{"ref":"content:authorization-management-with-opensearch-s-document-level-security-sap-cloud-log","page":"/content/authorization-management-with-opensearch-s-document-level-security-sap-cloud-log","json":"/content/authorization-management-with-opensearch-s-document-level-security-sap-cloud-log.json","generated":"2026-10-26","drafted_with_ai":true,"entity":{"id":"authorization-management-with-opensearch-s-document-level-security-sap-cloud-log","title":"Authorization management with OpenSearch's Document Level Security - SAP Cloud Logging","url":"https://community.sap.com/t5/technology-blog-posts-by-sap/authorization-management-with-opensearch-s-document-level-security-sap/ba-p/14263570","content_type":"blog","published_on":"source:sap-community","explains":["artifact:btp-cloud-logging",{"ref":"capability:authorization","applies_to":{"ecosystems":["btp"]}}],"summary":"Where the predecessor SAP Application Logging service reused CF space permissions for read-only access, [SAP Cloud Logging](artifact:btp-cloud-logging) integrates with [SAP Cloud Identity Services](artifact:btp-cloud-identity-services) (IAS) and controls per-document visibility through OpenSearch's Document Level Security: an IAS group becomes a backend role, mapped to an OpenSearch role that carries a DLS query filter, so a search request only ever returns documents whose indexed field (space_name, organization_id, or another keyword field) matches what that role's filter allows. It walks through fixed per-space roles, a shared multi-space role using a terms query, and a single dynamic role that substitutes ${user.roles} into the filter so the match is against the caller's own groups, then lists operational pitfalls — wildcard index patterns breaking Dashboards, DLS roles that also hold write access creating log entries nobody can read back, and match queries against a .keyword field being non-deterministic where term queries are exact.","short":"Document level security in SAP Cloud Logging with OpenSearch and IAS","author":"Hariharan-Gandhi","published":"2025-11-24","provenance":{"discovered_via":[{"source":"source:sap-community","channel":"btp-tag"},{"source":"source:sap-community","channel":"cloud-foundry-tag"}],"first_seen":"2026-09-18"},"drafted_with_ai":true},"readings":{"liveness":[{"label":"Checked against the source","tier":"unknown","evidence":"nobody has checked it"},{"label":"Source reachable","tier":"unknown","evidence":"not crawled"},{"label":"Age","tier":"good","evidence":"published 11 months ago"}],"compatibility":[{"label":"Version","tier":"unknown","evidence":"no version declared"},{"label":"Moved since?","tier":"good","evidence":"no recorded change after 2025-11-24"},{"label":"Findings","tier":"good","evidence":"none flagged"}],"reach":[{"value":2379,"unit":"views"},{"value":1,"unit":"comments"},{"value":1,"unit":"likes"}]},"signals":{"views":2379,"likes":1,"comments":1,"metrics_at":"2026-10-25"},"series":null,"edges":{"authors":[]}}