# Search guard certificate based user role mapping issue **URL:** \ **Category:** Search Guard\ **Created:** [December 31, 2018, 4:35pm UTC](https://forum.search-guard.com/t/search-guard-certificate-based-user-role-mapping-issue/1263 "2018-12-31T16:35:09Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![nisham](https://avatars.discourse-cdn.com/v4/letter/n/35a633/32.png) [@nisham](https://forum.search-guard.com/u/nisham)\ **Post date:** [December 31, 2018, 4:35pm UTC](https://forum.search-guard.com/t/search-guard-certificate-based-user-role-mapping-issue/1263/1 "2018-12-31T16:35:09Z")
Hello, - Search Guard version: 5 - Elasticsearch version: 5.6.13 - Operating system: Ubuntu 16.04/ CentOS 6 - Search guard edition: Community - Java version: 1.8 **Issue** The certificate based user role can’t be changed for Java transport client (To restrict java api to delete and write data to Elasticsearch). - Node, Client and Admin (.pem and .key) certificate’s were generated using the Offline TLS tool. Updated “elasticsearch.yml” with the content generated in snippet during the creation of certificate. - New user were addded to “sg\_internal\_users.yml” with hashed password. Over the HTTPS (curl -k -u username:password [https://localhost:9200](https://localhost:9200)) I’m able to alert the user roles and permission to access the Elasticsearch. Using sgadmin I have pushed the configuration changes to search guard. - In the case of transport client with search guard, using java API I’m able to perform indexing, search and delete operation in Elasticsearch with the generated certificate’s. I’m using the admin certificate for the following transport client settings .put(SSLConfigConstants.SEARCHGUARD\_SSL\_TRANSPORT\_PEMKEY\_FILEPATH, “/home/user/sg/certs/example-admin.key”) .put(SSLConfigConstants.SEARCHGUARD\_SSL\_TRANSPORT\_PEMCERT\_FILEPATH, “/home/user/sg/certs/example-admin.pem”) .put(SSLConfigConstants.SEARCHGUARD\_SSL\_TRANSPORT\_PEMTRUSTEDCAS\_FILEPATH, “/home/user/sg/certs/root-ca.pem”) .put(SSLConfigConstants.SEARCHGUARD\_SSL\_TRANSPORT\_ENFORCE\_HOSTNAME\_VERIFICATION, false) .put(“cluster.name”, “sg\_test”).build(); - In order to modify the role of the (example-admin.key) certificate, I have added the certificate DN in “sg\_roles\_mapping.yml” and provided the permission to only read data from Elasticsearch. Using the sgadmin new configuration changes were updated to search guard. The roles are not getting updated for the certificate based user, I’m unable to restrict the java client from indexing or deleting data from Elasticsearch. Please help me to modify the search guard role and permission (certificate based user) for Java transport client. Thanks. ---
**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\ **Post date:** [January 1, 2019, 2:27pm UTC](https://forum.search-guard.com/t/search-guard-certificate-based-user-role-mapping-issue/1263/2 "2019-01-01T14:27:34Z")
Can you post you rolesmapping file? > **···** > > > Am 31.12.2018 um 17:35 schrieb nisham@factweavers.com: > > > > Hello, > > > > \* Search Guard version: 5 > > \* Elasticsearch version: 5.6.13 > > \* Operating system: Ubuntu 16.04/ CentOS 6 > > \* Search guard edition: Community > > \* Java version: 1.8 > > > > \*\*Issue\*\* > > The certificate based user role can't be changed for Java transport client (To restrict java api to delete and write data to Elasticsearch). > > > > \* Node, Client and Admin (.pem and .key) certificate's were generated using the Offline TLS tool. Updated "elasticsearch.yml" with the content generated in snippet during the creation of certificate. > > > > \* New user were addded to "sg\_internal\_users.yml" with hashed password. Over the HTTPS (curl -k -u username:password [https://localhost:9200](https://localhost:9200)) I'm able to alert the