diff --git a/elasticsearch/x-pack/shield/src/test/java/org/elasticsearch/integration/DocumentLevelSecurityTests.java b/elasticsearch/x-pack/shield/src/test/java/org/elasticsearch/integration/DocumentLevelSecurityTests.java
index 0c0a45003c4..fd9c98fee29 100644
--- a/elasticsearch/x-pack/shield/src/test/java/org/elasticsearch/integration/DocumentLevelSecurityTests.java
+++ b/elasticsearch/x-pack/shield/src/test/java/org/elasticsearch/integration/DocumentLevelSecurityTests.java
@@ -16,6 +16,7 @@ import org.elasticsearch.action.termvectors.TermVectorsRequest;
 import org.elasticsearch.action.termvectors.TermVectorsResponse;
 import org.elasticsearch.action.update.UpdateRequest;
 import org.elasticsearch.common.settings.Settings;
+import org.elasticsearch.common.unit.TimeValue;
 import org.elasticsearch.index.query.QueryBuilder;
 import org.elasticsearch.index.query.QueryBuilders;
 import org.elasticsearch.indices.IndicesRequestCache;
@@ -675,6 +676,59 @@ public class DocumentLevelSecurityTests extends ShieldIntegTestCase {
         assertThat(response.getMatches()[0].getId().string(), equalTo("1"));
     }
 
+    public void testScroll() throws Exception {
+        assertAcked(client().admin().indices().prepareCreate("test")
+                .setSettings(Settings.builder().put(IndicesRequestCache.INDEX_CACHE_REQUEST_ENABLED_SETTING.getKey(), true))
+                .addMapping("type1", "field1", "type=text", "field2", "type=text", "field3", "type=text")
+        );
+        final int numVisible = scaledRandomIntBetween(2, 10);
+        final int numInVisible = scaledRandomIntBetween(2, 10);
+        int id = 1;
+        for (int i = 0; i < numVisible; i++) {
+            client().prepareIndex("test", "type1", String.valueOf(id++)).setSource("field1", "value1").get();
+        }
+
+        for (int i = 0; i < numInVisible; i++) {
+            client().prepareIndex("test", "type1", String.valueOf(id++)).setSource("field2", "value2").get();
+            client().prepareIndex("test", "type1", String.valueOf(id++)).setSource("field3", "value3").get();
+        }
+        refresh();
+
+        SearchResponse response = null;
+        try {
+            response = client()
+                    .filterWithHeader(Collections.singletonMap(BASIC_AUTH_HEADER, basicAuthHeaderValue("user1", USERS_PASSWD)))
+                    .prepareSearch("test")
+                    .setSize(1)
+                    .setScroll(TimeValue.timeValueMinutes(1L))
+                    .setQuery(termQuery("field1", "value1"))
+                    .get();
+            do {
+                assertNoFailures(response);
+                assertThat(response.getHits().getTotalHits(), is((long) numVisible));
+                assertThat(response.getHits().getAt(0).getSource().size(), is(1));
+                assertThat(response.getHits().getAt(0).getSource().get("field1"), is("value1"));
+
+                if (response.getScrollId() == null) {
+                    break;
+                }
+
+                response = client()
+                        .filterWithHeader(Collections.singletonMap(BASIC_AUTH_HEADER, basicAuthHeaderValue("user1", USERS_PASSWD)))
+                        .prepareSearchScroll(response.getScrollId())
+                        .setScroll(TimeValue.timeValueMinutes(1L))
+                        .get();
+            } while (response.getHits().getHits().length > 0);
+        } finally {
+            if (response != null) {
+                String scrollId = response.getScrollId();
+                if (scrollId != null) {
+                    client().prepareClearScroll().addScrollId(scrollId).get();
+                }
+            }
+        }
+    }
+
     public void testRequestCache() throws Exception {
         assertAcked(client().admin().indices().prepareCreate("test")
