# REST API: creation of user with role does not update rolesmapping

**URL:** <https://forum.search-guard.com/t/rest-api-creation-of-user-with-role-does-not-update-rolesmapping/1485>\
**Category:** Search Guard\
**Created:** [May 9, 2019, 2:53pm UTC](https://forum.search-guard.com/t/rest-api-creation-of-user-with-role-does-not-update-rolesmapping/1485 "2019-05-09T14:53:36Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![itudoben](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/itudoben/32/513_2.png) [@itudoben](https://forum.search-guard.com/u/itudoben)\
**Post date:** [May 9, 2019, 2:53pm UTC](https://forum.search-guard.com/t/rest-api-creation-of-user-with-role-does-not-update-rolesmapping/1485/1 "2019-05-09T14:53:36Z")

</div>

Hi,  
this is on ES 6.5.4 and SG 24.1.

I have the admin:password user with sg\_all\_access role.  
I used it to create a user with role sg\_all\_access. When I check the user it exists:

$ curl -k -uadmin:password [https://localhost:33533/\_searchguard/api/user/tony\_stark\_1550230687](https://localhost:33533/_searchguard/api/user/tony_stark_1550230687)  
{  
“tony\_stark\_1550230687”: {  
“roles”: [  
“sg\_all\_access”  
],  
“hash”: “”  
}  
}

I then run this query thinking Tony Stark can run anything - he is Ironman after all 😉

$ curl -k -utony\_stark\_1550230687:2090203225 [https://localhost:33533/index1/\_search?pretty](https://localhost:33533/index1/_search?pretty)  
{  
“error” : {  
“root\_cause” : [  
{  
“type” : “security\_exception”,  
“reason” : “no permissions for [indices:data/read/search] and User [name=tony\_stark\_1550230687, roles=[sg\_all\_access], requestedTenant=null]”  
}  
],  
“type” : “security\_exception”,  
“reason” : “no permissions for [indices:data/read/search] and User [name=tony\_stark\_1550230687, roles=[sg\_all\_access], requestedTenant=null]”  
},  
“status” : 403  
}

So I’m surprised!! It’s Tony with sg\_all\_access and he cannot access `indices:data/read/search`?!?!

Then I check the roles mapping, indeed tony stark is not listed in there:

$ curl -k -uadmin:password [https://localhost:33533/\_searchguard/api/rolesmapping?pretty](https://localhost:33533/_searchguard/api/rolesmapping?pretty)  
{  
“sg\_all\_access” : {  
“users” : [  
“admin”  
]  
}  
}

But I created Tony with sg\_all\_access role, is this the normal behavior?  
It looks to me not … what did I miss?

The documentation does not say anything about having to patch the rolesmapping after user creation with the RESP API:

> **[Internal users API](https://docs.search-guard.com/6.x-24/rest-api-internalusers#PUT)**
>
> How to use the users REST API endpoints to create, update and delete Search Guard users.

Anyways, now I PATCH the rolesmapping:  
curl -X PATCH -k -uadmin:password [https://localhost:33533/\_searchguard/api/rolesmapping/sg\_all\_access](https://localhost:33533/_searchguard/api/rolesmapping/sg_all_access) -H “Content-type: application/json” -d ’  
[{“op”: “replace”, “path”: “/users”, “value”: [“admin”, “tony\_stark\_1550230687"]}]’

Check the rolesmapping and this time Tony is there:  
$ curl -k -uadmin:password [https://localhost:33533/\_searchguard/api/rolesmapping?pretty](https://localhost:33533/_searchguard/api/rolesmapping?pretty)  
{  
“sg\_all\_access” : {  
“users” : [  
“admin”,  
“tony\_stark\_1550230687”  
]  
}}

And sure enough Tony Stark can now search indices:  
$ curl -k -utony\_stark\_1550230687:2090203225 [https://localhost:33533/index1/\_search?pretty](https://localhost:33533/index1/_search?pretty)  
{  
“took” : 5,  
“timed\_out” : false,  
“\_shards” : {  
“total” : 5,  
“successful” : 5,  
“skipped” : 0,  
“failed” : 0  
},  
“hits” : {  
“total” : 2,  
“max\_score” : 1.0,  
“hits” : [  
{  
“\_index” : “index1”,  
“\_type” : “\_doc”,  
“\_id” : “0”,  
“\_score” : 1.0,  
“\_source” : {  
“id” : 0  
}  
},  
{  
“\_index” : “index1”,  
“\_type” : “\_doc”,  
“\_id” : “1”,  
“\_score” : 1.0,  
“\_source” : {  
“id” : 1  
}  
}  
]  
}  
}

PS:  
There is also an error in the doc concerning the return message after the creation of a user.

// SG doc says one thing and in fact the API returns something else.  
// [Internal users REST API endpoints | Elasticsearch Security | Search Guard](https://docs.search-guard.com/6.x-24/rest-api-internalusers)  
// This should be the return message according to the doc:  
// withJsonPath(“message”, equalTo(“User $userName created”.toString())),

// This is what SG 24.1 in fact returns:  
withJsonPath(“message”, equalTo(“‘$userName’ created.”.toString())),

---

<div class="post-metadata">

**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\
**Post date:** [May 10, 2019, 1:39pm UTC](https://forum.search-guard.com/t/rest-api-creation-of-user-with-role-does-not-update-rolesmapping/1485/2 "2019-05-10T13:39:03Z")

</div>

The confusion here probably stems from a very unfortunate naming decision in SG6 (which has been corrected in SG7).

