# LDAP(AD) Authorization against groups not working

**URL:** <https://forum.search-guard.com/t/ldap-ad-authorization-against-groups-not-working/710>\
**Category:** Search Guard\
**Created:** [December 15, 2017, 2:18pm UTC](https://forum.search-guard.com/t/ldap-ad-authorization-against-groups-not-working/710 "2017-12-15T14:18:57Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sreekanth](https://avatars.discourse-cdn.com/v4/letter/s/e47774/32.png) [@Sreekanth](https://forum.search-guard.com/u/Sreekanth)\
**Post date:** [December 15, 2017, 2:18pm UTC](https://forum.search-guard.com/t/ldap-ad-authorization-against-groups-not-working/710/1 "2017-12-15T14:18:57Z")

</div>

When asking questions, please provide the following information:

- Search Guard and Elasticsearch version: **search-guard-5**

- Installed and used enterprise modules, if any :

- JVM version and operating system version: 1.8.0\_141 on CentOS 7.4

- Search Guard configuration files:

- Elasticsearch log messages on debug level:

- Other installed Elasticsearch or Kibana plugins, if any

We are doing a POC evaluation SearchGuard for authentication/Authorization against AD. We are currently stuck with this issue with SG not being able to do group based authorization.

Scenario

We have ES and Kibana running 5.4.1 with SearchGuard installed and running fine. We have a couple of indices like atest and etest and we are trying to authorize 2 users to each of these index via an AD group and have been unsuccessful at it.

We have an user created atest and a group agroup, similarly etest and egroup, We are using agroup to assign atest index to the atest user. But when we do that we are seeing the following error in ES logs. We tried to setup debug but we did not get the correct documentation on how to setup the debug so we do not have the debug logs. Our config files look as following.

_sg\_config.yml_

_searchguard:_

_dynamic:_

_authc:_

_ldap:_

_enabled: true_

_order: 1_

_http\_authenticator:_

_type: basic_

_challenge: false_

_authentication\_backend:_

_type: ldap_

_config:_

_enable\_ssl: false_

_enable\_start\_tls: false_

_enable\_ssl\_client\_auth: false_

_verify\_hostnames: false_

_hosts:_

_- [ragsr01-vm89188.myad.com:389](http://ragsr01-vm89188.myad.com:389)_

_bind\_dn: CN=Administrator,CN=Users,DC=myad,DC=com_

_# bind\_dn: CN=elk admin,OU=Users,OU=myOU,DC=myad,DC=com_

_password: ‘xxxxx’_

_userbase: OU=Users,OU=myou,DC=myad,DC=com_

_usersearch: ‘(sAMAccountName={0})’_

_username\_attribute: null_

_authz:_

_ldap:_

_enabled: true_

_authorization\_backend:_

_type: ldap_

_config:_

_enable\_ssl: false_

_enable\_start\_tls: false_

_enable\_ssl\_client\_auth: false_

_verify\_hostnames: false_

_hosts:_

_- [ragsr01-vm89188.myad.com:389](http://ragsr01-vm89188.myad.com:389)_

_bind\_dn: null_

_password: null_

_rolebase: “DC=myad,DC=com”_

_rolesearch: ‘(member={0})’_

_userroleattribute: null_

_userrolename: disabled_

_rolename: cn_

_resolve\_nested\_roles: true_

_rolesearch\_enabled: true_

_sg\_roles.yml I have the following group created_

_#Role for myorg_

_agrouprole:_

_cluster:_

_- all_

_indices:_

_‘atest-\*’:_

_‘\*’:_

_- ‘\*’_

_egrouprole:_

_cluster:_

_- all_

_indices:_

_‘etest-\*’:_

_‘\*’:_

_- ‘\*’_

_misc:_

_cluster:_

_- indices:admin/template/get_

_- indices:admin/template/put_

_indices:_

_‘misclogs\*’:_

_‘\*’:_

_- CRUD_

_- CREATE\_INDEX_

_sg\_roles\_mapping.yml has the following._

_agrouprole:_

_backendroles:_

_- agroup_

_eventeslog:_

_users:_

_- ‘CN=eventlog,OU=Users,OU=myou,DC=cmapps,DC=com’_

When I login with auser who is part of the agroup, the following line is printed in the log, infact the same line is printed for the bindDN user when I run the sg\_admin.

