RBAC for indices?

[Xavier Mertens]

Hello Wazuh'ers!

I'm facing a configuration problem with RBAC!

Context:

I'd like to create a user who will have access only to some indices (ex: wazuh-archives-*). I created the user, the role, mapping etc. But... it does not work!

If I use a "*" wildcard for indices, its ok but when I use the expected one, nothing!

When I'm on the "Discover" page, no indices are available.

Any idea?

PS: I read some posts from people who had the same issue but I did not find a solution.

[Nicolás Edgardo Rocca]

Hi,

I'm working on reproducing your scenario to identify exactly what's going on.

In order to narrow down the possibilities, I'll need some extra details:

• Wazuh version and deployment type you're using.
• Steps you followed to create the user, role and mapping.

Sharing the reference of the related posts you read would also be helpful.

Please share that information and I'll come back to you as soon as I find an answer.

[Xavier Mertens]

Hi Nicolas,

Sorry for re-activating this thread... I forgot to follow up but now, I'm still have the same issue... and would like to find a solution :-)

The setup is a stand alone Wazuh server, since my last post, it was upgraded, running the latest version.

/x