# Why the roles are not picking though the user is been assigned to role?

**URL:** <https://forum.search-guard.com/t/why-the-roles-are-not-picking-though-the-user-is-been-assigned-to-role/258>\
**Category:** Search Guard\
**Created:** [August 10, 2016, 11:52am UTC](https://forum.search-guard.com/t/why-the-roles-are-not-picking-though-the-user-is-been-assigned-to-role/258 "2016-08-10T11:52:32Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![SAI\_KRISHNA\_GHANTA](https://avatars.discourse-cdn.com/v4/letter/s/7feea3/32.png) [@SAI\_KRISHNA\_GHANTA](https://forum.search-guard.com/u/SAI_KRISHNA_GHANTA)\
**Post date:** [August 10, 2016, 11:52am UTC](https://forum.search-guard.com/t/why-the-roles-are-not-picking-though-the-user-is-been-assigned-to-role/258/1 "2016-08-10T11:52:32Z")

</div>

For example:

**sg\_config.yml:**

searchguard:

authc:

basic\_internal\_auth\_domain:  
enabled: true

order: 1

http\_authenticator:

type: basic

challenge: true

authentication\_backend:

type: intern

**sg\_roles\_mapping.yml:**

sg\_kibana4\_server:

users:

- kibanaserver

**sg\_roles.yml:**

sg\_kibana4\_server:

cluster:

- cluster:monitor/nodes/info

- cluster:monitor/health

indices:

‘?kibana’:

‘\*’:

- ALL

**In The log:**

[2016-08-10 11:33:22,157][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] **raw indices [.kibana]**

[2016-08-10 11:33:22,158][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Resolved [.kibana] to {}

[2016-08-10 11:33:22,158][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested resolved aliases and indices: [.kibana]

[2016-08-10 11:33:22,158][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested resolved types: [config]

[2016-08-10 11:33:22,158][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] **mapped roles: [sg\_kibana4\_server]**

[2016-08-10 11:33:22,158][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] ---------- evaluate sg\_role: sg\_kibana4\_server

[2016-08-10 11:33:22,158][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Try wildcard match for ?kibana

[2016-08-10 11:33:22,158][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Wildcard match for ?kibana: [.kibana]

[2016-08-10 11:33:22,158][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] matches for ?kibana, will check now types [\*]

[2016-08-10 11:33:22,158][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] resolvedActions for ?kibana/_: [indices:_]

[2016-08-10 11:33:22,158][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] match requested action indices:data/read/search against ?kibana/_: [indices:_]

[2016-08-10 11:33:22,158][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] For index ?kibana remaining requested aliases and indices:

[2016-08-10 11:33:22,158][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] For index ?kibana remaining requested resolved types:

[2016-08-10 11:33:22,158][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] found a match for ‘sg\_kibana4\_server.?kibana’, evaluate other roles

[2016-08-10 11:33:24,664][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] Try to extract auth creds from http basic

[2016-08-10 11:33:24,664][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] User ‘kibanaserver’ is in cache? true (cache size: 1)

[2016-08-10 11:33:24,664][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] User **‘User [name=kibanaserver, roles=[]]’** is authenticated

[2016-08-10 11:33:24,666][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] Try to extract auth creds from http basic

[2016-08-10 11:33:24,666][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] User ‘kibanaserver’ is in cache? true (cache size: 1)

[2016-08-10 11:33:24,666][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] User ‘User [name=kibanaserver, roles=]’ is authenticated

[2016-08-10 11:33:24,667][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] evaluate permissions for User [name=kibanaserver, roles=]

[2016-08-10 11:33:24,667][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested cluster:monitor/nodes/info from 172.16.189.219:60040

[2016-08-10 11:33:24,667][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] class org.elasticsearch.action.admin.cluster.node.info.NodesInfoRequest is not an IndicesRequest

[2016-08-10 11:33:24,667][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested resolved aliases and indices: [\_all]

[2016-08-10 11:33:24,667][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested resolved types: [\_all]

[2016-08-10 11:33:24,667][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] **mapped roles: [sg\_kibana4\_server]**

