[BUG] 403 Forbidden error on /api/saved_objects/_find?fields=title&per_page=10000&type=index-pattern

[sebastienbonami]

What is the bug?
The Discover page is blank in OpenSearch Dashboards with a 403 Forbidden error on /api/saved_objects/_find?fields=title&per_page=10000&type=index-pattern with the following message:

no permissions for [indices:data/read/search] and User [name=test, backend_roles=[], requestedTenant=null]: security_exception: [security_exception] Reason: no permissions for [indices:data/read/search] and User [name=test, backend_roles=[], requestedTenant=null]

How can one reproduce the bug?
Follow all the steps of the following Example: https://opensearch.org/docs/2.16/security/access-control/users-roles/#example

Even after adding indices:data/read/search + indices:data/read/search* + indices:data/read/search/template in both Cluster and Index permissions, the error occurs.

What is the expected behavior?
The Discover page should show the data.

What is your host/environment?

• OS: Ubuntu 22.04
• OpenSearch: 2.16.0

[cwperks]

[Triage] @sebastienbonami can you share a little bit more about the full role definition of the user making the call.

The saved_objects API queries the .kibana* indices. This is also what the tenant_permissions section of a security role is for if you have a cluster with multi-tenancy.

[sebastienbonami]

Here's the result of the query on _opendistro/_security/api/roles/bulk_access:

{
    "bulk_access": {
        "reserved": false,
        "hidden": false,
        "cluster_permissions": [
            "cluster_composite_ops",
            "test"
        ],
        "index_permissions": [
            {
                "index_patterns": [
                    "test-data*"
                ],
                "dls": "",
                "fls": [],
                "masked_fields": [],
                "allowed_actions": [
                    "write",
                    "indices:data/read/search",
                    "indices:data/read/search*",
                    "indices:data/read/search/template"
                ]
            }
        ],
        "tenant_permissions": [],
        "static": false
    }
}

The action group called test under cluster_permissions contains:

• indices:data/read/search
• indices:data/read/search*
• indices:data/read/search/template

About multi-tenancy, I'm don't have custom tenants, here's the result of the query on _opendistro/_security/api/tenants:

{
    "global_tenant": {
        "reserved": true,
        "hidden": false,
        "description": "Global tenant",
        "static": true
    }
}

Thanks for your help.