user roles and permission to access the Elasticsearch. Using sgadmin I have pushed the configuration changes to search guard. > > > > \* In the case of transport client with search guard, using java API I'm able to perform indexing, search and delete operation in Elasticsearch with the generated certificate's. I'm using the admin certificate for the following transport client settings > > > >   Settings settings = Settings.builder() > >               .put(SSLConfigConstants.SEARCHGUARD\_SSL\_TRANSPORT\_PEMKEY\_FILEPATH, "/home/user/sg/certs/example-admin.key") > >               .put(SSLConfigConstants.SEARCHGUARD\_SSL\_TRANSPORT\_PEMCERT\_FILEPATH, "/home/user/sg/certs/example-admin.pem") > >               .put(SSLConfigConstants.SEARCHGUARD\_SSL\_TRANSPORT\_PEMTRUSTEDCAS\_FILEPATH, "/home/user/sg/certs/root-ca.pem") > >               .put(SSLConfigConstants.SEARCHGUARD\_SSL\_TRANSPORT\_ENFORCE\_HOSTNAME\_VERIFICATION, false) > >               .put("cluster.name", "sg\_test").build(); > > > > \* In order to modify the role of the (example-admin.key) certificate, I have added the certificate DN in "sg\_roles\_mapping.yml" and provided the permission to only read data from Elasticsearch. Using the sgadmin new configuration changes were updated to search guard. > > > > The roles are not getting updated for the certificate based user, I'm unable to restrict the java client from indexing or deleting data from Elasticsearch. > > > > Please help me to modify the search guard role and permission (certificate based user) for Java transport client. > > > > Thanks. > > > > -- > > You received this message because you are subscribed to the Google Groups "Search Guard Community Forum" group. > > To unsubscribe from this group and stop receiving emails from it, send an email to search-guard+unsubscribe@googlegroups.com. > > To post to this group, send email to search-guard@googlegroups.com. > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/601f5639-f59b-4a6e-b909-9b0427d79fec%40googlegroups.com\](https://groups.google.com/d/msgid/search-guard/601f5639-f59b-4a6e-b909-9b0427d79fec%40googlegroups.com%5C). > > For more options, visit [https://groups.google.com/d/optout\](https://groups.google.com/d/optout%5C). ---
**Author:** ![nisham](https://avatars.discourse-cdn.com/v4/letter/n/35a633/32.png) [@nisham](https://forum.search-guard.com/u/nisham)\ **Post date:** [January 2, 2019, 4:27am UTC](https://forum.search-guard.com/t/search-guard-certificate-based-user-role-mapping-issue/1263/3 "2019-01-02T04:27:33Z")
Please find the attached file. [sg\_roles\_mapping.yml](https://forum.search-guard.com/uploads/short-url/3me1dluG6C4kKS1Skts8oroaTAC.yml) (1.1 KB) > **···** > > On Tuesday, January 1, 2019 at 7:57:37 PM UTC+5:30, Search Guard wrote: > > > Can you post you rolesmapping file? > > > > > Am 31.12.2018 um 17:35 schrieb [nis...@factweavers.com](mailto:nis...@factweavers.com): > > > > > Hello, > > > > > - Search Guard version: 5 > > > > > - Elasticsearch version: 5.6.13 > > > > > - Operating system: Ubuntu 16.04/ CentOS 6 > > > > > - Search guard edition: Community > > > > > - Java version: 1.8 > > > > > **Issue** > > > The certificate based user role can’t be changed for Java transport client (To restrict java api to delete and write data to Elasticsearch). > > > > > - Node, Client and Admin (.pem and .key) certificate’s were generated using the Offline TLS tool. Updated “elasticsearch.yml” with the content generated in snippet during the creation of certificate. > > > > > - New user were addded to “sg\_internal\_users.yml” with hashed password. Over the HTTPS (curl -k -u username:password [https://localhost:9200](https://localhost:9200)) I’m able to alert the user roles and permission to access the Elasticsearch. Using sgadmin I have pushed the configuration