# Role mapping for one tenant, in the file form used by
# /etc/wazuh-indexer/opensearch-security/roles_mapping.yml
#
# Source (structure and field meanings):
# https://documentation.wazuh.com/5.0-beta/user-manual/wazuh-indexer/security.html
#
# Wazuh recommends managing these through the dashboard Security application
# for routine administration. Edit the file directly only during installation,
# migration, backup and restore, or other advanced administrative tasks, and
# load it with securityadmin.sh afterwards.
#
# Two ways to reach the same role. Pick ONE per tenant:
#   users:         internal users created in the indexer user database
#   backend_roles: a group asserted by an identity provider (SAML, LDAP/AD, OIDC)
#
# Do not map a tenant user to any other role. Document-level security queries
# from several roles combine with a logical OR, so a second role widens the
# tenant rather than narrowing it.

tenant_acmeretail_read:
  reserved: false
  hidden: false
  # Internal-user route.
  users:
    - "acmeretail-analyst"
  # Identity-provider route. The value is the group or app-role name your IdP
  # asserts, matched case-sensitively.
  backend_roles:
    - "tenant-acmeretail"
  hosts: []
  and_backend_roles: []
  description: "Read-only access to tenant t-acmeretail findings, events and states"

# Load the file:
#   export JAVA_HOME=/usr/share/wazuh-indexer/jdk/ && \
#   bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh \
#     -f /etc/wazuh-indexer/opensearch-security/roles_mapping.yml \
#     -icl \
#     -key /etc/wazuh-indexer/certs/admin-key.pem \
#     -cert /etc/wazuh-indexer/certs/admin.pem \
#     -cacert /etc/wazuh-indexer/certs/root-ca.pem \
#     -h localhost -nhnv
#
# Back the directory up first:
#   /usr/share/wazuh-indexer/bin/indexer-security-init.sh \
#     --options "-backup /etc/wazuh-indexer/opensearch-security -icl -nhnv"