# Can we create new roles in graylog community instance

**URL:** <https://community.graylog.org/t/can-we-create-new-roles-in-graylog-community-instance/20038>\
**Category:** Graylog Central (peer support)\
**Created:** [June 2, 2021, 5:00am UTC](https://community.graylog.org/t/can-we-create-new-roles-in-graylog-community-instance/20038 "2021-06-02T05:00:00Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![sameerk](https://avatars.discourse-cdn.com/v4/letter/s/5f9b8f/32.png) [@sameerk](https://community.graylog.org/u/sameerk)\
**Post date:** [June 2, 2021, 5:00am UTC](https://community.graylog.org/t/can-we-create-new-roles-in-graylog-community-instance/20038/1 "2021-06-02T05:00:00Z")

</div>

Hello Team,

Can we create new roles in graylog community instance 4.0.6, i know that  
To use the **group synchronization** functionality you need the [Graylog Enterprise license](https://www.graylog.org/products/enterprise) and the [Graylog Enterprise plugin](https://docs.graylog.org/en/4.0/pages/enterprise/setup.html).

can we create new roles in community instance, if yes can you guide how we can do that. any way to add new roles in mongo or any alternate way. Please guide.

Regards,  
Sameer

---

<div class="post-metadata">

**Author:** ![shoothub](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/shoothub/32/6412_2.png) [@shoothub](https://community.graylog.org/u/shoothub)\
**Post date:** [June 2, 2021, 6:55am UTC](https://community.graylog.org/t/can-we-create-new-roles-in-graylog-community-instance/20038/2 "2021-06-02T06:55:10Z")

</div>

Yes, you can still create custom role with custom permissions with REST API:  
`curl -i -X POST -u admin:PASS -H 'Content-Type: application/json' -H 'X-Requested-By: cli' 'http://172.28.128.15:9000/api/roles' -d @custom-role.json`

File content `custom-role.json` :

```auto
{
  "name": "Custom",
  "description": "Custom role",
  "permissions": [
        "clusterconfigentry:read",
        "indexercluster:read",
        "messagecount:read",
        "journal:read",
        "messages:analyze",
        "metrics:read",
        "fieldnames:read",
        "buffers:read",
        "system:read",
        "jvmstats:read",
        "decorators:read",
        "throughput:read",
        "messages:read"
      ],
  "read_only": false
}

```

To get list of possible permission check this:  
`curl -XGET -u admin:PASS 'http://172.28.128.15:9000/api/system/permissions?pretty=true'`

Note: Some permissions are mandatory for role, without them role can’t work, you will see error messages in web after login with user assigned custom role, you need to experiment.

Then assign newly created role to newly created user. This way you can assign whichever role to newly created user. Or you can assign/unassign role for user from System - Roles. If you try to unassign role from System - Users and Teams it’s not possible without Reader role. Anyway Reader role can’t be unassigned by web gui, if assigned once, but you can unassign Reader role from user using API:

`curl -i -X DELETE -u admin:tdXd3RMW -H 'Content-Type: application/json' -H 'X-Requested-By: cli' 'http://172.28.128.15:9000/api/authz/roles/ROLE_ID/assignee/USERNAME'`

ROLE\_ID can be received by this little bash snippet:

```auto
#!/bin/bash
# Unassign Reader role for user
# Username
USERNAME="test5"

# Get id of Role (Reader)
ROLE="Reader"
ROLEID=$(curl -s -X GET -u admin:PASS -H 'Content-Type: application/json' -H 'Accept: application/json' -H 'X-Requested-By: cli' 'http://172.28.128.15:9000/api/authz/roles?page=1&per_page=50&sort=name&order=asc'| jq -r '.roles[] | select(.name=="'"$ROLE"'") | .id')

# Unassign Reader role
curl -i -X DELETE -u admin:PASS -H 'Content-Type: application/json' -H 'X-Requested-By: cli' 'http://172.28.128.15:9000/api/authz/roles/'"$ROLEID"'/assignee/'"$USERNAME"''

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [June 16, 2021, 6:55am UTC](https://community.graylog.org/t/can-we-create-new-roles-in-graylog-community-instance/20038/3 "2021-06-16T06:55:27Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.