changes to search guard. > > > > > - In the case of transport client with search guard, using java API I’m able to perform indexing, search and delete operation in Elasticsearch with the generated certificate’s. I’m using the admin certificate for the following transport client settings > > > > > ``` > > > Settings settings = Settings.builder() > > > > > > ``` > > > > > ``` > > > .put(SSLConfigConstants.SEARCHGUARD_SSL_TRANSPORT_PEMKEY_FILEPATH, "/home/user/sg/certs/example-admin.key") > > > > > > ``` > > > > > ``` > > > .put(SSLConfigConstants.SEARCHGUARD_SSL_TRANSPORT_PEMCERT_FILEPATH, "/home/user/sg/certs/example-admin.pem") > > > > > > ``` > > > > > ``` > > > .put(SSLConfigConstants.SEARCHGUARD_SSL_TRANSPORT_PEMTRUSTEDCAS_FILEPATH, "/home/user/sg/certs/root-ca.pem") > > > > > > ``` > > > > > ``` > > > .put(SSLConfigConstants.SEARCHGUARD_SSL_TRANSPORT_ENFORCE_HOSTNAME_VERIFICATION, false) > > > > > > ``` > > > > > ``` > > > .put("[cluster.name](http://cluster.name)", "sg_test").build(); > > > > > > ``` > > > > > - In order to modify the role of the (example-admin.key) certificate, I have added the certificate DN in “sg\_roles\_mapping.yml” and provided the permission to only read data from Elasticsearch. Using the sgadmin new configuration changes were updated to search guard. > > > > > > The roles are not getting updated for the certificate based user, I’m unable to restrict the java client from indexing or deleting data from Elasticsearch. > > > > > Please help me to modify the search guard role and permission (certificate based user) for Java transport client. > > > > > Thanks. > > > > > – > > > You received this message because you are subscribed to the Google Groups “Search Guard Community Forum” group. > > > > > To unsubscribe from this group and stop receiving emails from it, send an email to [search-guard...@googlegroups.com](mailto:search-guard...@googlegroups.com). > > > > > To post to this group, send email to [search...@googlegroups.com](mailto:search...@googlegroups.com). > > > > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/601f5639-f59b-4a6e-b909-9b0427d79fec%40googlegroups.com](https://groups.google.com/d/msgid/search-guard/601f5639-f59b-4a6e-b909-9b0427d79fec%40googlegroups.com). > > > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![nisham](https://avatars.discourse-cdn.com/v4/letter/n/35a633/32.png) [@nisham](https://forum.search-guard.com/u/nisham)\ **Post date:** [January 9, 2019, 10:14am UTC](https://forum.search-guard.com/t/search-guard-certificate-based-user-role-mapping-issue/1263/4 "2019-01-09T10:14:42Z")
Hello, We had added the below mapping in the config file to enable just readall, the roles mapping file is also attached, any help would be greatly appreciated, Thanks. **sg\_readall:** **users:** **- readall** **- ‘[CN=fw.example.com](http://CN=fw.example.com), OU=Ops, O=“Example Com, Inc.”, DC=example, DC=com’** [sg\_roles\_mapping.yml](https://forum.search-guard.com/uploads/short-url/3me1dluG6C4kKS1Skts8oroaTAC.yml) (1.1 KB) > **···** > > On Wednesday, January 2, 2019 at 9:57:33 AM UTC+5:30, [nis...@factweavers.com](mailto:nis...@factweavers.com) wrote: > > > Please find the attached file. > > > > On Tuesday, January 1, 2019 at 7:57:37 PM UTC+5:30, Search Guard wrote: > > > > > Can you post you rolesmapping file? > > > > > > > Am 31.12.2018 um 17:35 schrieb [nis...@factweavers.com](mailto:nis...