# LDAP Roles not mapping correctly
**URL:** https://forum.search-guard.com/t/ldap-roles-not-mapping-correctly/285
**Category:** Search Guard
**Created:** [September 24, 2016, 9:58pm UTC](https://forum.search-guard.com/t/ldap-roles-not-mapping-correctly/285 "2016-09-24T21:58:53Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@zohaib\_butt](https://forum.search-guard.com/u/zohaib_butt)
#### Post date: [September 24, 2016, 9:58pm UTC](https://forum.search-guard.com/t/ldap-roles-not-mapping-correctly/285/1 "2016-09-24T21:58:53Z")
Hey Guys,
I have been beating my head trying to figure this out… My user roles don’t seem to be mapped to seach guard roles. Using Microsft active directory for authentication.
ES Version: 2.4.0
Elasticsearch log:
> \_\_[2016-09-24 21:46:13,782][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] Try to extract auth creds from http basic
> [2016-09-24 21:46:13,785][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] User ‘test2’ is in cache? false (cache size: 0)
> [2016-09-24 21:46:13,786][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] test2 not cached, return from ldap backend directly
> [2016-09-24 21:46:13,801][DEBUG][com.floragunn.dlic.auth.ldap.backend.LDAPAuthorizationBackend] bindDn CN=Test Account,CN=Users,DC=ute-dev,DC=rci,DC=test,DC=com, password \*\*\*\*
> [2016-09-24 21:46:13,846][DEBUG][com.floragunn.dlic.auth.ldap.backend.LDAPAuthenticationBackend] Authenticated username CN=test 2,CN=Users,DC=ute-dev,DC=rci,DC=test,DC=com
> [2016-09-24 21:46:13,851][DEBUG][com.floragunn.dlic.auth.ldap.backend.LDAPAuthorizationBackend] bindDn CN=Test Account,CN=Users,DC=ute-dev,DC=rci,DC=test,DC=com, password \*\*\*\*
> [2016-09-24 21:46:13,887][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] User ‘User [name=CN=test 2,CN=Users,DC=ute-dev,DC=rci,DC=test,DC=com, roles=[Elasticsearch\_Admin]]’ is authenticated
> [2016-09-24 21:46:13,889][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] evaluate permissions for User [name=CN=test 2,CN=Users,DC=ute-dev,DC=rci,DC=test,DC=com, roles=[Elasticsearch\_Admin]]
> [2016-09-24 21:46:13,889][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested cluster:monitor/health from 70.50.56.161:61884
> [2016-09-24 21:46:13,889][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Resolve from class org.elasticsearch.action.admin.cluster.health.ClusterHealthRequest
> [2016-09-24 21:46:13,890][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] indicesOptions IndicesOptions[id=7, ignore\_unavailable=true, allow\_no\_indices=true, expand\_wildcards\_open=true, expand\_wildcards\_closed=false, allow\_alisases\_to\_multiple\_indices=
> true, forbid\_closed\_indices=false]
> [2016-09-24 21:46:13,890][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] raw indices
> [2016-09-24 21:46:13,890][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] No indices found in request, assume \_all
> [2016-09-24 21:46:13,890][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested resolved aliases and indices: [searchguard]
> [2016-09-24 21:46:13,890][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested resolved types: [_all]
> [2016-09-24 21:46:13,892][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] mapped roles: []
> [2016-09-24 21:46:13,892][INFO][com.floragunn.searchguard.configuration.PrivilegesEvaluator] No perm match for cluster:monitor/health and []
> [2016-09-24 21:46:13,893][DEBUG][com.floragunn.searchguard.filter.SearchGuardFilter] no permissions for cluster:monitor/health
> [2016-09-24 21:46:13,894][DEBUG][rest.suppressed] path: /cluster/health, params: {pretty=true}
> ElasticsearchSecurityException[no permissions for cluster:monitor/health]
> at com.floragunn.searchguard.filter.SearchGuardFilter.apply(SearchGuardFilter.java:164)
