Elastic-HQ grant access to Elasticsearch other users without authorization if one user was authorized

[svk-28]

General information

• OS Platform and Distribution (e.g., Linux Ubuntu 16.04): CentOS Linux release 7.8.2003 (Core)
• ElasticHQ Version: elastichq/elasticsearch-hq:latest
• Elasticsearch Version: opendistro-for-elasticsearch:1.9.0
• Python version (ignore is using docker image):
• Browser Vendor and Version (if applicable): FireFox, Chrome, Edge

The system is running in docker. User access is via https. for this purpose, elastic-hq is located behind nginx.
Elasticsearch used LDAP authentication and authorization

Issue Description

There was a problem with access to the Elasticsearch cluster: if one user was authorized in ES via Elastic-HQ, then other users (from different work station) who selected the desired cluster in the dialog get access to Elasticsearch without authorization.

Source Code / Logs

docker-compose
nginx:
image: nginx
container_name: nginx
env_file:
- .env
restart: always
ports:
- 443:443
environment:
- NGINX_HOST=${NGINX_HOST}
volumes:
- ./nginx/templates:/etc/nginx/templates
- ./ssl/cert.pem:/etc/nginx/certs/nginx-selfsigned.pem:ro
- ./ssl/client.key:/etc/nginx/certs/nginx-selfsigned.key:ro
networks:
- odfe-net
elastic-hq:
image: elastichq/elasticsearch-hq
container_name: elastic-hq
restart: always
environment:
- HQ_CA_CERTS=/src/ca.pem
- CLIENT_KEY=/src/client.key
- CLIENT_CERT=/src/client.pem
- HQ_ENABLE_SSL=True
- HQ_VERIFY_CERTS=False
- HQ_DEFAULT_URL=https://odfe-node1:9200
volumes:
- ./ssl/MyRootCA.pem:/src/ca.pem:ro
- ./ssl/crert.pem:/src/client.pem:ro
- ./ssl/client.key:/src/client.key:ro
networks:
- odfe-net
depends_on:
- nginx

nginx.conf.template
server {
listen 443 ssl;
server_name ${NGINX_HOST};
client_max_body_size 100M;
ssl_certificate /etc/nginx/certs/nginx-selfsigned.pem;
ssl_certificate_key /etc/nginx/certs/nginx-selfsigned.key;

location / {
proxy_pass http://elastic-hq:5000;
# proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}
}