Skip to content
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 15 additions & 10 deletions docs/management/dashboard_only_mode/advanced_configuration.asciidoc
Original file line number Diff line number Diff line change
@@ -1,19 +1,24 @@
[role="xpack"]
[[advanced-dashboard-mode-configuration]]
=== Advanced configuration for Dashboard Only mode
=== Advanced Configuration for Dashboard Only Mode

Kibana comes preconfigured with a reserved role called `kibana_dashboard_only_user` which will be sufficient
for most use cases. However, if your setup requires a custom Kibana index, you can manually create
Dashboard Mode roles.
Kibana comes preconfigured with a reserved role called `kibana_dashboard_only_user`
that grants read only access to the `.kibana` index. This role is sufficient

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe it's obvious, but it might be worth restating that this role is only available to you if security is enabled.

for most use cases. However, if your setup requires a custom {kib} index, you can create
your own roles and tag them as *Dashboard only mode*.

To do so, go into *Management > Advanced Settings* and search for `xpackDashboardMode:roles`. Then assign whatever
role names you wish to use to flag a user for Dashboard Only mode.
Go to *Management > Kibana > Advanced Settings* and search for *Dashboard*. By default
`xpackDashboardMode:roles` is set to `kibana_dashboard_only_user`.
Here you can add as many roles as you like.

[role="screenshot"]
image:management/dashboard_only_mode/images/advanced_dashboard_mode_role_setup.png["Advanced dashboard mode role setup"]

It isn't necessary for Dashboard Only mode roles to have any additional permissions, but it's a convenient location
to also place access rules to the custom Kibana index. If you wish to grant read only access to your custom Kibana
index, it must have `view_index_metadata` permissions as well as `read` permissions. These role settings are available
under *Management > Security > Roles*.
It's not necessary for *Dashboard only mode* to have additional privileges,
but it's a convenient place to add access rules to a custom {kib} index.
To grant read only access to your custom {kib}
index, you must assign `view_index_metadata` and `read` privileges.
These privileges are available under *Management > Security > Roles*.

[role="screenshot"]
image:management/dashboard_only_mode/images/custom_dashboard_mode_role.png["Custom dashboard mode role with read permissions on a custom kibana index"]
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file not shown.
33 changes: 19 additions & 14 deletions docs/management/dashboard_only_mode/index.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -2,25 +2,30 @@
[[xpack-dashboard-only-mode]]
== Kibana Dashboard Only Mode

{xpack} gives the ability for admins to limit what certain users see when they log in to Kibana with a
reserved `kibana_dashboard_only_user` role.
{xpack} gives admins the ability to assign users a reserved `kibana_dashboard_only_user`
role that limits what they see when they log in to {kib}.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm actually not sure what "reserved" role means in this case. I think it would be better to refer to it as a "built-in role", as in https://www.elastic.co/guide/en/elastic-stack-overview/6.3/built-in-roles.html. So maybe something like this:

"If {security} is enabled, you can use the kibana_dashboard_only_user built-in role to limit ...."


When you assign a user this role, the next time they sign in to Kibana they will only be able to see the Dashboard app,
and no editing tools will be available.

image:management/dashboard_only_mode/images/view_only_listing_page.png["View Only Dashboard Listing Page"]
Users assigned this role are only able to see the Dashboard app in the navigation
pane. When users open a dashboard, they will have a limited visual experience.
All edit and create controls are hidden.

[role="screenshot"]
image:management/dashboard_only_mode/images/view_only_dashboard.png["View Only Dashboard"]

IMPORTANT: If a user is also assigned the reserved `superuser` role, they will be able to see all of Kibana and have
full access.
To assign this role, go to *Management > Security > Users*, add or edit
a user, and add the `kibana_dashboard_only_user` role.

The `kibana_dashboard_only_user` role is
preconfigured with read only permissions on the `.kibana` index.

IMPORTANT: If you assign users the `kibana_dashboard_only_user` role, along with a role
with write permissions on the `.kibana` index, they *will* have write access,
even though the controls remain hidden in the {kib} UI.

The `kibana_dashboard_only_user` role comes preconfigured with read only permissions on the `.kibana` index.
IMPORTANT: If you also assign users the reserved `superuser` role, they will be able to see
all of {kib} and have full access.

IMPORTANT: If you assign a user the `kibana_dashboard_only_user` role, along with a role with write permissions on
the .kibana index, they *will* have write access, even though the controls will remain hidden in the kibana
UI.
<<advanced-dashboard-mode-configuration, Advanced configurations>> that use a
custom {kib} index are possible.

For advanced set ups that use a custom Kibana index,
<<advanced-dashboard-mode-configuration, advanced configurations>> are possible.
include::advanced_configuration.asciidoc[]