@factweavers.com): > > > > > > > Hello, > > > > > > > - Search Guard version: 5 > > > > > > > - Elasticsearch version: 5.6.13 > > > > > > > - Operating system: Ubuntu 16.04/ CentOS 6 > > > > > > > - Search guard edition: Community > > > > > > > - Java version: 1.8 > > > > > > > **Issue** > > > > The certificate based user role can’t be changed for Java transport client (To restrict java api to delete and write data to Elasticsearch). > > > > > > > - Node, Client and Admin (.pem and .key) certificate’s were generated using the Offline TLS tool. Updated “elasticsearch.yml” with the content generated in snippet during the creation of certificate. > > > > > > > - New user were addded to “sg\_internal\_users.yml” with hashed password. Over the HTTPS (curl -k -u username:password [https://localhost:9200](https://localhost:9200)) I’m able to alert the user roles and permission to access the Elasticsearch. Using sgadmin I have pushed the configuration changes to search guard. > > > > > > > - In the case of transport client with search guard, using java API I’m able to perform indexing, search and delete operation in Elasticsearch with the generated certificate’s. I’m using the admin certificate for the following transport client settings > > > > > > > ``` > > > > Settings settings = Settings.builder() > > > > > > > > ``` > > > > > > > ``` > > > > .put(SSLConfigConstants.SEARCHGUARD_SSL_TRANSPORT_PEMKEY_FILEPATH, "/home/user/sg/certs/example-admin.key") > > > > > > > > ``` > > > > > > > ``` > > > > .put(SSLConfigConstants.SEARCHGUARD_SSL_TRANSPORT_PEMCERT_FILEPATH, "/home/user/sg/certs/example-admin.pem") > > > > > > > > ``` > > > > > > > ``` > > > > .put(SSLConfigConstants.SEARCHGUARD_SSL_TRANSPORT_PEMTRUSTEDCAS_FILEPATH, "/home/user/sg/certs/root-ca.pem") > > > > > > > > ``` > > > > > > > ``` > > > > .put(SSLConfigConstants.SEARCHGUARD_SSL_TRANSPORT_ENFORCE_HOSTNAME_VERIFICATION, false) > > > > > > > > ``` > > > > > > > ``` > > > > .put("[cluster.name](http://cluster.name)", "sg_test").build(); > > > > > > > > ``` > > > > > > > - In order to modify the role of the (example-admin.key) certificate, I have added the certificate DN in “sg\_roles\_mapping.yml” and provided the permission to only read data from Elasticsearch. Using the sgadmin new configuration changes were updated to search guard. > > > > > > > > The roles are not getting updated for the certificate based user, I’m unable to restrict the java client from indexing or deleting data from Elasticsearch. > > > > > > > Please help me to modify the search guard role and permission (certificate based user) for Java transport client. > > > > > > > Thanks. > > > > > > > – > > > > You received this message because you are subscribed to the Google Groups “Search Guard Community Forum” group. > > > > > > > To unsubscribe from this group and stop receiving emails from it, send an email to [search-guard...@googlegroups.com](mailto:search-guard...@googlegroups.com). > > > > > > > To post to this group, send email to [search...@googlegroups.com](mailto:search...@googlegroups.com). > > > > > > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/601f5639-f59b-4a6e-b909-9b0427d79fec%40googlegroups.com](https://groups.google.com/d/msgid/search-guard/601f5639-f59b-4a6e-b909-9b0427d79fec%40googlegroups.com). > > > > > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\ **Post date:** [January 10, 2019, 9:53pm UTC](https://forum.search-guard.com/t/search-guard-certificate-based-user-role-mapping-issue/1263/5 "2019-01-10T21:53:39Z")
Pls post also elasticsearch.yml and sg\_config.yml > **···** > > On Wednesday, 9 January 2019 11:14:42 UTC+1, nish… wrote: > > > Hello, > > > We had added the below mapping in the config file to enable just readall, the roles mapping file is also attached, any help would be greatly appreciated, Thanks. > > > **sg\_readall:** > > > **users:** > > > **- readall** > > > **- ‘CN=[fw.example.com](http://fw.example.com), OU=Ops, O=“Example Com, Inc.”, DC=example, DC=com’** > > > On Wednesday, January 2, 2019 at 9:57:33 AM UTC+5:30, [nis...@factweavers.com](mailto:nis...