Insufficient privileges with API key

[cvanallen99]

Environment
Home-Assistant version: 2024.9.1
Elasticsearch version: 8.15

Describe the bug
When attempting to add the configuration using authenticate via API key within Home Assistant, HA returns an "Insufficient privileges for specified user" error. I am able to add the integration using username/password, so both HA and Elastic appear configured correctly. I copied the api key requirements exactly as in the configuration guide using the Elastic dev console. They key created with no errors

To Reproduce
Steps to reproduce the behavior:

1. Go to Home Assistant -> Settings -> Add Integration.
2. Add Elasticsearch integration. Chose the Authenticate via API key option
3. Enter URL and API key info.
4. After clicking submit, HA returns an error "Insufficient privileges for specified user"

For validation, here's the API key settings in elastic:

{
"hass_writer": {
"cluster": [
"manage_index_templates",
"monitor"
],
"indices": [
{
"names": [
"metrics-homeassistant.*"
],
"privileges": [
"manage",
"index",
"create_index",
"create"
],
"allow_restricted_indices": false
}
],
"applications": [],
"run_as": [],
"metadata": {},
"transient_metadata": {
"enabled": true
}
}
}

Used to work fine. I suspect something changed recently in either HA or Elastic. As a workaround, I can user username/password, I just prefer key based authentication for security reasons.

[legrego]

@cvanallen99, a few questions:

1. which version of this integration are you using?

2. Did the username/password credentials have the same set of privileges as your API Key, or a different set of privileges?

3. Can you enable debug logging for the integration, and share that with us (redacting if necessary)?

cc @strawgate in case you have other questions

[cvanallen99]

1) 0.7.2 of homeassistant-elasticsearch. 2) No, I used the elastic superuser when using username/password 3) I'll have to remove/reinstall the integration using an API key to pull the debug info. I'll try to find time tonight or tomorrow

…

On Thu, Sep 19, 2024 at 1:27 PM Larry Gregory ***@***.***> wrote: @cvanallen99 <https://github.com/cvanallen99>, a few questions: 1. which version of this integration are you using? 2. Did the username/password credentials have the same set of privileges as your API Key, or a different set of privileges? 3. Can you enable debug logging for the integration, and share that with us (redacting if necessary)? cc @strawgate <https://github.com/strawgate> in case you have other questions — Reply to this email directly, view it on GitHub <#361 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AYDPJY55CL2ARXTVTITKBHLZXMJRFAVCNFSM6AAAAABOH7O756VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDGNRRHA4DOOBQHE> . You are receiving this because you were mentioned.Message ID: ***@***.***>

-- ----------------------------------------------------------------------------------------- Christopher Van Allen (K5CVA) ***@***.***

[strawgate]

For version 0.7 you need the "manage_ilm" cluster permission, did you follow the setup instructions for 0.7 or for 2.0?

[cvanallen99]

I configured the API key as the configuration instructions under Documentation within the Home Assistant Elasticsearch integration (which actually takes you to the README file in github) under the configuration link within that README OST /_security/api_key { "name": "home_assistant_component", "role_descriptors": { "hass_writer": { "cluster": [ "manage_index_templates", "monitor" ], "indices": [ { "names": [ "metrics-homeassistant.*" ], "privileges": [ "manage", "index", "create_index", "create" ] } ] } } }

…

On Thu, Sep 19, 2024 at 9:22 PM William Easton ***@***.***> wrote: For version 0.7 you need the "manage_ilm" cluster permission, did you follow the setup instructions for 0.7 or for 2.0? — Reply to this email directly, view it on GitHub <#361 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AYDPJYYYFL6VFMIMJZN5KTDZXOBG3AVCNFSM6AAAAABOH7O756VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDGNRSGU3TQMJSGQ> . You are receiving this because you were mentioned.Message ID: ***@***.***>

-- ----------------------------------------------------------------------------------------- Christopher Van Allen (K5CVA) ***@***.***

[strawgate]

Are you able to test adding the manage ilm cluster permission and let us know if that resolves the issue?

[cvanallen99]

yes, that appears to have resolved the issue. I'd recommend updating the configuration section of the readme to add manage_ilm under cluster.

…

On Thu, Sep 19, 2024 at 10:04 PM William Easton ***@***.***> wrote: Are you able to test adding the manage ilm cluster permission and let us know if that resolves the issue? — Reply to this email directly, view it on GitHub <#361 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AYDPJYY7F723N7XZFWVQ6DLZXOGEHAVCNFSM6AAAAABOH7O756VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDGNRSGY3DQMRYGU> . You are receiving this because you were mentioned.Message ID: ***@***.***>

-- ----------------------------------------------------------------------------------------- Christopher Van Allen (K5CVA) ***@***.***