Cannot retrieve roles for User [name=me@example.com]

[nils]

I think, I slightly lost the overview here, sorry!

So, it is about these roles SG_ADMIN and SG_USER you mentioned earlier, right?

@Doug_Renze

Cannot retrieve roles for User [name=me@example.com, backend_roles=[SG_ADMIN, SG_USER], requestedTenant=null] from ldap due to ElasticsearchSecurityException[ElasticsearchSecurityException[No user me@example.com found]]; nested: ElasticsearchSecurityException[No user me@example.com found];

Also, if I understand it correctly, the user is authenticated via SAML.

This means that the roles probably come from the assertions in the SAML response. These roles are called backend roles, referring to the IdP as authcz backend.

To give these roles an actual meaning, they need to be specified in the roles mapping configuration. In the roles mapping, which you have provided earlier, I however can’t spot these backend roles.

There are however a couple of env variables which might contain the names of the backend roles:

@Doug_Renze

    - '${env.SG_LDAP_IT_USERS}'
    - '${env.SG_LDAP_NONIT_USERS}'
    - '${env.SG_SAML_USERS}'

So, you would need to check:

• Is the IdP providing SAML supposed to send the roles SG_USER and SG_ADMIN?
• If no, what roles should the IdP provide instead?
• If yes, make sure that the backend roles SG_USER and SG_ADMIN are mapped to Search Guard roles in the roles mapping configuration.