@factweavers.com) wrote: > > > > > Please find the attached file. > > > > > > On Tuesday, January 1, 2019 at 7:57:37 PM UTC+5:30, Search Guard wrote: > > > > > > > Can you post you rolesmapping file? > > > > > > > > > Am 31.12.2018 um 17:35 schrieb [nis...@factweavers.com](mailto:nis...@factweavers.com): > > > > > > > > > Hello, > > > > > > > > > - Search Guard version: 5 > > > > > > > > > - Elasticsearch version: 5.6.13 > > > > > > > > > - Operating system: Ubuntu 16.04/ CentOS 6 > > > > > > > > > - Search guard edition: Community > > > > > > > > > - Java version: 1.8 > > > > > > > > > **Issue** > > > > > The certificate based user role can’t be changed for Java transport client (To restrict java api to delete and write data to Elasticsearch). > > > > > > > > > - Node, Client and Admin (.pem and .key) certificate’s were generated using the Offline TLS tool. Updated “elasticsearch.yml” with the content generated in snippet during the creation of certificate. > > > > > > > > > - New user were addded to “sg\_internal\_users.yml” with hashed password. Over the HTTPS (curl -k -u username:password [https://localhost:9200](https://localhost:9200)) I’m able to alert the user roles and permission to access the Elasticsearch. Using sgadmin I have pushed the configuration changes to search guard. > > > > > > > > > - In the case of transport client with search guard, using java API I’m able to perform indexing, search and delete operation in Elasticsearch with the generated certificate’s. I’m using the admin certificate for the following transport client settings > > > > > > > > > ``` > > > > > Settings settings = Settings.builder() > > > > > > > > > > ``` > > > > > > > > > ``` > > > > > .put(SSLConfigConstants.SEARCHGUARD_SSL_TRANSPORT_PEMKEY_FILEPATH, "/home/user/sg/certs/example-admin.key") > > > > > > > > > > ``` > > > > > > > > > ``` > > > > > .put(SSLConfigConstants.SEARCHGUARD_SSL_TRANSPORT_PEMCERT_FILEPATH, "/home/user/sg/certs/example-admin.pem") > > > > > > > > > > ``` > > > > > > > > > ``` > > > > > .put(SSLConfigConstants.SEARCHGUARD_SSL_TRANSPORT_PEMTRUSTEDCAS_FILEPATH, "/home/user/sg/certs/root-ca.pem") > > > > > > > > > > ``` > > > > > > > > > ``` > > > > > .put(SSLConfigConstants.SEARCHGUARD_SSL_TRANSPORT_ENFORCE_HOSTNAME_VERIFICATION, false) > > > > > > > > > > ``` > > > > > > > > > ``` > > > > > .put("[cluster.name](http://cluster.name)", "sg_test").build(); > > > > > > > > > > ``` > > > > > > > > > - In order to modify the role of the (example-admin.key) certificate, I have added the certificate DN in “sg\_roles\_mapping.yml” and provided the permission to only read data from Elasticsearch. Using the sgadmin new configuration changes were updated to search guard. > > > > > > > > > > The roles are not getting updated for the certificate based user, I’m unable to restrict the java client from indexing or deleting data from Elasticsearch. > > > > > > > > > Please help me to modify the search guard role and permission (certificate based user) for Java transport client. > > > > > > > > > Thanks. > > > > > > > > > – > > > > > You received this message because you are subscribed to the Google Groups “Search Guard Community Forum” group. > > > > > > > > > To unsubscribe from this group and stop receiving emails from it, send an email to [search-guard...@googlegroups.com](mailto:search-guard...@googlegroups.com). > > > > > > > > > To post to this group, send email to [search...@googlegroups.com](mailto:search...@googlegroups.com). > > > > > > > > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/601f5639-f59b-4a6e-b909-9b0427d79fec%40googlegroups.com](https://groups.google.com/d/msgid/search-guard/601f5639-f59b-4a6e-b909-9b0427d79fec%40googlegroups.com). > > > > > > > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![nisham](https://avatars.discourse-cdn.com/v4/letter/n/35a633/32.png) [@nisham](https://forum.search-guard.com/u/nisham)\ **Post date:** [January 11, 2019, 5:23am UTC](https://forum.search-guard.com/t/search-guard-certificate-based-user-role-mapping-issue/1263/6 "2019-01-11T05:23:08Z")