> at org.elasticsearch.action.support.TransportAction$RequestFilterChain.proceed(TransportAction.java:170)
> at org.elasticsearch.action.support.TransportAction.execute(TransportAction.java:144)
> at org.elasticsearch.action.support.TransportAction.execute(TransportAction.java:85)
> at org.elasticsearch.client.node.NodeClient.doExecute(NodeClient.java:58)
> at org.elasticsearch.client.support.AbstractClient.execute(AbstractClient.java:359)
> at org.elasticsearch.client.FilterClient.doExecute(FilterClient.java:52)
> at org.elasticsearch.rest.BaseRestHandler$HeadersAndContextCopyClient.doExecute(BaseRestHandler.java:88)
> at org.elasticsearch.client.support.AbstractClient.execute(AbstractClient.java:359)
> at org.elasticsearch.client.support.AbstractClient$ClusterAdmin.execute(AbstractClient.java:853)
> at org.elasticsearch.client.support.AbstractClient$ClusterAdmin.health(AbstractClient.java:873)
> at org.elasticsearch.rest.action.admin.cluster.health.RestClusterHealthAction.handleRequest(RestClusterHealthAction.java:62)
> at org.elasticsearch.rest.BaseRestHandler.handleRequest(BaseRestHandler.java:54)
> at org.elasticsearch.rest.RestController.executeHandler(RestController.java:198)
> at org.elasticsearch.rest.RestController$RestHandlerFilter.process(RestController.java:280)
> at org.elasticsearch.rest.RestController$ControllerFilterChain.continueProcessing(RestController.java:261)
> at com.floragunn.searchguard.filter.SearchGuardRestFilter.process(SearchGuardRestFilter.java:65)
> at org.elasticsearch.rest.RestController$ControllerFilterChain.continueProcessing(RestController.java:264)
> at org.elasticsearch.rest.RestController.dispatchRequest(RestController.java:161)
> at org.elasticsearch.http.HttpServer.internalDispatchRequest(HttpServer.java:153)
> at org.elasticsearch.http.HttpServer$Dispatcher.dispatchRequest(HttpServer.java:101)
> at org.elasticsearch.http.netty.NettyHttpServerTransport.dispatchRequest(NettyHttpServerTransport.java:451)
> at com.floragunn.searchguard.ssl.http.netty.SearchGuardSSLNettyHttpServerTransport.dispatchRequest(SearchGuardSSLNettyHttpServerTransport.java:159)
> at org.elasticsearch.http.netty.HttpRequestHandler.messageReceived(HttpRequestHandler.java:61)
> at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)
> at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)
> at org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791)
> at org.elasticsearch.http.netty.pipelining.HttpPipeliningHandler.messageReceived(HttpPipeliningHandler.java:60)
> at org.jboss.netty.channel.SimpleChannelHandler.handleUpstream(SimpleChannelHandler.java:88)
> at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)
> at org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791)
> at org.jboss.netty.handler.codec.http.HttpChunkAggregator.messageReceived(HttpChunkAggregator.java:145)
> at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)
> at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)
> at org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791)
> at org.jboss.netty.handler.codec.http.HttpContentDecoder.messageReceived(HttpContentDecoder.java:108)
> at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)
> at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)
> at org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791)
> at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:296)
> at org.jboss.netty.handler.codec.frame.FrameDecoder.unfoldAndFireMessageReceived(FrameDecoder.java:459)
> at org.jboss.netty.handler.codec.replay.ReplayingDecoder.callDecode(ReplayingDecoder.java:536)
> at org.jboss.netty.handler.codec.replay.ReplayingDecoder.messageReceived(ReplayingDecoder.java:435)
> at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)
> at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)
