Wesley Cheek

1,058
12
22

ElasticSearch no permissions for [indices:data/read/msearch] despite having the permission

3 Answers3

Linked