Creating Users in OpenSearch for ElastiFlow

This guide describes how to create internal users and roles in OpenSearch that can read and search ElastiFlow data without full administrative privileges.

---

Create an Internal User

1. Log in as the admin user and navigate to Security → Internal Users.

2. Click Create User.

3. Fill out the form:

   • Username

   • Password (and confirmation)

4. Click Create to save the user.

---

Create a Role

1. Go to Security → Roles and click Create role.

2. Name the role, e.g. elastiflow-readonly.

3. In the Cluster Permissions section, add:

   • cluster_composite_ops_ro

4. In Index Permissions, use these patterns:

   • elastiflow-*

   • .kibana*

5. And apply the following permissions:

   • read

   • search

6. In the Tenant Permissions section:

   • Select global_tenant

   • Set to Read only access

7. Click Create to save the role.

---

Map the User to the Role

1. From the elastiflow-readonly role page, open the Mapped users tab.

2. Click Manage mapping.

3. Select the newly created user.

4. Click Map.

---

Test the New User

• Open a private browser window.

• Log in with the new user.

• Select the Global tenant when prompted (ElastiFlow dashboards are stored here).

---

External Authentication Mapping (Optional)

If you're using an external provider (SAML, LDAP, RADIUS), map the backend role sent by the IdP to this internal role:

• Go to Roles → elastiflow-readonly → Mapped backend roles

• Add the backend role (e.g. elastiflow-readonly) sent by your IdP

---

Users will now be able to access ElastiFlow Dashboards and data with the appropriate read-only permissions.