# Active Directory Role Mapping in the role\_mapping.yml file

**URL:** <https://discuss.elastic.co/t/active-directory-role-mapping-in-the-role-mapping-yml-file/130357>\
**Category:** Elasticsearch\
**Created:** [May 3, 2018, 4:18am UTC](https://discuss.elastic.co/t/active-directory-role-mapping-in-the-role-mapping-yml-file/130357 "2018-05-03T04:18:28Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![stargate](https://avatars.discourse-cdn.com/v4/letter/s/9d8465/32.png) [@stargate](https://discuss.elastic.co/u/stargate)\
**Post date:** [May 3, 2018, 4:18am UTC](https://discuss.elastic.co/t/active-directory-role-mapping-in-the-role-mapping-yml-file/130357/1 "2018-05-03T04:18:29Z")

</div>

Hi,

I am trying to configure and setup Active Directory(AD) groups in the role\_mapping.yml file for e.g. as shown below:

monitoring:

- "CN=Demo User1,OU=InformationTechnology,OU=Users,DC=example,DC=com"
- "CN=ESSuperAdmin,OU=ElasticStack,OU=ApplicationsDev,DC=example,DC=com"

superuser:

- "CN=ESSuperAdmin,OU=ElasticStack,OU=ApplicationsDev,DC=example,DC=com"

admin:

- "CN=ESAdmin,OU=ElasticStack,OU=ApplicationsDev,DC=example,DC=com"

I am a member of 'ESSuperAdmin' group in AD and when I login to [https://localhost:5601/app/kibana](https://localhost:5601/app/kibana) and click on monitoring, I get access denied error message saying the user is not authorized.

How can I fix this issue, what am I doing wrong here?

Regards,  
Anand

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [May 3, 2018, 5:24am UTC](https://discuss.elastic.co/t/active-directory-role-mapping-in-the-role-mapping-yml-file/130357/2 "2018-05-03T05:24:01Z")

</div>

Hi there,

The way forward would be to enable DEBUG logging and see what groups AD reports back that you belong in, and if something goes wrong with the mapping to roles, or even with the connection to AD. In order to do so

1. Please share your AD realm configuration in `elasticsearch.yml`

2. Enable debug logging:

3. and then attempt to authenticate with your AD user

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 31, 2018, 5:24am UTC](https://discuss.elastic.co/t/active-directory-role-mapping-in-the-role-mapping-yml-file/130357/3 "2018-05-31T05:24:03Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.