# Value of returned role (SAML auth)

**URL:** <https://forum.search-guard.com/t/value-of-returned-role-saml-auth/1024>\
**Category:** Search Guard\
**Created:** [July 19, 2018, 1:11pm UTC](https://forum.search-guard.com/t/value-of-returned-role-saml-auth/1024 "2018-07-19T13:11:06Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![erik\_clark](https://avatars.discourse-cdn.com/v4/letter/e/ba8739/32.png) [@erik\_clark](https://forum.search-guard.com/u/erik_clark)\
**Post date:** [July 19, 2018, 1:11pm UTC](https://forum.search-guard.com/t/value-of-returned-role-saml-auth/1024/1 "2018-07-19T13:11:06Z")

</div>

I have two roles that I want to apply to my users. One is:

sg\_all\_access, and the other is sg\_readall. However, these map to backend roles of admin and readall. Just what exactly is supposed to be returned by our IdP for a role to use these two? Admin and readall? Or sg\_all\_access and sg\_readall? Thanks!

Erik

When asking questions, please provide the following information:

- Search Guard and Elasticsearch version

- Installed and used enterprise modules, if any

- JVM version and operating system version

- Search Guard configuration files

- Elasticsearch log messages on debug level

- Other installed Elasticsearch or Kibana plugins, if any

---

<div class="post-metadata">

**Author:** ![jkressin](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/jkressin/32/9_2.png) [@jkressin](https://forum.search-guard.com/u/jkressin)\
**Post date:** [July 19, 2018, 8:59pm UTC](https://forum.search-guard.com/t/value-of-returned-role-saml-auth/1024/2 "2018-07-19T20:59:20Z")

</div>

It is actually the other way around. The mapping is always:

backend role → Search Guard role

``

Where backend role means any role that is returned by the configured authentication domain. This could be LDAP groups, claims in JSON web tokens or, in your case, an IdP response.

So if you are using the demo configuration and our demo roles, and you want to assign users to the sg\_all\_access and sg\_readall Search Guard role, the roles returned from the IdP would be readall and admin.

But mind you, this is just a demo configuration. You can map any existing backend role in your IdP to any Search Guard role. This is where the roles\_mapping.yml comes into play:

[https://docs.search-guard.com/latest/mapping-users-roles](https://docs.search-guard.com/latest/mapping-users-roles)

> **···**
>
> On Thursday, July 19, 2018 at 3:11:07 PM UTC+2, erik clark wrote:
> 
> > I have two roles that I want to apply to my users. One is:
> 
> > 
> 
> > sg\_all\_access, and the other is sg\_readall. However, these map to backend roles of admin and readall. Just what exactly is supposed to be returned by our IdP for a role to use these two? Admin and readall? Or sg\_all\_access and sg\_readall? Thanks!
> 
> > 
> 
> > Erik
> 
> > 
> 
> > 
> 
> > When asking questions, please provide the following information:
> 
> > - Search Guard and Elasticsearch version
> 
> > - Installed and used enterprise modules, if any
> 
> > - JVM version and operating system version
> 
> > - Search Guard configuration files
> 
> > - Elasticsearch log messages on debug level
> 
> > - Other installed Elasticsearch or Kibana plugins, if any