> at org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791)
> at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:296)
> at org.jboss.netty.handler.codec.frame.FrameDecoder.unfoldAndFireMessageReceived(FrameDecoder.java:459)
> at org.jboss.netty.handler.codec.replay.ReplayingDecoder.callDecode(ReplayingDecoder.java:536)
> at org.jboss.netty.handler.codec.replay.ReplayingDecoder.messageReceived(ReplayingDecoder.java:435)
> at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)
> at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)
> at org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791)
> at org.elasticsearch.common.netty.OpenChannelsHandler.handleUpstream(OpenChannelsHandler.java:75)
> at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)
> at org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791)
> at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:296)
> at org.jboss.netty.handler.codec.frame.FrameDecoder.unfoldAndFireMessageReceived(FrameDecoder.java:462)
> at org.jboss.netty.handler.codec.frame.FrameDecoder.callDecode(FrameDecoder.java:443)
> at org.jboss.netty.handler.codec.frame.FrameDecoder.messageReceived(FrameDecoder.java:303)
> at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)
> at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)
> at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:559)
> at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:268)
> at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:255)
> at org.jboss.netty.channel.socket.nio.NioWorker.read(NioWorker.java:88)
> at org.jboss.netty.channel.socket.nio.AbstractNioWorker.process(AbstractNioWorker.java:108)
> at org.jboss.netty.channel.socket.nio.AbstractNioSelector.run(AbstractNioSelector.java:337)
> at org.jboss.netty.channel.socket.nio.AbstractNioWorker.run(AbstractNioWorker.java:89)
> at org.jboss.netty.channel.socket.nio.NioWorker.run(NioWorker.java:178)
> at org.jboss.netty.util.ThreadRenamingRunnable.run(ThreadRenamingRunnable.java:108)
> at org.jboss.netty.util.internal.DeadLockProofWorker$1.run(DeadLockProofWorker.java:42)
> at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
> at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
> at java.lang.Thread.run(Thread.java:745)_
My Sg Configs are the following
_sg\_role.yml:_
> **searchguard:
> dynamic:
> http:
> anonymous\_auth\_enabled: false
> authc:
> ldap:
> enabled: true
> order: 5
> http\_authenticator:
> type: “basic”
> challenge: true
> authentication\_backend:
> type: “ldap”
> config:
> enable\_ssl: false
> enable\_start\_tls: false
> enable\_ssl\_client\_auth: false
> verify\_hostnames: false
> hosts:
> - “172.31.55.166:389”
> - “172.31.43.140:389”
> bind\_dn: “CN=Test Account,CN=Users,DC=ute-dev,DC=rci,DC=test,DC=com”
> password: “XXXXX”
> userbase: “CN=Users,DC=ute-dev,DC=rci,DC=test,DC=com”
> authz:
> roles\_from\_myldap:
> enabled: true
> authorization\_backend:
> type: “ldap”
> config:
> enable\_ssl: false
> enable\_start\_tls: false
> enable\_ssl\_client\_auth: false
> verify\_hostnames: true
> hosts:
> - “172.31.55.166:389”
> - “172.31.43.140:389”
> bind\_dn: “CN=Test Account,CN=Users,DC=ute-dev,DC=rci,DC=test,DC=com”
> password: “XXXXX”
> rolebase: “CN=Users,DC=ute-dev,DC=rci,DC=test,DC=com”
> rolesearch: “(uniqueMember={0})”
> userroleattribute: null
> userrolename: “memberOf”
> rolename: “CN”
> resolve\_nested\_roles: true
> userbase: “CN=Users,DC=ute-dev,DC=rci,DC=test,DC=com”
> usersearch: “(uid={0})”**
\*\* I added some additional roles for testing purposes… not sure the correct format etc… was trying to follow documentation
_sg\_role:_
> \_\_sg\_all\_access:
> cluster:
>
> - "_"
> indices:
> '_':
> ‘\*’:
> - “\*”
> - “ALL”
> sg\_readall:
> cluster:
>
> - “CLUSTER\_ALL”
> indices:
> ‘_':
> '_’:
> - “READ”
> sg\_kibana4:
> cluster:
>
> - “CLUSTER\_ALL”
> indices:
