# Cannot retrieve roles for User \[name=me@example.com\]

**URL:** https://forum.search-guard.com/t/cannot-retrieve-roles-for-user-name-me-example-com/2092
**Category:** Search Guard
**Created:** [February 12, 2021, 8:21am UTC](https://forum.search-guard.com/t/cannot-retrieve-roles-for-user-name-me-example-com/2092 "2021-02-12T08:21:37Z")
**Posts on this page:** 1
**Showing post:** 5

<div class="post-metadata">

### Author: ![nils](https://avatars.discourse-cdn.com/v4/letter/n/d6d6ee/32.png) [@nils](https://forum.search-guard.com/u/nils)
#### Post date: [February 15, 2021, 3:15pm UTC](https://forum.search-guard.com/t/cannot-retrieve-roles-for-user-name-me-example-com/2092/5 "2021-02-15T15:15:31Z")

</div>

I think, I slightly lost the overview here, sorry!

So, it is about these roles `SG_ADMIN` and `SG_USER` you mentioned earlier, right?

> [@Signals Watch getting "Failed to Fetch"](https://forum.search-guard.com/t/signals-watch-getting-failed-to-fetch/2091/1):
>
> `Cannot retrieve roles for User [name=me@example.com, backend_roles=[SG_ADMIN, SG_USER], requestedTenant=null] from ldap due to ElasticsearchSecurityException[ElasticsearchSecurityException[No user me@example.com found]]; nested: ElasticsearchSecurityException[No user me@example.com found];`

Also, if I understand it correctly, the user is authenticated via SAML.

This means that the roles probably come from the assertions in the SAML response. These roles are called backend roles, referring to the IdP as authcz backend.

To give these roles an actual meaning, they need to be specified in the roles mapping configuration. In the roles mapping, which you have provided earlier, I however can’t spot these backend roles.

There are however a couple of env variables which might contain the names of the backend roles:

> [@Signals Watch getting "Failed to Fetch"](https://forum.search-guard.com/t/signals-watch-getting-failed-to-fetch/2091/3):
>
> ```auto
> - '${env.SG_LDAP_IT_USERS}'
> - '${env.SG_LDAP_NONIT_USERS}'
> - '${env.SG_SAML_USERS}'
> 
> ```

So, you would need to check:

- Is the IdP providing SAML supposed to send the roles `SG_USER` and `SG_ADMIN`?
- If no, what roles should the IdP provide instead?
- If yes, make sure that the backend roles `SG_USER` and `SG_ADMIN` are mapped to Search Guard roles in the roles mapping configuration.

---

_[View the full topic](https://forum.search-guard.com/t/cannot-retrieve-roles-for-user-name-me-example-com/2092)._