                 .setSettings(Settings.builder().put(IndicesRequestCache.INDEX_CACHE_REQUEST_ENABLED_SETTING.getKey(), true))
diff --git a/elasticsearch/x-pack/shield/src/test/java/org/elasticsearch/integration/FieldLevelSecurityTests.java b/elasticsearch/x-pack/shield/src/test/java/org/elasticsearch/integration/FieldLevelSecurityTests.java
index 9f475650b7b..56c6b0b67b6 100644
--- a/elasticsearch/x-pack/shield/src/test/java/org/elasticsearch/integration/FieldLevelSecurityTests.java
+++ b/elasticsearch/x-pack/shield/src/test/java/org/elasticsearch/integration/FieldLevelSecurityTests.java
@@ -17,6 +17,7 @@ import org.elasticsearch.action.termvectors.TermVectorsRequest;
 import org.elasticsearch.action.termvectors.TermVectorsResponse;
 import org.elasticsearch.action.update.UpdateRequest;
 import org.elasticsearch.common.settings.Settings;
+import org.elasticsearch.common.unit.TimeValue;
 import org.elasticsearch.index.IndexModule;
 import org.elasticsearch.indices.IndicesRequestCache;
 import org.elasticsearch.rest.RestStatus;
@@ -555,6 +556,58 @@ public class FieldLevelSecurityTests extends ShieldIntegTestCase {
         assertThat(response.getAllFieldStats().get("field2").getDocCount(), equalTo(1L));
     }
 
+    public void testScroll() throws Exception {
+        assertAcked(client().admin().indices().prepareCreate("test")
+                .setSettings(Settings.builder().put(IndexModule.INDEX_QUERY_CACHE_EVERYTHING_SETTING.getKey(), true))
+                .addMapping("type1", "field1", "type=text", "field2", "type=text", "field3", "type=text")
+        );
+
+        final int numDocs = scaledRandomIntBetween(2, 10);
+        for (int i = 0; i < numDocs; i++) {
+            client().prepareIndex("test", "type1", String.valueOf(i))
+                    .setSource("field1", "value1", "field2", "value2", "field3", "value3")
+                    .get();
+        }
+        refresh("test");
+
+        SearchResponse response = null;
+        try {
+            response = client()
+                    .filterWithHeader(Collections.singletonMap(BASIC_AUTH_HEADER, basicAuthHeaderValue("user1", USERS_PASSWD)))
+                    .prepareSearch("test")
+                    .setScroll(TimeValue.timeValueMinutes(1L))
+                    .setSize(1)
+                    .setQuery(constantScoreQuery(termQuery("field1", "value1")))
+                    .setFetchSource(true)
+                    .get();
+
+            do {
+                assertThat(response.getHits().getTotalHits(), is((long) numDocs));
+                assertThat(response.getHits().getHits().length, is(1));
+                assertThat(response.getHits().getAt(0).getSource().size(), is(1));
+                assertThat(response.getHits().getAt(0).getSource().get("field1"), is("value1"));
+
+                if (response.getScrollId() == null) {
+                    break;
+                }
+
+                response = client()
+                        .filterWithHeader(Collections.singletonMap(BASIC_AUTH_HEADER, basicAuthHeaderValue("user1", USERS_PASSWD)))
+                        .prepareSearchScroll(response.getScrollId())
+                        .setScroll(TimeValue.timeValueMinutes(1L))
+                        .get();
+            } while (response.getHits().getHits().length > 0);
+
+        } finally {
+            if (response != null) {
+                String scrollId = response.getScrollId();
+                if (scrollId != null) {
+                    client().prepareClearScroll().addScrollId(scrollId).get();
+                }
+            }
+        }
+    }
+
     public void testQueryCache() throws Exception {
         assertAcked(client().admin().indices().prepareCreate("test")
                         .setSettings(Settings.builder().put(IndexModule.INDEX_QUERY_CACHE_EVERYTHING_SETTING.getKey(), true))