Create users and assign rules by sensor nodes

[itdeveloper50]

We have installed distributed version of Security Onion.
Each branch has its own sensor node.
How to create users and assign roles by their sensor nodes?

For instance, let's say user Alice enters into management (web) and can see only her sensor's alerts.
Same for user Bob, Bob may see only his sensor node's alerts.

Superuser can see all alerts.

[dougburks]

Please see the RBAC page in our documentation:
https://docs.securityonion.net/en/2.3/rbac.html

[itdeveloper50]

@dougburks , we installed Security Onion-2.3.160-20220829 version originally and still we are running this version.
We use it in airgap mode.

Thank you.

[dougburks]

What is the output of the following?

sudo grep -A1 auth /opt/so/saltstack/local/pillar/elasticsearch/auth.sls

[itdeveloper50]

@dougburks ,

auth:
    enabled: True

[dougburks]

OK, that seems to confirm that Elastic auth is enabled. Let's go back to this:

Even if I do like this: so-user add "[email protected]" limited-analyst ,
It creates user named testuser, but does not assign role of limited-analyst.

I just tested on a 2.3.160 installation and this seems to work correctly for me:

[doug@securityonion ~]$ sudo so-user list
[email protected]: superuser 
[doug@securityonion ~]$ sudo so-user add "[email protected]" limited-analyst
Enter new password:
Syncing users and roles between SOC and Elastic...
Elastic state will be re-applied to affected minions. This may take several minutes...
Successfully added new user to SOC
[doug@securityonion ~]$ sudo so-user list
[email protected]: superuser 
[email protected]: limited-analyst 

When you do that test, what do you get at the end when running sudo so-user list?

You might also want to try a fresh installation (perhaps in a VM) just to see if you get any different results there.

[itdeveloper50]

Thank you for reply!

1. I created user [email protected] and assigned role limited-analyst.
   sudo so-user list shows it. That is fine.

2. After that, I created limited-analyst.json file in /opt/so/saltstack/local/salt/elasticsearch/roles according to this link.
   I just changed this line: "query": "{ "bool": { "should": [ { "prefix": { "observer.name": "myobserver" }}..

3. Ran sudo salt-call state.highstate.

Everything is fine, testuser can login into SO and Kibana.
But, when I do so-elasticsearch-restart, at the end of message there is one line that bothers me:
Loading roles..., {"role":{"created:false..... current license is non-compliant for .... field and document level security..role:created:false

Is it okay? Will testuser be able to see alerts only from myobserver?
Thank you again!