[2016-08-10 11:33:24,667][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] ---------- evaluate sg\_role: sg\_kibana4\_server

[2016-08-10 11:33:24,667][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] resolved cluster actions:[cluster:monitor/nodes/info, cluster:monitor/health]

[2016-08-10 11:33:24,667][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] found a match for ‘sg\_kibana4\_server’ and cluster:monitor/nodes/info, skip other roles

[2016-08-10 11:33:24,677][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] Try to extract auth creds from http basic

[2016-08-10 11:33:24,677][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] User ‘kibanaserver’ is in cache? true (cache size: 1)

[2016-08-10 11:33:24,677][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] User **‘User [name=kibanaserver, roles=[]]’** is authenticated

[2016-08-10 11:33:24,677][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] **evaluate permissions for User [name=kibanaserver, roles=[]]**

[2016-08-10 11:33:24,677][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested cluster:monitor/health from 172.16.189.219:60041

[2016-08-10 11:33:24,678][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Resolve [.kibana] from class org.elasticsearch.action.admin.cluster.health.ClusterHealthRequest

[2016-08-10 11:33:24,678][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] indicesOptions IndicesOptions[**id=7** , ignore\_unavailable=true, allow\_no\_indices=true, expand\_wildcards\_open=true, expand\_wildcards\_closed=false, allow\_alisases\_to\_multiple\_indices=true, **forbid\_closed\_indices=false**]

[2016-08-10 11:33:24,678][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] **raw indices [.kibana]**

[2016-08-10 11:33:24,678][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Resolved [.kibana] to {}

[2016-08-10 11:33:24,678][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested resolved aliases and indices: [.kibana]

[2016-08-10 11:33:24,678][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested resolved types: [\_all]

[2016-08-10 11:33:24,678][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] **mapped roles: [sg\_kibana4\_server]**

[2016-08-10 11:33:24,678][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] ---------- evaluate sg\_role: sg\_kibana4\_server

[2016-08-10 11:33:24,678][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] resolved cluster actions:[cluster:monitor/nodes/info, cluster:monitor/health]

[2016-08-10 11:33:24,678][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] found a match for ‘sg\_kibana4\_server’ and cluster:monitor/health, skip other roles

[2016-08-10 11:33:24,683][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] Try to extract auth creds from http basic

[2016-08-10 11:33:24,683][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] User ‘kibanaserver’ is in cache? true (cache size: 1)

[2016-08-10 11:33:24,683][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] User ‘**User [name=kibanaserver, roles=[]]**’ is authenticated

[2016-08-10 11:33:24,684][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] evaluate permissions for **User [name=kibanaserver, roles=[]]**

[2016-08-10 11:33:24,684][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested indices:data/read/search from 172.16.189.219:60042

[2016-08-10 11:33:24,684][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Resolve [.kibana] from class org.elasticsearch.action.search.SearchRequest

[2016-08-10 11:33:24,684][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] indicesOptions IndicesOptions\*\*[id=38\*\*, ignore\_unavailable=false, allow\_no\_indices=true, expand\_wildcards\_open=true, expand\_wildcards\_closed=false, allow\_alisases\_to\_multiple\_indices=true, **forbid\_closed\_indices=true**]

Some one please throw some on light on this, I’m totally confused.

---

<div class="post-metadata">

**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\
**Post date:** [August 17, 2016, 7:03pm UTC](https://forum.search-guard.com/t/why-the-roles-are-not-picking-though-the-user-is-been-assigned-to-role/258/2 "2016-08-17T19:03:11Z")

</div>

Everything seems to work fine. Wehn speaking of roles, there are actually two types of roles:

- Backend roles
- These are roles that Search Guard retrieves from some authorization backend like LDAP
- These authorization backends are configured in the authz section of the sg\_config
- You use them to collect additional roles for the user
- Mapped roles
- Search Guard maps users and backend roles to Search Guard roles
- This is what you define in sg\_roles\_mapping
- Search Guard uses the mapped roles to define permissions  
What you see in the logfiles are the backend roles of the user, not the mapped roles. If you have not defined an authorization backend, and thus have no additional backend roles, these will always be empty.

