[BUG] 2.19 Reporting Generate CSV Permissions

[eddic]

After updating to OpenSearch 2.19 (R2025-04-28) our generate CSV ability in the reporting plugin now fails for any non-all_access users. We have tried to "clone" all_access by adding every possible cluster and index permission (to all possible indexes) to a role and assigning it to users but the result is the same. Specifically the API returns "Permission denied for report instance creation". As soon as the user is added to the native all_access it works fine.

[ps48]

Thanks for reporting the issue. Will look into this shortly. Meanwhile just some pointers we don't have any major updates that went in reporting 2.19. Need to deep dive to figure out what's causing the issue.

[gursharanbagha]

@eddic @ps48 This bug was not introduced in version 2.19—it has existed in earlier versions as well.

[eddic]

Yes we have been struggling with it in previous versions but seemed to be able to fix it by giving users read access to .kibana* indexes. Upon updating to 2.19 that fixed ceased to work.

[gursharanbagha]

@eddic I tried but not worked.

[eddic]

Meaning you cannot reproduce?

[cameronattard]

I think we're seeing this same issue in 2.19 as well.

[sumukhswamy]

A code regression in 2.19's security plugin refactor caused the requestTenantAccess field to be null, breaking permission checks. As a result, the reporting plugin wrongly denies access to users who should be authorized. The patch should be available in 3.1

[b1zzu]

Same here, do you know a workaround for this issue?