{"id":9417,"date":"2022-09-20T10:48:38","date_gmt":"2022-09-20T15:48:38","guid":{"rendered":"https:\/\/www.rushworth.us\/lisa\/?p=9417"},"modified":"2022-09-23T10:49:50","modified_gmt":"2022-09-23T15:49:50","slug":"opensearch-2-x-building-a-new-tenant","status":"publish","type":"post","link":"https:\/\/www.rushworth.us\/lisa\/?p=9417","title":{"rendered":"OpenSearch 2.x: Building a New Tenant"},"content":{"rendered":"

Logged in as an admin user, use the left-hand navigation menu to select \u201cSecurity\u201d. Select \u201cTenants\u201d and click on \u201cCreate tenant\u201d.<\/p>\n

<\/p>\n

Give the tenant a name and a description, then click \u201cCreate\u201d<\/p>\n

<\/p>\n

OK, now a tenant is created. The important bit is to establish a role that only sees data within the tenant. Click on \u201cRoles\u201d, then click \u201cCreate role\u201d.<\/p>\n

<\/p>\n

Give the role a name:<\/p>\n

<\/p>\n

Under \u201cCluster permissions\u201d add either cluster_composite_ops_ro (for read only access \u2013 cannot make new visualizations or dashboards) or cluster_composite_ops \u2013 we may make a \u201chelp desk\u201d type role where users are not permitted to write to the tenant, but my examples herein are all for business owners who will be able to save queries, create visualizations, modify dashboards, etc.<\/p>\n

<\/p>\n

Under \u201cIndex permissions\u201d, add the index pattern (or patterns) to which the tenant should have access. Add read or read\/write permissions to the index. We are not using any of the fine-grained security components (providing access only to records that come in from a specific host or contain a specific error)<\/p>\n

<\/p>\n

Finally, under \u201cTenant Permissions\u201d, select the associated tenant and grant either Read or Read and Write permission<\/p>\n

<\/p>\n

Click \u201cCreate\u201d and your new role has been created. Once created, click on \u201cMapped users\u201d<\/p>\n

<\/p>\n

Select \u201cMap users\u201d to edit the users mapped to the role.<\/p>\n

<\/p>\n

To map an externally authenticated user (accounts authenticate through OpenID, for example), just type the username and hit enter to add \u201cas a custom option\u201d.<\/p>\n

<\/p>\n

For an internal user, you\u2019ll be able to select them from a user list as you begin typing the user ID<\/p>\n

<\/p>\n

There is one trick to getting a new tenant working — https:\/\/forum.opensearch.org\/t\/multi-tenancy-for-different-indices\/5008\/8<\/a> indicates you\u2019ve got to use an admin account from the global tenant, switch to the new tenant, and create the index pattern there. Once the index pattern (or, I suppose, patterns) has been created, the tenant users are able to discover \/ visualize their data.<\/p>\n

Click on the icon for your user account and select \u201cSwitch tenants\u201d<\/p>\n

<\/p>\n

Select the radio button in front of \u201cChoose from custom\u201d and then use the drop-down to select your newly created tenant. Click \u201cConfirm\u201d to switch to that tenant.<\/p>\n

<\/p>\n

From the left-hand navigation menu, select \u201cStack Management\u201d and then select \u201cIndex Patterns\u201d. Click to \u201cCreate index pattern\u201d<\/p>\n

<\/p>\n

Type the pattern and click \u201cNext step\u201d<\/p>\n

<\/p>\n

Select the time field from the drop-down menu, then click \u201cCreate index pattern\u201d<\/p>\n

<\/p>\n

Now you\u2019re ready \u2013 have a user log into OpenSearch Dashboard. They\u2019ll need to select the radio button to \u201cChoose from custom\u201d and select their tenant from the dropdown menu.<\/p>\n

<\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

Logged in as an admin user, use the left-hand navigation menu to select \u201cSecurity\u201d. Select \u201cTenants\u201d and click on \u201cCreate tenant\u201d. Give the tenant a name and a description, then click \u201cCreate\u201d OK, now a tenant is created. The important bit is to establish a role that only sees data within the tenant. Click on …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1744],"tags":[1740,1741,1745],"class_list":["post-9417","post","type-post","status-publish","format-standard","hentry","category-opensearch","tag-opensearch","tag-opensearch-dashboard","tag-opensearch-multitenancy"],"_links":{"self":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/9417","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=9417"}],"version-history":[{"count":1,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/9417\/revisions"}],"predecessor-version":[{"id":9435,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=\/wp\/v2\/posts\/9417\/revisions\/9435"}],"wp:attachment":[{"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=9417"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=9417"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rushworth.us\/lisa\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=9417"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}