Role Based Dashboard Access

[varunsharma27]

Features:-

• Role Based Dashboard Access.
• Role Based Visualization Access (Showing partial Dashboards).

Summary :-

• Lets say there are 3 groups:- Sales, Accounting, Management. They visit a dashboard 'Report'.
• We'd like each of them to see it in a different way, Sales have no use for all those nitpicky things that accounting would require and Accounting wouldn't really care about Sales target related visualizations. Management would probably want all details plus a few higher level visualizations showing the health of organization.

A direct solution would be to create different dashboards and use Own Home plugin somehow but this gets complicated when we have a lot of dashboards and the relationship is more tightly bound between them. Visualization level access would make a lot of sense then.

The best solution (According to me) would be :-
To have role based access to .kibana index (And fetching the details using user credentials, not kibana process 'master' credentials which currently in 5.4.1 it does, so we're fine) for dashboard and visualization types (At least) in elasticsearch and then kibana should behave accordingly (after handling 403s for a few visualizations + re-ordering). This would require some collaboration between ES and Kibana team.

I have already developed our own SSO/token-based security, for kibana and elasticsearch but this feature is not something that a plugin can address (AFAIK) and changes in kibana's code would be required. If you have some ideas then please share.

Moreover, I have seen that Kibana is great for developers but at an enterprise level it lacks severely. Access control granularity is almost non existent even in X-Pack. Do you have any plans to make it more enterprise ready? I'd be willing to give my input and even contribute.

[legrego]

You might be interested in the Spaces feature we are actively working on. This will let you organize your dashboards (and other saved objects) into "spaces", and with X-Pack Security, you'll be able to control who has access to individual spaces.

[marius-dr]

As @legrego mentioned, Spaces will cover this request. Closing this issue.