> ‘_':
> '_’:
> - “READ”
> - “indices:admin/mappings/fields/get\*”
> - “indices:admin/validate/query\*”
> - “indices:admin/get\*”
> ?kibana:
> ‘\*’:
> - “ALL”
> Elasticsearch\_Admin:
> cluster:
>
> - "_"
> indices:
> '_':
> ‘\*’:
> - “\*”
> - “ALL”
> sg\_Elasticsearch\_Admin:
> cluster:
>
> - "_"
> indices:
> '_':
> ‘\*’:
> - “\*”
> - “ALL”
> sg\_role\_Elasticsearch\_Admin:
> cluster:
>
> - "_"
> indices:
> '_':
> ‘\*’:
> - “\*”
> - “ALL” \_\_
\*\*\* more trial/test configs… not sure the correct method
_sg\_role\_mapping_
> \*\*sg\_kibana4:
> backendroles:
>
> - “CN=Elasticsearch\_Kibana,CN=Users,DC=ute-dev,DC=rci,DC=test,DC=com”
> roles\_from\_myldap:
> - “CN=Elasticsearch\_Kibana,CN=Users,DC=ute-dev,DC=rci,DC=test,DC=com”
> sg\_all\_access:
> backendroles:
> - “CN=Elasticsearch\_Admin,CN=Users,DC=ute-dev,DC=rci,DC=test,DC=com”
> roles\_from\_myldap:
> - “CN=Elasticsearch\_Admin,CN=Users,DC=ute-dev,DC=rci,DC=test,DC=com”
> sg\_readall:
> backendroles:
> - “CN=Elasticsearch\_ReadOnly,CN=Users,DC=ute-dev,DC=rci,DC=test,DC=com”
> roles\_from\_myldap:
> - “CN=Elasticsearch\_ReadOnly,CN=Users,DC=ute-dev,DC=rci,DC=test,DC=com”
> Elasticsearch\_Admin:
> backendroles:
> - “CN=Elasticsearch\_Admin,CN=Users,DC=ute-dev,DC=rci,DC=test,DC=com”
> roles\_from\_myldap:
> - “CN=Elasticsearch\_Admin,CN=Users,DC=ute-dev,DC=rci,DC=test,DC=com”
> sg\_Elasticsearch\_Admin:
> backendroles:
> - “CN=Elasticsearch\_Admin,CN=Users,DC=ute-dev,DC=rci,DC=test,DC=com”
> roles\_from\_myldap:
> - “CN=Elasticsearch\_Admin,CN=Users,DC=ute-dev,DC=rci,DC=test,DC=com”
> sg\_role\_Elasticsearch\_Admin:
> backendroles:
> - “CN=Elasticsearch\_Admin,CN=Users,DC=ute-dev,DC=rci,DC=test,DC=com”
> roles\_from\_myldap:
> - “CN=Elasticsearch\_Admin,CN=Users,DC=ute-dev,DC=rci,DC=test,DC=com”\*\*
I am completely dumbfounded on why this is not working. In the logs you can see that it detects the role but not sure why it doesn’t map. Any help would be greatly appreciated.
Thanks
---
### Author:  [@zohaib\_butt](https://forum.search-guard.com/u/zohaib_butt)
#### Post date: [September 24, 2016, 10:43pm UTC](https://forum.search-guard.com/t/ldap-roles-not-mapping-correctly/285/2 "2016-09-24T22:43:47Z")
Looks like i manged to figure it out. The documentation is not clear at all but i chaned my sg\_role\_mapping.yml to the following
> **sg\_kibana4:
> backendroles:
> - Elasticsearch\_Kibana
> sg\_all\_access:
> backendroles:
> - Elasticsearch\_Admin
> sg\_readall:
> backendroles:
> - Elasticsearch\_ReadOnly**
“Elastsearch\_Admin” etc are the actual security group names that are being pulled from my LDAP. I think we should make this more clear for the LDAP Documentation… it was very confusing and a lot of trail and error to figure it out.
---
### Author:  [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)
#### Post date: [September 27, 2016, 1:54pm UTC](https://forum.search-guard.com/t/ldap-roles-not-mapping-correctly/285/3 "2016-09-27T13:54:36Z")
Hi - thanks for your input, and glad it worked out for you. Can you please elaborate a bit on which parts of the documentation are confusing, so we can rework and improve it?
Thanks!
> **···**
>
> On Sunday, 25 September 2016 00:43:47 UTC+2, zohaib butt wrote:
>
> > Looks like i manged to figure it out. The documentation is not clear at all but i chaned my sg\_role\_mapping.yml to the following
>
> > > **sg\_kibana4:
> > > backendroles:
> > > - Elasticsearch\_Kibana
> > > sg\_all\_access:
> > > backendroles:
> > > - Elasticsearch\_Admin
> > > sg\_readall:
> > > backendroles:
> > > - Elasticsearch\_ReadOnly**
>
> >
>
> > “Elastsearch\_Admin” etc are the actual security group names that are being pulled from my LDAP. I think we should make this more clear for the LDAP Documentation… it was very confusing and a lot of trail and error to figure it out.
>
> >