Thanks for the quick response. I have attached both the files (elasticsearch.yml and sg\_config.yml) with this message, please find the same. [elasticsearch.yml](https://forum.search-guard.com/uploads/short-url/aRPHgHDzgJAAL0zklxfeX6Qjlz8.yml) (3.79 KB) [sg\_config.yml](https://forum.search-guard.com/uploads/short-url/j3VIlxeYBaHeYOHqKQlVy5OmME9.yml) (9.4 KB) > **···** > > On Friday, January 11, 2019 at 3:23:40 AM UTC+5:30, Search Guard wrote: > > > Pls post also elasticsearch.yml and sg\_config.yml > > > > On Wednesday, 9 January 2019 11:14:42 UTC+1, nish… wrote: > > > > > Hello, > > > > We had added the below mapping in the config file to enable just readall, the roles mapping file is also attached, any help would be greatly appreciated, Thanks. > > > > **sg\_readall:** > > > > **users:** > > > > **- readall** > > > > **- ‘CN=[fw.example.com](http://fw.example.com), OU=Ops, O=“Example Com, Inc.”, DC=example, DC=com’** > > > > On Wednesday, January 2, 2019 at 9:57:33 AM UTC+5:30, [nis...@factweavers.com](mailto:nis...@factweavers.com) wrote: > > > > > > > Please find the attached file. > > > > > > > > On Tuesday, January 1, 2019 at 7:57:37 PM UTC+5:30, Search Guard wrote: > > > > > > > > > Can you post you rolesmapping file? > > > > > > > > > > > Am 31.12.2018 um 17:35 schrieb [nis...@factweavers.com](mailto:nis...@factweavers.com): > > > > > > > > > > > Hello, > > > > > > > > > > > - Search Guard version: 5 > > > > > > > > > > > - Elasticsearch version: 5.6.13 > > > > > > > > > > > - Operating system: Ubuntu 16.04/ CentOS 6 > > > > > > > > > > > - Search guard edition: Community > > > > > > > > > > > - Java version: 1.8 > > > > > > > > > > > **Issue** > > > > > > The certificate based user role can’t be changed for Java transport client (To restrict java api to delete and write data to Elasticsearch). > > > > > > > > > > > - Node, Client and Admin (.pem and .key) certificate’s were generated using the Offline TLS tool. Updated “elasticsearch.yml” with the content generated in snippet during the creation of certificate. > > > > > > > > > > > - New user were addded to “sg\_internal\_users.yml” with hashed password. Over the HTTPS (curl -k -u username:password [https://localhost:9200](https://localhost:9200)) I’m able to alert the user roles and permission to access the Elasticsearch. Using sgadmin I have pushed the configuration changes to search guard. > > > > > > > > > > > - In the case of transport client with search guard, using java API I’m able to perform indexing, search and delete operation in Elasticsearch with the generated certificate’s. I’m using the admin certificate for the following transport client settings > > > > > > > > > > > ``` > > > > > > Settings settings = Settings.builder() > > > > > > > > > > > > ``` > > > > > > > > > > > ``` > > > > > > .put(SSLConfigConstants.SEARCHGUARD_SSL_TRANSPORT_PEMKEY_FILEPATH, "/home/user/sg/certs/example-admin.key") > > > > > > > > > > > > ``` > > > > > > > > > > > ``` > > > > > > .put(SSLConfigConstants.SEARCHGUARD_SSL_TRANSPORT_PEMCERT_FILEPATH, "/home/user/sg/certs/example-admin.pem") > > > > > > > > > > > > ``` > > > > > > > > > > > ``` > > > > > > .put(SSLConfigConstants.SEARCHGUARD_SSL_TRANSPORT_PEMTRUSTEDCAS_FILEPATH, "/home/user/sg/certs/root-ca.pem") > > > > > > > > > > > > ``` > > > > > > > > > > > ``` > > > > > > .put(SSLConfigConstants.SEARCHGUARD_SSL_TRANSPORT_ENFORCE_HOSTNAME_VERIFICATION, false) > > > > > > > > > > > > ``` > > > > > > > > > > > ``` > > > > > > .put("[cluster.name](http://cluster.name)", "sg_test").build(); > > > > > > > > > > > > ``` > > > > > > > > > > > - In order to modify the role of the (example-admin.key) certificate, I have added the certificate DN in “sg\_roles\_mapping.yml” and provided the permission to only read data from Elasticsearch. Using the sgadmin new configuration changes were updated to search guard. > > > > > > > > > > > > The roles are not getting updated for the certificate based user, I’m unable to restrict the java client from indexing or deleting data from Elasticsearch. > > > > > > > > > > > Please help me to modify the search guard role and permission (certificate based user) for Java transport client. > > > > > > > > > > > Thanks. > > > > > > > > > > > – > > > > > > You received this message because you are subscribed to the Google Groups “Search Guard Community Forum” group. > > > > > > > > > > > To unsubscribe from this group and stop receiving emails from it, send an email to [search-guard...@googlegroups.com](mailto:search-guard...@googlegroups.com). > > > > > > > > > > > To post to this group, send email to [search...@googlegroups.com](mailto:search...@googlegroups.com). > > > > > > > > > > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/601f5639-f59b-4a6e-b909-9b0427d79fec%40googlegroups.com](https://groups.google.com/d/msgid/search-guard/601f5639-f59b-4a6e-b909-9b0427d79fec%40googlegroups.com). > > > > > > > > > > > For more options, visit [https://groups.google.com/d/optout](https://groups.google.com/d/optout). ---
**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\ **Post date:** [January 12, 2019, 4:16pm UTC](https://forum.search-guard.com/t/search-guard-certificate-based-user-role-mapping-issue/1263/7 "2019-01-12T16:16:01Z")
You should not add the admin\_dn (CN=fw.example.com,OU=Ops,O="Example Com, Inc.",DC=Example,DC=com) somewhere in the sg\_roles\_mapping.yml file. To connect via transport client use a other (additional non-admin) client certificate and not the admin certificate (except you want to deal with the search guard index like sgadmin). Put hte dn of the other client certificate in the sg\_roles\_mapping.yml file See: [https://search-guard.com/searchguard-elasicsearch-transport-clients/](https://search-guard.com/searchguard-elasicsearch-transport-clients/) [https://search-guard.com/transport-client-authentication-authorization/](https://search-guard.com/transport-client-authentication-authorization/) > **[Transport Clients](https://docs.search-guard.com/latest/elasticsearch-transport-clients-search-guard)** > > How to connect to a Search Guard secured Elasticsearch cluster using a Transport Client. Also make sure you enable the clientcert\_auth\_domain clientcert\_auth\_domain:         enabled: true         order: 2         http\_authenticator:           type: clientcert           config:             username\_attribute: null           challenge: false         authentication\_backend:           type: noop > **···** > > > Am 11.01.2019 um 06:23 schrieb nisham@factweavers.com: > > > > Thanks for the quick response. > > > > I have attached both the files (elasticsearch.yml and sg\_config.yml) with this message, please find the same. > > > > On Friday, January 11, 2019 at 3:23:40 AM UTC+5:30, Search Guard wrote: > > Pls post also elasticsearch.yml and sg\_config.yml > > > > On Wednesday, 9 January 2019 11:14:42 UTC+1, nish... wrote: > > Hello, > > > > We had added the below mapping in the config file to enable just readall, the roles mapping file is also attached, any help would be greatly appreciated, Thanks. > > > > sg\_readall: > >   users: > >     - readall > >     - 'CN=fw.example.com, OU=Ops, O="Example Com\, Inc.", DC=example, DC=com' > > > > On Wednesday, January 2, 2019 at 9:57:33 AM UTC+5:30, nis...@factweavers.com wrote: > > Please find the attached file. > > > > On Tuesday, January 1, 2019 at 7:57:37 PM UTC+5:30, Search Guard wrote: > > Can you post you rolesmapping file? > > > > \> Am 31.12.2018 um 17:35 schrieb nis...