The important part in the log is:

**mapped roles: [sg\_kibana4\_server]**

Which means that Search Guard has mapped user names and backend roles to the **sg\_kibana4\_server** role, and SG will use the permission settings for this mapped role.

> **···**
>
> On Wednesday, 10 August 2016 13:52:32 UTC+2, SAI KRISHNA GHANTA wrote:
> 
> > For example:
> 
> > **sg\_config.yml:**
> > 
> > searchguard:
> 
> > authc:
> 
> > basic\_internal\_auth\_domain:  
> > enabled: true
> 
> > order: 1
> 
> > http\_authenticator:
> 
> > type: basic
> 
> > challenge: true
> 
> > authentication\_backend:
> 
> > type: intern
> 
> > 
> 
> > **sg\_roles\_mapping.yml:**
> 
> > sg\_kibana4\_server:
> 
> > users:
> 
> > - kibanaserver
> 
> > 
> 
> > **sg\_roles.yml:**
> 
> > 
> 
> > sg\_kibana4\_server:
> 
> > cluster:
> 
> > - cluster:monitor/nodes/info
> 
> > - cluster:monitor/health
> 
> > indices:
> 
> > ‘?kibana’:
> 
> > ‘\*’:
> 
> > - ALL
> 
> > 
> 
> > **In The log:**
> 
> > [2016-08-10 11:33:22,157][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] **raw indices [.kibana]**
> 
> > [2016-08-10 11:33:22,158][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Resolved [.kibana] to {}
> 
> > [2016-08-10 11:33:22,158][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested resolved aliases and indices: [.kibana]
> 
> > [2016-08-10 11:33:22,158][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested resolved types: [config]
> 
> > [2016-08-10 11:33:22,158][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] **mapped roles: [sg\_kibana4\_server]**
> 
> > [2016-08-10 11:33:22,158][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] ---------- evaluate sg\_role: sg\_kibana4\_server
> 
> > [2016-08-10 11:33:22,158][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Try wildcard match for ?kibana
> 
> > [2016-08-10 11:33:22,158][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Wildcard match for ?kibana: [.kibana]
> 
> > [2016-08-10 11:33:22,158][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] matches for ?kibana, will check now types [\*]
> 
> > [2016-08-10 11:33:22,158][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] resolvedActions for ?kibana/_: [indices:_]
> 
> > [2016-08-10 11:33:22,158][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] match requested action indices:data/read/search against ?kibana/_: [indices:_]
> 
> > [2016-08-10 11:33:22,158][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] For index ?kibana remaining requested aliases and indices:
> 
> > [2016-08-10 11:33:22,158][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] For index ?kibana remaining requested resolved types:
> 
> > [2016-08-10 11:33:22,158][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] found a match for ‘sg\_kibana4\_server.?kibana’, evaluate other roles
> 
> > [2016-08-10 11:33:24,664][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] Try to extract auth creds from http basic
> 
> > [2016-08-10 11:33:24,664][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] User ‘kibanaserver’ is in cache? true (cache size: 1)
> 
> > [2016-08-10 11:33:24,664][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] User **‘User [name=kibanaserver, roles=[]]’** is authenticated
> 
> > [2016-08-10 11:33:24,666][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] Try to extract auth creds from http basic
> 
> > [2016-08-10 11:33:24,666][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] User ‘kibanaserver’ is in cache? true (cache size: 1)
> 
> > [2016-08-10 11:33:24,666][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] User ‘User [name=kibanaserver, roles=]’ is authenticated
> 
> > [2016-08-10 11:33:24,667][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] evaluate permissions for User [name=kibanaserver, roles=]
> 
> > [2016-08-10 11:33:24,667][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested cluster:monitor/nodes/info from [172.16.189.219:60040](http://172.16.189.219:60040)
> 
> > [2016-08-10 11:33:24,667][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] class org.elasticsearch.action.admin.cluster.node.info.NodesInfoRequest is not an IndicesRequest
> 
> > [2016-08-10 11:33:24,667][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested resolved aliases and indices: [\_all]
> 
