### Author:  [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)
#### Post date: [May 7, 2018, 8:18am UTC](https://forum.search-guard.com/t/how-to-create-a-jwt-to-match-the-users-in-search-guard/903/2 "2018-05-07T08:18:46Z")
its not yet possible to combine jwt and the internal authorization backend.
we are working on this here [https://github.com/floragunncom/search-guard/pull/475](https://github.com/floragunncom/search-guard/pull/475)
so currently you need to add your roles to the jwt token or use ldap to assign roles
> **···**
>
> On Friday, 4 May 2018 16:56:06 UTC+2, .mni wrote:
>
> > On printing roles form the REST api, I have:
>
> > “kibanaro” : {
> > “hash” : “\”,
> > “roles” : [
> > “kibanauser”,
> > “readall”
> > ]
> > }
>
> > ``
>
> >
>
> >
>
> > On the JWT side, I am using [jwt.io](http://jwt.io) to generate a payload, and in the payload section of the [jwt.io](http://jwt.io) I am using:
>
> >
>
> > {
> > “name”: “kibanaro”,
> > “iat”: 1516239022,
> > “exp”: 1656723873,
> > “sub”: “kibanaro”,
> > “roles”: “kibanauser, readall”
> > }
>
> > ``
>
> >
>
> > However, I get an error saying:
>
> >
>
> > [2018-05-04T14:53:35,323][DEBUG][c.f.s.a.BackendRegistry] Try to extract auth creds from jwt http authenticator
> > [2018-05-04T14:53:35,324][DEBUG][c.f.s.a.BackendRegistry] kibanaro not cached, return from noop backend directly
> > [2018-05-04T14:53:35,325][DEBUG][c.f.s.a.BackendRegistry] User ‘User [name=kibanaro, roles=, requestedTenant=null]’ is authenticated
> > [2018-05-04T14:53:35,325][DEBUG][c.f.s.a.BackendRegistry] sgtenant ‘null’
> > [2018-05-04T14:53:35,326][DEBUG][c.f.s.c.PrivilegesEvaluator] ### evaluate permissions for User [name=kibanaro, roles=, requestedTenant=null] on elasticsearch
> > [2018-05-04T14:53:35,326][DEBUG][c.f.s.c.PrivilegesEvaluator] requested cluster:monitor/main from \*\*\*\*\*\*\*\*\*\*\*\*\*
> > [2018-05-04T14:53:35,326][DEBUG][c.f.s.c.PrivilegesEvaluator] class org.elasticsearch.action.main.MainRequest is not an IndicesRequest
> > [2018-05-04T14:53:35,327][DEBUG][c.f.s.c.PrivilegesEvaluator] requested resolved indextypes: [IndexType [index=\_all, type=_]]
> > [2018-05-04T14:53:35,327][DEBUG][c.f.s.c.PrivilegesEvaluator] mapped roles for kibanaro: [sg\_own\_index]
> > [2018-05-04T14:53:35,328][DEBUG][c.f.s.c.PrivilegesInterceptorImpl] raw requestedTenant: ‘null’
> > [2018-05-04T14:53:35,328][DEBUG][c.f.s.c.PrivilegesEvaluator] Result from privileges interceptor: null
> > [2018-05-04T14:53:35,329][DEBUG][c.f.s.c.PrivilegesEvaluator] ---------- evaluate sg\_role: sg\_own\_index
> > [2018-05-04T14:53:35,329][DEBUG][c.f.s.c.PrivilegesEvaluator] resolved cluster actions:[indices:data/write/reindex, indices:admin/aliases/exists_, indices:admin/aliases\*, indices:data/read/msearch, indices:data/read/scroll, indices:data/read/coordinate-msearch\*, indices:data/write/bulk, indices:admin/aliases/get\*, indices:data/read/mget, indices:data/read/mtv]
> > [2018-05-04T14:53:35,329][DEBUG][c.f.s.c.PrivilegesEvaluator] not match found a match for ‘sg\_own\_index’ and cluster:monitor/main, check next role
> > [2018-05-04T14:53:35,330][INFO][c.f.s.c.PrivilegesEvaluator] No cluster-level perm match for User [name=kibanaro, roles=, requestedTenant=null] [IndexType [index=\_all, type=\*]] [Action [[cluster:monitor/main]]] [RolesChecked [sg\_own\_index]]
> > [2018-05-04T14:53:35,330][INFO][c.f.s.c.PrivilegesEvaluator] No permissions for {}
> > [2018-05-04T14:53:35,330][DEBUG][c.f.s.f.SearchGuardFilter] no permissions for [cluster:monitor/main]
> > [2018-05-04T14:53:35,331][DEBUG][r.suppressed] path: /, params: {}
> > org.elasticsearch.ElasticsearchSecurityException: no permissions for [cluster:monitor/main] and User [name=kibanaro, roles=, requestedTenant=null]
>
> > ``
>
> >
---
### Author:  [@mni](https://forum.search-guard.com/u/mni)
#### Post date: [May 7, 2018, 2:17pm UTC](https://forum.search-guard.com/t/how-to-create-a-jwt-to-match-the-users-in-search-guard/903/3 "2018-05-07T14:17:03Z")
So, how do I properly add my roles to the JWT token? I have not been able to do this successfully either.
---
### Author:  [@jkressin](https://forum.search-guard.com/u/jkressin)
#### Post date: [May 8, 2018, 5:09pm UTC](https://forum.search-guard.com/t/how-to-create-a-jwt-to-match-the-users-in-search-guard/903/4 "2018-05-08T17:09:05Z")
If this is your JWT token:
{
“name”: “kibanaro”,
“iat”: 1516239022,
“exp”: 1656723873,
“sub”: “kibanaro”,
“roles”: “kibanauser, readall”
}
Then you already have two roles in it. You just need to tell Search Guard under which key they can be found. So for the JWT above you would need to configure:
jwt\_auth\_domain:
enabled: true
order: 1
http\_authenticator:
type: jwt
challenge: false
config:
signing\_key: “…”
jwt\_header: “Authorization”
roles\_key: roles
subject\_key: sub
authentication\_backend:
type: noop
``
> **···**
>
> On Monday, May 7, 2018 at 4:17:03 PM UTC+2, .mni wrote:
>
> > So, how do I properly add my roles to the JWT token? I have not been able to do this successfully either.
---
### Author:  [@mni](https://forum.search-guard.com/u/mni)
#### Post date: [May 9, 2018, 3:28pm UTC](https://forum.search-guard.com/t/how-to-create-a-jwt-to-match-the-users-in-search-guard/903/5 "2018-05-09T15:28:11Z")
Thank you, the docs had an example of using null fields and that confused me. It works now with your directions 🙂