@factweavers.com: > > \> > > \> Hello, > > \> > > \> \* Search Guard version: 5 > > \> \* Elasticsearch version: 5.6.13 > > \> \* Operating system: Ubuntu 16.04/ CentOS 6 > > \> \* Search guard edition: Community > > \> \* Java version: 1.8 > > \> > > \> > > \> \*\*Issue\*\* > > \> The certificate based user role can't be changed for Java transport client (To restrict java api to delete and write data to Elasticsearch). > > \> > > \> \* Node, Client and Admin (.pem and .key) certificate's were generated using the Offline TLS tool. Updated "elasticsearch.yml" with the content generated in snippet during the creation of certificate. > > \> > > \> > > \> \* New user were addded to "sg\_internal\_users.yml" with hashed password. Over the HTTPS (curl -k -u username:password [https://localhost:9200](https://localhost:9200)) I'm able to alert the user roles and permission to access the Elasticsearch. Using sgadmin I have pushed the configuration changes to search guard. > > \> > > \> \* In the case of transport client with search guard, using java API I'm able to perform indexing, search and delete operation in Elasticsearch with the generated certificate's. I'm using the admin certificate for the following transport client settings > > \> > > \> Settings settings = Settings.builder() > > \> .put(SSLConfigConstants.SEARCHGUARD\_SSL\_TRANSPORT\_PEMKEY\_FILEPATH, "/home/user/sg/certs/example-admin.key") > > \> .put(SSLConfigConstants.SEARCHGUARD\_SSL\_TRANSPORT\_PEMCERT\_FILEPATH, "/home/user/sg/certs/example-admin.pem") > > \> .put(SSLConfigConstants.SEARCHGUARD\_SSL\_TRANSPORT\_PEMTRUSTEDCAS\_FILEPATH, "/home/user/sg/certs/root-ca.pem") > > \> .put(SSLConfigConstants.SEARCHGUARD\_SSL\_TRANSPORT\_ENFORCE\_HOSTNAME\_VERIFICATION, false) > > \> .put("cluster.name", "sg\_test").build(); > > \> > > \> \* In order to modify the role of the (example-admin.key) certificate, I have added the certificate DN in "sg\_roles\_mapping.yml" and provided the permission to only read data from Elasticsearch. Using the sgadmin new configuration changes were updated to search guard. > > \> > > \> The roles are not getting updated for the certificate based user, I'm unable to restrict the java client from indexing or deleting data from Elasticsearch. > > \> > > \> Please help me to modify the search guard role and permission (certificate based user) for Java transport client. > > \> > > \> Thanks. > > \> > > \> -- > > \> You received this message because you are subscribed to the Google Groups "Search Guard Community Forum" group. > > \> To unsubscribe from this group and stop receiving emails from it, send an email to search-guard...@googlegroups.com. > > \> To post to this group, send email to search...@googlegroups.com. > > \> To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/601f5639-f59b-4a6e-b909-9b0427d79fec%40googlegroups.com\](https://groups.google.com/d/msgid/search-guard/601f5639-f59b-4a6e-b909-9b0427d79fec%40googlegroups.com%5C). > > \> For more options, visit [https://groups.google.com/d/optout\](https://groups.google.com/d/optout%5C). > > > > -- > > You received this message because you are subscribed to the Google Groups "Search Guard Community Forum" group. > > To unsubscribe from this group and stop receiving emails from it, send an email to search-guard+unsubscribe@googlegroups.com. > > To post to this group, send email to search-guard@googlegroups.com. > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/22b77d2d-612f-44e2-bf91-d98227ddf2e8%40googlegroups.com\](https://groups.google.com/d/msgid/search-guard/22b77d2d-612f-44e2-bf91-d98227ddf2e8%40googlegroups.com%5C). > > For more options, visit [https://groups.google.com/d/optout\](https://groups.google.com/d/optout%5C). > > \\