The default in SG6 is that we will always apply the roles mapping in order to map users to roles. This also affects the internal user database. The confusion comes from the “roles” key in the internal users configuration:

So this output here:

```
$ curl -k -uadmin:password https://localhost:33533/_searchguard/api/user/tony_stark_1550230687
{
“tony_stark_1550230687”: {
  “roles”: [
     “sg_all_access”
  ],
  “hash”: “”
 }
}

```

means that your user tony\_stark\_1550230687 has the **backend\_role** (not SG role!) called “sg\_all\_access”.

As a next step SG would then apply the roles mapping, and since none is there for the user or the backend role, no SG role will be applied.

The roles mapping step is needed especially when you use external authentication, like LDAP, JWT, SAML, Active Directory etc. Admitted, when using the internal user database this step is not really required.

In SG6 you have the option to deactivate the roles mapping. This means you can use SG roles in the internal users file directly:

> **[Role mapping modes](https://docs.search-guard.com/latest/role-mapping-modes)**
>
> Different ways to use the Search Guard role mapping feature to map users, backend roles and hosts to Search Guard roles.

We are also working on a new feature for SG7 which will make it possible to configure SG roles in the internal users file explicitly.

Again, sorry for the confusion here!

---

<div class="post-metadata">

**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\
**Post date:** [May 10, 2019, 1:39pm UTC](https://forum.search-guard.com/t/rest-api-creation-of-user-with-role-does-not-update-rolesmapping/1485/3 "2019-05-10T13:39:12Z")

</div>



---

<div class="post-metadata">

**Author:** ![itudoben](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/itudoben/32/513_2.png) [@itudoben](https://forum.search-guard.com/u/itudoben)\
**Post date:** [May 13, 2019, 5:59am UTC](https://forum.search-guard.com/t/rest-api-creation-of-user-with-role-does-not-update-rolesmapping/1485/4 "2019-05-13T05:59:35Z")

</div>

Thx for clearing out some of the confusion.

So the backend\_roles are checked against the external authentication service,

> The roles mapping step is needed especially when you use external authentication, like LDAP, JWT, SAML, Active Directory etc. Admitted, when using the internal user database this step is not really required.

Here nothing but internal user db is used:

```
searchguard:

```

dynamic:  
respect\_request\_indices\_options: true  
kibana:  
do\_not\_fail\_on\_forbidden: true  
http:  
anonymous\_auth\_enabled: false  
xff:  
enabled: false  
authc:  
transport\_auth\_domain:  
enabled: true  
order: 2  
http\_authenticator:  
type: basic  
authentication\_backend:  
type: internal  
basic\_internal\_auth\_domain:  
enabled: true  
http\_authenticator:  
type: basic  
challenge: true  
authentication\_backend:  
type: internal

Therefore as mentioned in the doc, the rolesmapping should not have been necessary:

> **[Internal users database](https://docs.search-guard.com/6.x-24/internal-users-database)**
>
> How to store and manage Search Guard users directly in Elasticsearch by using the Internal Users Database.

> Search Guard will use the name of the authenticated user to look up the corresponding entry in the internal user database. If found, the configures roles will be assigned as backen roles to this user.

Is `searchguard.roles_mapping_resolution` required to be set to MAPPING\_ONLY or BOTH for `the configures roles will be assigned as backen roles to this user` to work automatically, here the doc does not say so?

Thx 🙂

---

<div class="post-metadata">

**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\
**Post date:** [May 14, 2019, 1:40pm UTC](https://forum.search-guard.com/t/rest-api-creation-of-user-with-role-does-not-update-rolesmapping/1485/5 "2019-05-14T13:40:56Z")

</div>

No quite 😉

- the backend roles for a user are fetched when the user authenticates.
- this happens for every authentication method, like LDAP, OpenID **and also** the internal users DB
- In the next step, the roles mapping kicks in
- SG will map the user to a SG role by using either the username or the backend roles

Say you have the following user definition:

```
myuser:
  hash: ...
  roles: 
    - myrole

```

Here the username is _myuser_, and this user has one backend role, namely _myrole_.

SG then looks at the role mapping configuration. If you want to assign this user to a SG role called sg\_role, in the roles mapping you can use either:

```
sg_role:
  users:
    - myuser

```

or:

```
sg_role:
  backendroles:
    - myuser

```

This is the default behaviour of SG: The role mapping is mandatory, regardless what authentication type you use.

You can change this behavior by setting:

```auto
searchguard.roles_mapping_resolution: BACKENDROLES_ONLY

```

or

```auto
searchguard.roles_mapping_resolution: BOTH

```

In this case you can use a SG role in your internal users definition directly, and forget about the roles mapping altogether:

```
myuser:
  hash: ...
  roles: 
    - sg_role

```

---

<div class="post-metadata">

**Author:** ![itudoben](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/itudoben/32/513_2.png) [@itudoben](https://forum.search-guard.com/u/itudoben)\
**Post date:** [May 16, 2019, 6:36am UTC](https://forum.search-guard.com/t/rest-api-creation-of-user-with-role-does-not-update-rolesmapping/1485/6 "2019-05-16T06:36:32Z")

</div>

Thx for the clarification.  
Best,  
Johnny

---

<div class="post-metadata">

**Author:** ![system](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/system/32/1870_2.png) [@system](https://forum.search-guard.com/u/system)\
**Post date:** [June 6, 2019, 6:36am UTC](https://forum.search-guard.com/t/rest-api-creation-of-user-with-role-does-not-update-rolesmapping/1485/7 "2019-06-06T06:36:33Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.