> > [2016-08-10 11:33:24,667][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested resolved types: [\_all]
> 
> > [2016-08-10 11:33:24,667][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] **mapped roles: [sg\_kibana4\_server]**
> 
> > [2016-08-10 11:33:24,667][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] ---------- evaluate sg\_role: sg\_kibana4\_server
> 
> > [2016-08-10 11:33:24,667][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] resolved cluster actions:[cluster:monitor/nodes/info, cluster:monitor/health]
> 
> > [2016-08-10 11:33:24,667][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] found a match for ‘sg\_kibana4\_server’ and cluster:monitor/nodes/info, skip other roles
> 
> > [2016-08-10 11:33:24,677][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] Try to extract auth creds from http basic
> 
> > [2016-08-10 11:33:24,677][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] User ‘kibanaserver’ is in cache? true (cache size: 1)
> 
> > [2016-08-10 11:33:24,677][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] User **‘User [name=kibanaserver, roles=[]]’** is authenticated
> 
> > [2016-08-10 11:33:24,677][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] **evaluate permissions for User [name=kibanaserver, roles=[]]**
> 
> > [2016-08-10 11:33:24,677][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested cluster:monitor/health from [172.16.189.219:60041](http://172.16.189.219:60041)
> 
> > [2016-08-10 11:33:24,678][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Resolve [.kibana] from class org.elasticsearch.action.admin.cluster.health.ClusterHealthRequest
> 
> > [2016-08-10 11:33:24,678][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] indicesOptions IndicesOptions[**id=7** , ignore\_unavailable=true, allow\_no\_indices=true, expand\_wildcards\_open=true, expand\_wildcards\_closed=false, allow\_alisases\_to\_multiple\_indices=true, **forbid\_closed\_indices=false**]
> 
> > [2016-08-10 11:33:24,678][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] **raw indices [.kibana]**
> 
> > [2016-08-10 11:33:24,678][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Resolved [.kibana] to {}
> 
> > [2016-08-10 11:33:24,678][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested resolved aliases and indices: [.kibana]
> 
> > [2016-08-10 11:33:24,678][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested resolved types: [\_all]
> 
> > [2016-08-10 11:33:24,678][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] **mapped roles: [sg\_kibana4\_server]**
> 
> > [2016-08-10 11:33:24,678][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] ---------- evaluate sg\_role: sg\_kibana4\_server
> 
> > [2016-08-10 11:33:24,678][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] resolved cluster actions:[cluster:monitor/nodes/info, cluster:monitor/health]
> 
> > [2016-08-10 11:33:24,678][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] found a match for ‘sg\_kibana4\_server’ and cluster:monitor/health, skip other roles
> 
> > [2016-08-10 11:33:24,683][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] Try to extract auth creds from http basic
> 
> > [2016-08-10 11:33:24,683][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] User ‘kibanaserver’ is in cache? true (cache size: 1)
> 
> > [2016-08-10 11:33:24,683][DEBUG][com.floragunn.searchguard.auth.BackendRegistry] User ‘**User [name=kibanaserver, roles=[]]**’ is authenticated
> 
> > [2016-08-10 11:33:24,684][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] evaluate permissions for **User [name=kibanaserver, roles=[]]**
> 
> > [2016-08-10 11:33:24,684][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] requested indices:data/read/search from [172.16.189.219:60042](http://172.16.189.219:60042)
> 
> > [2016-08-10 11:33:24,684][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] Resolve [.kibana] from class org.elasticsearch.action.search.SearchRequest
> 
> > [2016-08-10 11:33:24,684][DEBUG][com.floragunn.searchguard.configuration.PrivilegesEvaluator] indicesOptions IndicesOptions\*\*[id=38\*\*, ignore\_unavailable=false, allow\_no\_indices=true, expand\_wildcards\_open=true, expand\_wildcards\_closed=false, allow\_alisases\_to\_multiple\_indices=true, **forbid\_closed\_indices=true**]
> 
> > 
> 
> > Some one please throw some on light on this, I’m totally confused.