ApiKey with role_descriptors to access Kibana - elasticsearch

Question

I would like to use the ApiKey authentication to create a reverse proxy for Kibana. The Reverse Proxy is needed to inject a custom role with some filters.
The proxy creates an ApiKey first with this post:
POST /_security/api_key
{
"name": "kb-1234-9876",
"expiration": "1d",
"role_descriptors": {
"role-a": {
"cluster": ["all"],
"indices": [
{
"names": ["*"],
"privileges": ["read"],
"query": "\"bool\": { \"filter\": { \"terms\": { \"customer.id_customer\": [ \"1234\", \"9876\" ] } }}"
}
]
}
}
After that the authentication header with the APIKEY Base64 string is passed to the backend.
Apparently the ApiKey does not have permission to access the Kibana Dashboard.
Is there any way to create the Kibana feature authorisation within the ApiKey as described in Kibana Role Management API?
Some other workaround?

Answer 1

I found that the "old" Kibana authorisation with the applications privileges work. So my new Post of the ApiKey is like this:
POST /_security/api_key
{
"name": "kb-1234-9876",
"expiration": "1d",
"role_descriptors": {
"role-a": {
"cluster": ["all"],
"indices": [
{
"names": ["*"],
"privileges": ["read"],
"query": "\"bool\": { \"filter\": { \"terms\": { \"customer.id_customer\": [ \"1234\", \"9876\" ] } }}"
}
],
"applications": [
{
"application": "kibana-.kibana",
"privileges": [
"read"
],
"resources": ["*"]
}
]
}
}
}