[Reporting/Documentation] Docs incorrectly state kibana_user role is necessary

[tsullivan]

Kibana version: 7.3.0

https://www.elastic.co/guide/en/kibana/current/secure-reporting.html

To enable users to generate reports, assign them the built in reporting_user and kibana_user roles:

This is not entirely correct, because users can generate reports without kibana_user. A custom role is also supported:

Create a user with reporting_user and a custom role. The custom role must give them all ES access to a particular index, and in the Default Kibana space, give them access to Discover/Dashboard. That user can create a report from that index and view the report generated

[elasticmachine]

Pinging @elastic/kibana-docs

[tsullivan]

cc @andrew-moldovan

[KOTungseth]

@kobelb can you help with this one?

[gchaps]

@tsullivan Do I replace the existing content about requiring the built in reporting_user and kibana_user roles with the new paragraph:

Create a user with reporting_user and a custom role. The custom role must give them all ES access to a particular index, and in the Default Kibana space, give them access to Discover/Dashboard. That user can create a report from that index and view the report generated.

Or should ways be included in the doc?

[tsullivan]

@gchaps the change should reflect that there isn't a "hard" requirement to assign the user kibana_user role. The notes I wrote in the issue description weren't intended to be a proposal for replacing for the existing text - I needed to jot down the technical details to be able to remember what this issue was about.

A proposal:

To enable users to generate reports, assign them the built in reporting_user role. They will also need authorization to access the Elasticsearch indices with the underlying data, and they will need authorization to read the visualization saved objects in the Kibana Spaces they belong to.

I'm fuzzy on the terminology needed for the last part. I'm not sure how to technically mention "Spaces they belong to"

[legrego]

They will also need authorization to access the Elasticsearch indices with the underlying data, and they will need authorization to read the visualization saved objects in the Kibana Spaces they belong to.

It's tough, because you can report on the following saved object types (not just visualizations):

• Index Patterns / Saved Searches via the Discover app
• Visualizations via the Visualize app
• Dashboards (and therefore visualizations and index patterns) via the Dashboard app
• Canvas Workpads via the Canvas app
• others?

How about something like:

They will also need the appropriate Kibana Privileges to access the saved objects (I don't like this term...) they wish to report on, as well as access to the Elasticsearch indices with the underlying data.

It might be helpful if the docs also included an example which illustrated a user being assigned the reporting_user role, as well as a custom role that defines access to a subset of Kibana.

[gchaps]

@tsullivan, @legrego Can either of you provide the example that Larry suggests in his comment?