[2017-12-15T13:39:31,283][ERROR][c.f.s.a.BackendRegistry] Problems retrieving roles for User [name=CN=auser,_OU=Users,OU=myou,DC=myad,DC=com_, roles=] from class com.floragunn.dlic.auth.ldap.backend.LDAPAuthorizationBackend

I think the above error is not fetching the backend roles due to which the SG is not able to assign the correct rights. Any pointer on how to fix this issue.

Thanks,

Sreekanth

---

<div class="post-metadata">

**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\
**Post date:** [December 15, 2017, 7:19pm UTC](https://forum.search-guard.com/t/ldap-ad-authorization-against-groups-not-working/710/2 "2017-12-15T19:19:17Z")

</div>

To pinpoint the problem you need to set the log level to debug first, otherwise, we can’t help you. How to set the log level to debug for 5.x:

> **[Search Guard Documentation 404](https://docs.search-guard.com/latest/404.html)**
>
> Seems like the page you are looking for does not exist. We deeply and humbly apologize.

Please set the log level, restart the node, try to log in with your “auser” and then post the debug logs here.

> **···**
>
> On Friday, December 15, 2017 at 3:18:57 PM UTC+1, [ragisreekanth@gmail.com](mailto:ragisreekanth@gmail.com) wrote:
> 
> > When asking questions, please provide the following information:
> 
> > - Search Guard and Elasticsearch version: **search-guard-5**
> 
> > - Installed and used enterprise modules, if any :
> 
> > - JVM version and operating system version: 1.8.0\_141 on CentOS 7.4
> 
> > - Search Guard configuration files:
> 
> > - Elasticsearch log messages on debug level:
> 
> > - Other installed Elasticsearch or Kibana plugins, if any
> 
> > 
> 
> > 
> 
> > We are doing a POC evaluation SearchGuard for authentication/Authorization against AD. We are currently stuck with this issue with SG not being able to do group based authorization.
> 
> > 
> 
> > Scenario
> 
> > We have ES and Kibana running 5.4.1 with SearchGuard installed and running fine. We have a couple of indices like atest and etest and we are trying to authorize 2 users to each of these index via an AD group and have been unsuccessful at it.
> 
> > 
> 
> > We have an user created atest and a group agroup, similarly etest and egroup, We are using agroup to assign atest index to the atest user. But when we do that we are seeing the following error in ES logs. We tried to setup debug but we did not get the correct documentation on how to setup the debug so we do not have the debug logs. Our config files look as following.
> 
> > 
> 
> > 
> 
> > _sg\_config.yml_
> 
> > _searchguard:_
> 
> > _dynamic:_
> 
> > _authc:_
> 
> > _ldap:_
> 
> > _enabled: true_
> 
> > _order: 1_
> 
> > _http\_authenticator:_
