{"action":"created","issue":{"url":"https://api.github.com/repos/elastic/kibana/issues/4731","repository_url":"https://api.github.com/repos/elastic/kibana","labels_url":"https://api.github.com/repos/elastic/kibana/issues/4731/labels{/name}","comments_url":"https://api.github.com/repos/elastic/kibana/issues/4731/comments","events_url":"https://api.github.com/repos/elastic/kibana/issues/4731/events","html_url":"https://github.com/elastic/kibana/issues/4731","id":102470012,"number":4731,"title":"More consistent error handling for restricted roles","user":{"login":"tbragin","id":933397,"avatar_url":"https://avatars.githubusercontent.com/u/933397?v=3","gravatar_id":"","url":"https://api.github.com/users/tbragin","html_url":"https://github.com/tbragin","followers_url":"https://api.github.com/users/tbragin/followers","following_url":"https://api.github.com/users/tbragin/following{/other_user}","gists_url":"https://api.github.com/users/tbragin/gists{/gist_id}","starred_url":"https://api.github.com/users/tbragin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tbragin/subscriptions","organizations_url":"https://api.github.com/users/tbragin/orgs","repos_url":"https://api.github.com/users/tbragin/repos","events_url":"https://api.github.com/users/tbragin/events{/privacy}","received_events_url":"https://api.github.com/users/tbragin/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/elastic/kibana/labels/bug","name":"bug","color":"ff0000"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-08-21T21:56:24Z","updated_at":"2016-03-18T12:01:45Z","closed_at":null,"body":"In a recent test of Kibana 4.2 with a restricted role that has read-only access to the .kibana index, the handling of access control failure modes was quite varied:\r\n1. Exception that takes up the whole screen\r\n2. Exception that just shows up in the top bar\r\n3. No error, action does not appear to succeed\r\n4. No error, action appears to succeed in the browser, but is not persisted\r\n\r\nSuggestion is to improve handling of access control failure modes to make it more consistent. \r\n\r\nSome details of my test\r\n\r\nShield role\r\n```\r\nkibana4:\r\n  cluster:\r\n#      - cluster:monitor/nodes/info\r\n#      - cluster:monitor/health\r\n  indices:\r\n    '*':\r\n      - indices:admin/mappings/fields/get\r\n      - indices:admin/validate/query\r\n      - indices:data/read/search\r\n      - indices:data/read/msearch\r\n#      - indices:admin/get\r\n    '.kibana':\r\n#      - indices:admin/exists\r\n#      - indices:admin/mapping/put\r\n      - indices:admin/mappings/fields/get\r\n#      - indices:admin/refresh\r\n      - indices:admin/validate/query\r\n      - indices:data/read/get\r\n      - indices:data/read/mget\r\n      - indices:data/read/search\r\n#      - indices:data/write/delete\r\n#      - indices:data/write/index\r\n#      - indices:data/write/update\r\n#      - indices:admin/create\r\n```\r\n\r\nDetailed errors\r\n```\r\n- Create index pattern - No error, action does not appear to succeed\r\n- Delete index pattern - [security_exception] action [indices:data/write/delete] is unauthorized for user [kibana4]\r\n- Set default index pattern - No error, action appears to succeed in the browser, but is not persisted\r\n- Refresh mappings - No error, action appears to succeed in the browser, but is not persisted\r\n- Modify advanced setting - Request to Elasticsearch failed: \"[security_exception] action [indices:data/write/update] is unauthorized for user [kibana4]\"\r\n- Modify saved object - SavedObject view: AuthorizationException[action [indices:data/write/index] is unauthorized for user [kibana4]]\r\n- Delete saved object - No error, action does not appear to succeed\r\n- Import saved object from JSON - Saved Objects: AuthorizationException[action [indices:data/write/bulk] is unauthorized for user [kibana4]]\r\n- Create new saved object - Visualization Editor: Request to Elasticsearch failed: \"[security_exception] action [indices:data/write/index] is unauthorized for user [kibana4]\"\r\n- Update field properties (formatting, popularity) - No error, action appears to succeed in the browser, but is not persisted\r\n- Create new scripted field - No error, action appears to succeed in the browser, but is not persisted\r\n```"},"comment":{"url":"https://api.github.com/repos/elastic/kibana/issues/comments/198324658","html_url":"https://github.com/elastic/kibana/issues/4731#issuecomment-198324658","issue_url":"https://api.github.com/repos/elastic/kibana/issues/4731","id":198324658,"user":{"login":"gmoskovicz","id":1675411,"avatar_url":"https://avatars.githubusercontent.com/u/1675411?v=3","gravatar_id":"","url":"https://api.github.com/users/gmoskovicz","html_url":"https://github.com/gmoskovicz","followers_url":"https://api.github.com/users/gmoskovicz/followers","following_url":"https://api.github.com/users/gmoskovicz/following{/other_user}","gists_url":"https://api.github.com/users/gmoskovicz/gists{/gist_id}","starred_url":"https://api.github.com/users/gmoskovicz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gmoskovicz/subscriptions","organizations_url":"https://api.github.com/users/gmoskovicz/orgs","repos_url":"https://api.github.com/users/gmoskovicz/repos","events_url":"https://api.github.com/users/gmoskovicz/events{/privacy}","received_events_url":"https://api.github.com/users/gmoskovicz/received_events","type":"User","site_admin":false},"created_at":"2016-03-18T12:01:45Z","updated_at":"2016-03-18T12:01:45Z","body":"@tbragin Same thing happens when you don't have `indices:data/read/mget` access and try to open Kibana:\r\n\r\n![screen shot 2016-03-18 at 09 00 39](https://cloud.githubusercontent.com/assets/1675411/13877171/f2b0d138-ece7-11e5-9fa5-3e32215c54f4.png)\r\n\r\n\r\nSo, :+1: on adding a more consistent error. While this is a clear error, we should have a consistent error handling. "}}