-
Notifications
You must be signed in to change notification settings - Fork 8.6k
[DOCS] Dashboard-only-mode: Update to match UI #20734
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from 1 commit
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,19 +1,24 @@ | ||
| [role="xpack"] | ||
| [[advanced-dashboard-mode-configuration]] | ||
| === Advanced configuration for Dashboard Only mode | ||
| === Advanced Configuration for Dashboard Only Mode | ||
|
|
||
| Kibana comes preconfigured with a reserved role called `kibana_dashboard_only_user` which will be sufficient | ||
| for most use cases. However, if your setup requires a custom Kibana index, you can manually create | ||
| Dashboard Mode roles. | ||
| Kibana comes preconfigured with a reserved role called `kibana_dashboard_only_user` | ||
| that grants read only access to the `.kibana` index. This role is sufficient | ||
| for most use cases. However, if your setup requires a custom {kib} index, you can create | ||
| your own roles and tag them as *Dashboard only mode*. | ||
|
|
||
| To do so, go into *Management > Advanced Settings* and search for `xpackDashboardMode:roles`. Then assign whatever | ||
| role names you wish to use to flag a user for Dashboard Only mode. | ||
| Go to *Management > Kibana > Advanced Settings* and search for *Dashboard*. By default | ||
| `xpackDashboardMode:roles` is set to `kibana_dashboard_only_user`. | ||
| Here you can add as many roles as you like. | ||
|
|
||
| [role="screenshot"] | ||
| image:management/dashboard_only_mode/images/advanced_dashboard_mode_role_setup.png["Advanced dashboard mode role setup"] | ||
|
|
||
| It isn't necessary for Dashboard Only mode roles to have any additional permissions, but it's a convenient location | ||
| to also place access rules to the custom Kibana index. If you wish to grant read only access to your custom Kibana | ||
| index, it must have `view_index_metadata` permissions as well as `read` permissions. These role settings are available | ||
| under *Management > Security > Roles*. | ||
| It's not necessary for *Dashboard only mode* to have additional privileges, | ||
| but it's a convenient place to add access rules to a custom {kib} index. | ||
| To grant read only access to your custom {kib} | ||
| index, you must assign `view_index_metadata` and `read` privileges. | ||
| These privileges are available under *Management > Security > Roles*. | ||
|
|
||
| [role="screenshot"] | ||
| image:management/dashboard_only_mode/images/custom_dashboard_mode_role.png["Custom dashboard mode role with read permissions on a custom kibana index"] | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -2,25 +2,30 @@ | |
| [[xpack-dashboard-only-mode]] | ||
| == Kibana Dashboard Only Mode | ||
|
|
||
| {xpack} gives the ability for admins to limit what certain users see when they log in to Kibana with a | ||
| reserved `kibana_dashboard_only_user` role. | ||
| {xpack} gives admins the ability to assign users a reserved `kibana_dashboard_only_user` | ||
| role that limits what they see when they log in to {kib}. | ||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I'm actually not sure what "reserved" role means in this case. I think it would be better to refer to it as a "built-in role", as in https://www.elastic.co/guide/en/elastic-stack-overview/6.3/built-in-roles.html. So maybe something like this: "If {security} is enabled, you can use the |
||
|
|
||
| When you assign a user this role, the next time they sign in to Kibana they will only be able to see the Dashboard app, | ||
| and no editing tools will be available. | ||
|
|
||
| image:management/dashboard_only_mode/images/view_only_listing_page.png["View Only Dashboard Listing Page"] | ||
| Users assigned this role are only able to see the Dashboard app in the navigation | ||
| pane. When users open a dashboard, they will have a limited visual experience. | ||
| All edit and create controls are hidden. | ||
|
|
||
| [role="screenshot"] | ||
| image:management/dashboard_only_mode/images/view_only_dashboard.png["View Only Dashboard"] | ||
|
|
||
| IMPORTANT: If a user is also assigned the reserved `superuser` role, they will be able to see all of Kibana and have | ||
| full access. | ||
| To assign this role, go to *Management > Security > Users*, add or edit | ||
| a user, and add the `kibana_dashboard_only_user` role. | ||
|
|
||
| The `kibana_dashboard_only_user` role is | ||
| preconfigured with read only permissions on the `.kibana` index. | ||
|
|
||
| IMPORTANT: If you assign users the `kibana_dashboard_only_user` role, along with a role | ||
| with write permissions on the `.kibana` index, they *will* have write access, | ||
| even though the controls remain hidden in the {kib} UI. | ||
|
|
||
| The `kibana_dashboard_only_user` role comes preconfigured with read only permissions on the `.kibana` index. | ||
| IMPORTANT: If you also assign users the reserved `superuser` role, they will be able to see | ||
| all of {kib} and have full access. | ||
|
|
||
| IMPORTANT: If you assign a user the `kibana_dashboard_only_user` role, along with a role with write permissions on | ||
| the .kibana index, they *will* have write access, even though the controls will remain hidden in the kibana | ||
| UI. | ||
| <<advanced-dashboard-mode-configuration, Advanced configurations>> that use a | ||
| custom {kib} index are possible. | ||
|
|
||
| For advanced set ups that use a custom Kibana index, | ||
| <<advanced-dashboard-mode-configuration, advanced configurations>> are possible. | ||
| include::advanced_configuration.asciidoc[] | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Maybe it's obvious, but it might be worth restating that this role is only available to you if security is enabled.