Update securing-spaces.asciidoc #26652
Conversation
| image::spaces/images/securing-spaces.png["Securing spaces"] | ||
|
|
||
| Note that kibana ships with a built-in role called ```kibana_user``` which grants the **all** privilege as minimum access to all spaces. In order to restrict a user to only a subset of spaces, remember to not give the ```kibana_user``` role but but instead to create a custom scheme where new roles grant both Index Privileges **manage, read, index, delete** to the pattern ```.kibana*``` and the intended access to the correct subset of spaces. |
There was a problem hiding this comment.
We actually don't want to be creating roles with direct index access anymore, and should be recommending using the Kibana Privileges.
There was a problem hiding this comment.
@kobelb The built in kibana roles grant access to all spaces, so it's a circular argument for the person who wants to restrict some spaces for some users. I'm not sure what to suggest.
There was a problem hiding this comment.
Apologies for the confusion, I was attempting to suggest that we reword the following phrasing:
but but instead to create a custom scheme where new roles grant both Index Privileges manage, read, index, delete to the pattern
.kibana*and the intended access to the correct subset of spaces.
but instead create a custom role that grants access to the correct subset of spaces using the role's Kibana privileges.
There was a problem hiding this comment.
This is the section of the role page, which we refer to as the "Kibana privileges":
This comment has been minimized.
This comment has been minimized.
💚 Build Succeeded |
spalger
added
the
Team:Security
|
Pinging @elastic/kibana-security |
💔 Build Failed |
|
I'm going to close this due to inactivity - thanks! |
Summary
Users following the instructions will be surprised to find that kibana_user gives blanket "all" access to spaces. kibana_user is a default role and cannot be modified so a new scheme will have to be created. Hopefully this notice will help people understand why users can still see and modify all roles until something is taken away from a user that was unrelated to spaces in version 6.4 and before.
Checklist
Use
strikethroughsto remove checklist items you don't feel are applicable to this PR.This was checked for cross-browser compatibility, including a check against IE11Documentation was added for features that require explanation or tutorialsUnit or functional tests were updated or added to match the most common scenariosThis was checked for keyboard-only and screenreader accessibilityFor maintainers