# Active Directory Role Mappings to Groups

**URL:** <https://discuss.elastic.co/t/active-directory-role-mappings-to-groups/236621>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [June 11, 2020, 5:56am UTC](https://discuss.elastic.co/t/active-directory-role-mappings-to-groups/236621 "2020-06-11T05:56:12Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![AClerk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aclerk/32/55297_2.png) [@AClerk](https://discuss.elastic.co/u/AClerk)\
**Post date:** [June 11, 2020, 5:56am UTC](https://discuss.elastic.co/t/active-directory-role-mappings-to-groups/236621/1 "2020-06-11T05:56:13Z")

</div>

Hey,  
I am trying to map roles to AD groups. But can't get it working.

I tried the following

```auto
PUT /_security/role_mapping/Lvl-3
{
  "roles" : ["Level_3"],
  "rules" : { "field" : { "groups" : "OU=Ops_Intel_Groups,OU=Accounts_Groups,CN=Lvl-3,DC=DOMAIN,DC=local" } },
  "enabled": true
}

```

I tried with upper case and lower case. i.e. OU/ou, CN/cn, etc.

This is the AD structure/hierarchy  
 ![AD_Structure](https://us1.discourse-cdn.com/elastic/original/3X/b/9/b980402c66b8d6ddb39b92b8379689ba6dca5d8c.png)

Under Ops\_Intel\_Groups there are a few security groups and one of them is Lvl-3  
 ![AD_Groups](https://us1.discourse-cdn.com/elastic/original/3X/4/7/47fcb1b4672801c762ed1962cc62ebfa01d2588d.png)

This is elasticsearch.yml

```auto
xpack.security.authc.realms:
  active_directory.active_directory_1:
    order: 0
    enabled: true
    domain_name: "DOMAIN.local"
    url: ["ldaps://server1:636", "ldaps://server2:636", "ldaps://server3:636", "ldaps://server4:636", "ldaps://server5:636", "ldaps://server6:636"]
    load_balance.type: failover
    ssl.certificate_authorities: ["pem.pem"]
    ssl.verification_mode: certificate

```

**Anything missing?** or maybe wrong syntax?

When I map a single user to a role, it works fine. The issue is with AD groups.

Thanks!

---

<div class="post-metadata">

**Author:** ![AClerk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aclerk/32/55297_2.png) [@AClerk](https://discuss.elastic.co/u/AClerk)\
**Post date:** [June 11, 2020, 6:35am UTC](https://discuss.elastic.co/t/active-directory-role-mappings-to-groups/236621/2 "2020-06-11T06:35:15Z")

</div>

In the log I see the following

```auto
[2020-06-11T16:26:15,081][DEBUG][o.e.x.s.a.AuthenticationService]
[SERVER] Authentication of [myuser@domain.local] 
using realm [active_directory/active_directory_1] 
with token [UsernamePasswordToken] 
was [AuthenticationResult{status=SUCCESS, ...
...
...
}]

```

**status=SUCCESS??**

Then I get

```auto
{"statusCode":403,"error":"Forbidden","message":"Forbidden"}

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 9, 2020, 6:35am UTC](https://discuss.elastic.co/t/active-directory-role-mappings-to-groups/236621/3 "2020-07-09T06:35:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.