[BUG] Missing indices:admin/get permission in kibana_server static role

Open Beginner friendly
#6,103 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
1/5
Estimated time
Under an hour
Newbie friendliness
72/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Quiet
Tech stack
yaml
Domain
authorization, security

Research direction

Start with src/main/resources/static_config/static_roles.yml at the kibana_server role entry referenced in the issue, and compare its permissions with the reported indices:admin/get failure. Reproduce with OpenSearch Dashboards using the kibana_server mapping, then verify startup succeeds without the security exception and that the role remains appropriately scoped.

Written by the indexing model from the issue text.

Description

bug triaged

What is the bug?
The kibana_server static role should provide all permissions required for OpenSearch Dashboards. However, a user with that role receives:

{"type":"log","@timestamp":"2026-04-21T19:31:41Z","tags":["error","opensearch","data"],"pid":23005,"message":"[security_exception]: no permissions for [indices:admin/get] and User [name=opensearch-dashboards, backend_roles=[], requestedTenant=null]"}

Mapping the user to all_access works fine:

{"type":"log","@timestamp":"2026-04-21T19:31:43Z","tags":["info","savedobjects-service"],"pid":23005,"message":"Creating index .kibana_1."}
{"type":"log","@timestamp":"2026-04-21T19:31:44Z","tags":["info","savedobjects-service"],"pid":23005,"message":"Pointing alias .kibana to .kibana_1."}
{"type":"log","@timestamp":"2026-04-21T19:31:44Z","tags":["info","savedobjects-service"],"pid":23005,"message":"Finished in 550ms."}

How can one reproduce the bug?
Steps to reproduce the behavior:

  1. Use OpenSearch with security plugin and OpenSearch Dashboards 3.6.0.0
  2. Map user opensearch-dashboards to role kibana_server
  3. Start Dashboards with that user
  4. See error

What is the expected behavior?
OpenSearch Dashboard works with kibana_server role permissions.

What is your host/environment?

  • OS: Arch Linux

Do you have any additional context?

The named permission is indeed missing from the static role: https://github.com/opensearch-project/security/blob/3.6.0.0/src/main/resources/static_config/static_roles.yml#L79

Dominant language
Java
Stars
252
Forks
395
Avg merge
1d 11h
Merged PRs (30d)
74

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from opensearch-project/security

All issues in opensearch-project/security

Similar issues

More Java issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.