> 
> > _type: basic_
> 
> > _challenge: false_
> 
> > _authentication\_backend:_
> 
> > _type: ldap_
> 
> > _config:_
> 
> > _enable\_ssl: false_
> 
> > _enable\_start\_tls: false_
> 
> > _enable\_ssl\_client\_auth: false_
> 
> > _verify\_hostnames: false_
> 
> > _hosts:_
> 
> > _- [ragsr01-vm89188.myad.com:389](http://ragsr01-vm89188.myad.com:389)_
> 
> > _bind\_dn: CN=Administrator,CN=Users,DC=myad,DC=com_
> 
> > _# bind\_dn: CN=elk admin,OU=Users,OU=myOU,DC=myad,DC=com_
> 
> > _password: ‘xxxxx’_
> 
> > _userbase: OU=Users,OU=myou,DC=myad,DC=com_
> 
> > _usersearch: ‘(sAMAccountName={0})’_
> 
> > _username\_attribute: null_
> 
> > _authz:_
> 
> > _ldap:_
> 
> > _enabled: true_
> 
> > _authorization\_backend:_
> 
> > _type: ldap_
> 
> > _config:_
> 
> > _enable\_ssl: false_
> 
> > _enable\_start\_tls: false_
> 
> > _enable\_ssl\_client\_auth: false_
> 
> > _verify\_hostnames: false_
> 
> > _hosts:_
> 
> > _- [ragsr01-vm89188.myad.com:389](http://ragsr01-vm89188.myad.com:389)_
> 
> > _bind\_dn: null_
> 
> > _password: null_
> 
> > _rolebase: “DC=myad,DC=com”_
> 
> > _rolesearch: ‘(member={0})’_
> 
> > _userroleattribute: null_
> 
> > _userrolename: disabled_
> 
> > _rolename: cn_
> 
> > _resolve\_nested\_roles: true_
> 
> > _rolesearch\_enabled: true_
> 
> > _sg\_roles.yml I have the following group created_
> 
> > _#Role for myorg_
> 
> > _agrouprole:_
> 
> > _cluster:_
> 
> > _- all_
> 
> > _indices:_
> 
> > _‘atest-\*’:_
> 
> > _‘\*’:_
> 
> > _- ‘\*’_
> 
> > _egrouprole:_
> 
> > _cluster:_
> 
> > _- all_
> 
> > _indices:_
> 
> > _‘etest-\*’:_
> 
> > _‘\*’:_
> 
> > _- ‘\*’_
> 
> > _misc:_
> 
> > _cluster:_
> 
> > _- indices:admin/template/get_
> 
> > _- indices:admin/template/put_
> 
> > _indices:_
> 
> > _‘misclogs\*’:_
> 
> > _‘\*’:_
> 
> > _- CRUD_
> 
> > _- CREATE\_INDEX_
> 
> > 
> 
> > _sg\_roles\_mapping.yml has the following._
> 
> > _agrouprole:_
> 
> > _backendroles:_
> 
> > _- agroup_
> 
> > _eventeslog:_
> 
> > _users:_
> 
> > _- ‘CN=eventlog,OU=Users,OU=myou,DC=cmapps,DC=com’_
> 
> > 
> 
> > 
> 
> > When I login with auser who is part of the agroup, the following line is printed in the log, infact the same line is printed for the bindDN user when I run the sg\_admin.
> 
> > [2017-12-15T13:39:31,283][ERROR][c.f.s.a.BackendRegistry] Problems retrieving roles for User [name=CN=auser,_OU=Users,OU=myou,DC=myad,DC=com_, roles=] from class com.floragunn.dlic.auth.ldap.backend.LDAPAuthorizationBackend
> 
> > 
> 
> > I think the above error is not fetching the backend roles due to which the SG is not able to assign the correct rights. Any pointer on how to fix this issue.
> 
> > 
> 
> > Thanks,
> 
> > Sreekanth
> 
> > 
> 
> >

