{security} introduces the concept of _authorization_ to Elasticsearch.
Authorization is the process of determining whether the user behind an incoming
request is allowed to execute it. This process takes place once a request is
successfully authenticated and the user behind the request is identified.
[[roles]]
[float]
=== Roles, Permissions and Privileges
The authorization process revolves around the following 5 constructs:
_Secured Resource_::
A resource to which access is restricted. Indices/aliases, documents, fields,
users and the Elasticsearch cluster itself are all examples of secured objects.
_Privilege_::
A named group representing one or more actions that a user may execute against a
secured resource. Each secured resource has its own sets of available privileges.
For example, `read` is an index privilege that represents all actions that enable
reading the indexed/stored data. For a complete list of available privileges
see <<security-privileges>>.
_Permissions_::
A set of one or more privileges against a secured resource. Permissions can
easily be described in words, here are few examples:
* `read` privilege on the `products` index
* `manage` privilege on the cluster
* `run_as` privilege on `john` user
* `read` privilege on documents that match query X
* `read` privilege on `credit_card` field
_Role_::
A named sets of permissions
_User_::
The authenticated user.
A secure Elasticsearch cluster manages the privileges of users through _roles_.
A role has a unique name and identifies a set of permissions that translate to
privileges on resources. A user can be associated with an arbitrary number of
roles. The total set of permissions that a user has is therefore defined by
union of the permissions in all its roles.
As an administrator, you will need to define the roles that you want to use,
then assign users to the roles. These can be assigned to users in a number of
ways depending on the realms by which the users are authenticated.
[[built-in-roles]]
=== Built-in Roles
{security} applies a default role to all users, including <<anonymous-access, anonymous users>>. The default role enables users to access the authenticate
endpoint, change their own passwords, and get information about themselves.
{security} also provides a set of built-in roles you can explicitly assign
to users. These roles have a fixed set of privileges and cannot be updated.
[[built-in-roles-superuser]]
`superuser`::
Grants full access to the cluster, including all indices and data. A user with
the `superuser` role can also manage users and roles and <<run-as-privilege, impersonate>> any other user in the system. Due to the permissive nature of
this role, take extra care when assigning it to a user.
[[built-in-roles-transport-client]]
`transport_client`::
Grants the privileges required to access the cluster through the Java Transport Client. The Java Transport Client fetches information about the nodes in the
cluster using the _Node Liveness API_ and the _Cluster State API_ (when
sniffing is enabled). Assign your users this role if they use the
Transport Client.
+
NOTE: Using the Transport Client effectively means the users are granted access
to the cluster state. This means users can view the metadata over all indices,
index templates, mappings, node and basically everything about the cluster.
However, this role does not grant permission to view the data in all indices.
[[built-in-roles-kibana-user]]
`kibana_user` ::
Grants the minimum privileges required for any user of Kibana. This role grants
access to the Kibana indices and grants monitoring privileges for the cluster.
[[built-in-roles-monitoring-user]]
`monitoring_user` ::
Grants the minimum privileges required for any user of Monitoring other than those
required to use Kibana. This role grants access to the monitoring indices. Monitoring
users should also be assigned the `kibana_user` role.
[[built-in-roles-reporting-user]]
`reporting_user` ::
Grants the specific privileges required for users of Reporting other than those
required to use Kibana. This role grants access to the reporting indices. Reporting
users should also be assigned the `kibana_user` role and a role that grants them
access to the data that will be used to generate reports with.
[[built-in-roles-remote-monitoring-agent]]
`remote_monitoring_agent` ::
Grants the minimum privileges required for a remote monitoring agent to write data
into this cluster.
[[built-in-roles-ingest-user]]
`ingest_admin` ::
Grants access to manage *all* index templates and *all* ingest pipeline configurations.
+
NOTE: This role does *not* provide the ability to create indices; those privileges
must be defined in a separate role.
[[built-in-roles-kibana-system]]
`kibana_system` ::
Grants access necessary for the Kibana system user to read from and write to the Kibana indices
and check the availability of the Elasticsearch cluster.
+
NOTE: This role should not be assigned to users as the granted permissions may
change between releases.
[[built-in-roles-logstash-system]]
`logstash_system` ::
Grants access necessary for the Logstash system user to send data to Elasticsearch.
+
NOTE: This role should not be assigned to users as the granted permissions may
