Skip to content

Commit 68bee8b

Browse files
Deprecates the reporting_user role. (#2605)
This marks the `reporting_user` role as deprecated, in favor of custom roles which leverage Kibana feature privileges. Relates: elastic/elasticsearch#132766 --------- Co-authored-by: shainaraskas <[email protected]>
1 parent 1a4d206 commit 68bee8b

File tree

3 files changed

+7
-5
lines changed

3 files changed

+7
-5
lines changed

deploy-manage/kibana-reporting-configuration.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -167,12 +167,12 @@ PUT <kibana host>:<port>/api/security/role/custom_reporting_user
167167

168168
If you are using an external identity provider, such as LDAP or Active Directory, you can assign roles to individual users or groups of users. Role mappings are configured in [`config/role_mapping.yml`](/deploy-manage/users-roles/cluster-or-deployment-auth/mapping-users-groups-to-roles.md).
169169

170-
For example, assign the `kibana_admin` and `reporting_user` roles to the Bill Murray user:
170+
For example, assign the `kibana_admin` and `custom_reporting_user` roles to the Bill Murray user:
171171

172172
```yaml
173173
kibana_admin:
174174
- "cn=Bill Murray,dc=example,dc=com"
175-
reporting_user:
175+
custom_reporting_user:
176176
- "cn=Bill Murray,dc=example,dc=com"
177177
```
178178

deploy-manage/users-roles/cluster-or-deployment-auth/built-in-roles.md

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -115,8 +115,10 @@ $$$built-in-roles-remote-monitoring-agent$$$ `remote_monitoring_agent`
115115
$$$built-in-roles-remote-monitoring-collector$$$ `remote_monitoring_collector`
116116
: Grants the minimum privileges required to collect monitoring data for the {{stack}}.
117117

118-
$$$built-in-roles-reporting-user$$$ `reporting_user`
119-
: Grants the necessary privileges required to use {{reporting}} features in {{kib}}, including generating and downloading reports. This role implicitly grants access to all {{kib}} reporting features, with each user having access only to their own reports. Note that reporting users should also be assigned additional roles that grant read access to the [indices](/deploy-manage/users-roles/cluster-or-deployment-auth/role-structure.md#roles-indices-priv) that will be used to generate reports.
118+
$$$built-in-roles-reporting-user$$$ `reporting_user` {applies_to}`stack: deprecated 9.0`
119+
: This role is deprecated. Use [{{kib}} feature privileges](../../../deploy-manage/users-roles/cluster-or-deployment-auth/kibana-privileges.md#kibana-feature-privileges) instead.
120+
121+
Grants the necessary privileges required to use {{reporting}} features in {{kib}}, including generating and downloading reports. This role implicitly grants access to all {{kib}} reporting features, with each user having access only to their own reports. Note that reporting users should also be assigned additional roles that grant read access to the [indices](/deploy-manage/users-roles/cluster-or-deployment-auth/role-structure.md#roles-indices-priv) that will be used to generate reports.
120122

121123
$$$built-in-roles-rollup-admin$$$ `rollup_admin`
122124
: Grants `manage_rollup` cluster privileges, which enable you to manage and execute all rollup actions.

troubleshoot/elasticsearch/remote-clusters.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -227,7 +227,7 @@ If the anonymous user does not the have necessary privileges to make a connectio
227227

228228
```txt
229229
org.elasticsearch.transport.RemoteTransportException: [remote-node][192.168.0.42:9309][cluster:internal/remote_cluster/handshake]
230-
Caused by: org.elasticsearch.ElasticsearchSecurityException: action [cluster:internal/remote_cluster/handshake] is **unauthorized** for user [anonymous_foo] with effective roles [reporting_user], this action is granted by the cluster privileges [cross_cluster_search,cross_cluster_replication,manage,all]
230+
Caused by: org.elasticsearch.ElasticsearchSecurityException: action [cluster:internal/remote_cluster/handshake] is **unauthorized** for user [anonymous_foo] with effective roles [kibana_admin], this action is granted by the cluster privileges [cross_cluster_search,cross_cluster_replication,manage,all]
231231
```
232232

233233
If the anonymous user has necessary privileges, for example it is a superuser, the local cluster logs `requires channel profile to be [_remote_cluster], but got [default]`:

0 commit comments

Comments
 (0)