# Active Directory - Account not assigned to role

**URL:** <https://discuss.elastic.co/t/active-directory-account-not-assigned-to-role/81119>\
**Category:** Elasticsearch\
**Created:** [April 4, 2017, 10:52am UTC](https://discuss.elastic.co/t/active-directory-account-not-assigned-to-role/81119 "2017-04-04T10:52:49Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Fabien](https://avatars.discourse-cdn.com/v4/letter/f/85e7bf/32.png) [@Fabien](https://discuss.elastic.co/u/Fabien)\
**Post date:** [April 4, 2017, 10:52am UTC](https://discuss.elastic.co/t/active-directory-account-not-assigned-to-role/81119/1 "2017-04-04T10:52:49Z")

</div>

Hello,

I want to use an active directory connection with **x-pack**.  
My error is that the account of active directory is associated with no role. However, it seems to me that I followed the configuration steps:

Edit **elasticsearch.yml**

```
            xpack:
              security:
                authc:
                  realms:
                    active_directory:
                      type: active_directory
                      order: 0 
                      domain_name: myactivedirectory.com
                      url: ldap://myactivedirectory:389
                      unmapped_groups_as_roles: true 
                      files:
                        role_mapping: "CONFIG_DIR/x-pack/role_mapping.yml"

```

Edit **role\_mapping.yml**

```
admin:
    - "CN=GG_USER_EXEMPLE1,OU=EXEMPLE,OU=EXEMPLE,DC=directory,DC=EXEMPLE,DC=com"

```

Edit **roles.yml**

```
admin:
    cluster: all
    indices:
        '*': all

```

To watch the log of the connection, I active it in the file **log4j2.proprieties**

```
logger.authc.name = org.elasticsearch.xpack.security.authc
logger.authc.level = DEBUG

```

So when I log in, the connection is a success.

`[2017-04-04T12:17:29,612][DEBUG][o.e.x.s.a.l.LdapRealm] [Z7NT4T5] authenticated user [f.user], with roles [[GG_USER_EXEMPLE1, GG_USER_EXEMPLE2, GG_USER_EXEMPLE3, GG_USER_EXEMPLE4, GG_USER_EXEMPLE5]]`

However, I can see nothing on the website, all is white. I think I don't have access rights

Do you know what's the problem ?

Thank you

Cordialement  
FJ

---

<div class="post-metadata">

**Author:** ![prodrg](https://avatars.discourse-cdn.com/v4/letter/p/3bc359/32.png) [@prodrg](https://discuss.elastic.co/u/prodrg)\
**Post date:** [April 4, 2017, 10:36pm UTC](https://discuss.elastic.co/t/active-directory-account-not-assigned-to-role/81119/2 "2017-04-04T22:36:30Z")

</div>

You should assign the `kibana_user` role to those accounts on the role mapping file.

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [April 5, 2017, 1:51am UTC](https://discuss.elastic.co/t/active-directory-account-not-assigned-to-role/81119/3 "2017-04-05T01:51:07Z")

</div>

> [@Fabien](#):
>
> [2017-04-04T12:17:29,612][DEBUG][o.e.x.s.a.l.LdapRealm] [Z7NT4T5] authenticated user [f.user], with roles [[GG\_USER\_EXEMPLE1, GG\_USER\_EXEMPLE2, GG\_USER\_EXEMPLE3, GG\_USER\_EXEMPLE4, GG\_USER\_EXEMPLE5]

The `admin` role isn't listed there, which implies that your role\_mapping file isn't working.

```auto
role_mapping: "CONFIG_DIR/x-pack/role_mapping.yml"

```

This probably isn't what you want - that's not a path that X-Pack can understand and unfortunately the system doesn't report an error if it can't find the file.

Just remove the `files.role_mapping` section entirely from your config. `role_mapping.yml` is the default filename, so there's no pointing specifying it explicitly.

Then, try again, and look for `DEBUG` messages from `DnRoleMapper`  
Those messages will tell you how many entries the role mapper finds, and how they are being applied to your user.

---

<div class="post-metadata">

**Author:** ![Fabien](https://avatars.discourse-cdn.com/v4/letter/f/85e7bf/32.png) [@Fabien](https://discuss.elastic.co/u/Fabien)\
**Post date:** [April 5, 2017, 8:09am UTC](https://discuss.elastic.co/t/active-directory-account-not-assigned-to-role/81119/4 "2017-04-05T08:09:39Z")

</div>

> [@TimV](#):
>
> DnRoleMapper

Hello TimV,

Thank your for your answer.

I already tried to remove `files.role_mapping` but it didn't work.  
I think it doesn't find role\_mapping.yml because I have these logs:

```
[2017-04-05T09:36:51,480][DEBUG][o.e.x.s.a.s.DnRoleMapper] [Z7NT4T5] the roles [[]], are mapped from  
the user [CN=Fabien User,OU=SI,OU=EXEMPLE,OU=FR,OU=GROUP,DC=directory,DC=exemple-group,DC=com] 
for realm [active_directory/active_directory]

[2017-04-05T09:30:02,462][DEBUG][o.e.x.s.a.s.DnRoleMapper] [Z7NT4T5] the roles [[]], are mapped from these [active_directory] groups [[CN=GG_USER_EXEMPLE1,OU=ALFRESCO,OU=APPLICATIONS,DC=directory,DC=exemple-group,DC=com, CN=GG_USER_EXEMPLE2,OU=ALFRESCO,OU=APPLICATIONS,DC=directory,DC=exemple-group,DC=com, CN=GG_USER_EXEMPLE3,OU=ALFRESCO,OU=APPLICATIONS,DC=directory,DC=exemple-group,DC=com, CN=GG_USER_EXEMPLE4,OU=ALFRESCO,OU=APPLICATIONS,DC=directory,DC=exemple-group,DC=com]]

```

And I tried with this in **role\_mapping.yml**

```
admin:
    - "CN=Fabien User,OU=SI,OU=EXEMPLE,OU=FR,OU=GROUP,DC=directory,DC=exemple-group,DC=com"

```

However, I tried to move the file **role\_mapping.yml**'s directory and configure `files.role_mapping` like this:

```
files:
    role_mapping: "config/role_mapping.yml"

```

But it didn't work.

Do you think it found **role\_mapping.yml**? Or maybe it's the configuration of my roles in this file (I try à lot of map).

Thank you

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 3, 2017, 8:09am UTC](https://discuss.elastic.co/t/active-directory-account-not-assigned-to-role/81119/5 "2017-05-03T08:09:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.