---

<div class="post-metadata">

**Author:** ![Sreekanth](https://avatars.discourse-cdn.com/v4/letter/s/e47774/32.png) [@Sreekanth](https://forum.search-guard.com/u/Sreekanth)\
**Post date:** [December 19, 2017, 9:02am UTC](https://forum.search-guard.com/t/ldap-ad-authorization-against-groups-not-working/710/3 "2017-12-19T09:02:30Z")

</div>

Hi Jochen

I was able to get the correct process for setting the logs to debug, once I did that was able to figure out the probem. It was being caused as for authorization queries we were not sending any bind\_dn. Once that was provided, it started working. Thanks for your support.

Thanks,

Sreekanth

> **···**
>
> On Friday, December 15, 2017 at 7:48:57 PM UTC+5:30, [ragisr...@gmail.com](mailto:ragisr...@gmail.com) wrote:
> 
> > When asking questions, please provide the following information:
> 
> > - Search Guard and Elasticsearch version: **search-guard-5**
> 
> > - Installed and used enterprise modules, if any :
> 
> > - JVM version and operating system version: 1.8.0\_141 on CentOS 7.4
> 
> > - Search Guard configuration files:
> 
> > - Elasticsearch log messages on debug level:
> 
> > - Other installed Elasticsearch or Kibana plugins, if any
> 
> > 
> 
> > 
> 
> > We are doing a POC evaluation SearchGuard for authentication/Authorization against AD. We are currently stuck with this issue with SG not being able to do group based authorization.
> 
> > 
> 
> > Scenario
> 
> > We have ES and Kibana running 5.4.1 with SearchGuard installed and running fine. We have a couple of indices like atest and etest and we are trying to authorize 2 users to each of these index via an AD group and have been unsuccessful at it.
> 
> > 
> 
> > We have an user created atest and a group agroup, similarly etest and egroup, We are using agroup to assign atest index to the atest user. But when we do that we are seeing the following error in ES logs. We tried to setup debug but we did not get the correct documentation on how to setup the debug so we do not have the debug logs. Our config files look as following.
> 
> > 
> 
> > 
> 
> > _sg\_config.yml_
> 
> > _searchguard:_
> 
> > _dynamic:_
> 
> > _authc:_
> 
> > _ldap:_
> 
> > _enabled: true_
> 
> > _order: 1_
> 
> > _http\_authenticator:_
> 
> > _type: basic_
> 
> > _challenge: false_
> 
> > _authentication\_backend:_
> 
> > _type: ldap_
> 
> > _config:_
> 
> > _enable\_ssl: false_
> 
> > _enable\_start\_tls: false_
> 
> > _enable\_ssl\_client\_auth: false_
> 
> > _verify\_hostnames: false_
> 
> > _hosts:_
> 
> > _- [ragsr01-vm89188.myad.com:389](http://ragsr01-vm89188.myad.com:389)_
> 
> > _bind\_dn: CN=Administrator,CN=Users,DC=myad,DC=com_
> 
> > _# bind\_dn: CN=elk admin,OU=Users,OU=myOU,DC=myad,DC=com_
> 
> > _password: ‘xxxxx’_
> 
> > _userbase: OU=Users,OU=myou,DC=myad,DC=com_
> 
> > _usersearch: ‘(sAMAccountName={0})’_
> 
> > _username\_attribute: null_
> 
> > _authz:_
> 
> > _ldap:_
> 
> > _enabled: true_
> 
> > _authorization\_backend:_
> 
> > _type: ldap_
> 
> > _config:_
> 
> > _enable\_ssl: false_
> 
> > _enable\_start\_tls: false_
> 
> > _enable\_ssl\_client\_auth: false_
> 
> > _verify\_hostnames: false_
> 
> > _hosts:_
> 
> > _- [ragsr01-vm89188.myad.com:389](http://ragsr01-vm89188.myad.com:389)_
> 
> > _bind\_dn: null_
> 
> > _password: null_
> 
> > _rolebase: “DC=myad,DC=com”_
> 
> > _rolesearch: ‘(member={0})’_
> 
> > _userroleattribute: null_
> 
> > _userrolename: disabled_
> 
> > _rolename: cn_
> 
> > _resolve\_nested\_roles: true_
> 
> > _rolesearch\_enabled: true_
> 
> > _sg\_roles.yml I have the following group created_
> 
> > _#Role for myorg_
> 
> > _agrouprole:_
> 
> > _cluster:_
> 
> > _- all_
> 
> > _indices:_
> 
> > _‘atest-\*’:_
> 
> > _‘\*’:_
> 
> > _- ‘\*’_
> 
> > _egrouprole:_
> 
> > _cluster:_
> 
> > _- all_
> 
> > _indices:_
> 
> > _‘etest-\*’:_
> 
> > _‘\*’:_
> 
> > _- ‘\*’_
> 
> > _misc:_
> 
> > _cluster:_
> 
> > _- indices:admin/template/get_
> 
> > _- indices:admin/template/put_
> 
> > _indices:_
> 
> > _‘misclogs\*’:_
> 
> > _‘\*’:_
> 
> > _- CRUD_
> 
> > _- CREATE\_INDEX_
> 
> > 
> 
> > _sg\_roles\_mapping.yml has the following._
> 
> > _agrouprole:_
> 
> > _backendroles:_
> 
> > _- agroup_
> 
> > _eventeslog:_
> 
> > _users:_
> 
> > _- ‘CN=eventlog,OU=Users,OU=myou,DC=cmapps,DC=com’_
> 
> > 
> 
> > 
> 
> > When I login with auser who is part of the agroup, the following line is printed in the log, infact the same line is printed for the bindDN user when I run the sg\_admin.
> 
> > [2017-12-15T13:39:31,283][ERROR][c.f.s.a.BackendRegistry] Problems retrieving roles for User [name=CN=auser,_OU=Users,OU=myou,DC=myad,DC=com_, roles=] from class com.floragunn.dlic.auth.ldap.backend.LDAPAuthorizationBackend
> 
> > 
> 
> > I think the above error is not fetching the backend roles due to which the SG is not able to assign the correct rights. Any pointer on how to fix this issue.
> 
> > 
> 
> > Thanks,
> 
> > Sreekanth
> 
> > 
> 
> >