Skip to content

[Discover] Forbidden error when read only user uses API created index pattern #62373

@phy1729

Description

@phy1729

Kibana version:
7.6.2
Elasticsearch version:
7.6.2

Describe the bug:
When a read only user uses an index pattern that does not yet have fields populated, a Forbidden error notification is displayed.

Steps to reproduce:

  1. Create an index pattern via Kibana's API for some indices that have documents.
POST /api/saved_objects/index-pattern/test
{
    "attributes": {
        "title": "test-*",
        "timeFieldName": "@timestamp"
    }
}
  1. As a user with read only permissions to Kibana Discover and the relevant indices, open Discover and select the created index pattern.
  2. Observe an error notification.
Error fetching fields for index pattern test-* (ID: test)

Forbidden

Expected behavior:
No error notification.

Any additional context:
I believe the error stems from

return this._fetchFields()
.then(() => this.save())
.catch(err => {

Kibana appears to attempt to update the index pattern saved object's fields attribute if it is out of date (or missing); however, a read only user does not have permission to update the saved object. Since the save method is called under the catch, an error when saving is treated the same as an error in fetching the pattern. I think it would be reasonable in this case to ignore an exception raised when saving.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Feature:Data ViewsData Views code and UI - index patterns before 8.0impact:lowAddressing this issue will have a low level of impact on the quality/strength of our product.loe:smallSmall Level of Efforttriage_needed

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions