# AD authentication not working correctly

**URL:** <https://discuss.elastic.co/t/ad-authentication-not-working-correctly/176006>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [April 9, 2019, 10:14am UTC](https://discuss.elastic.co/t/ad-authentication-not-working-correctly/176006 "2019-04-09T10:14:55Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![wiliamauc85](https://avatars.discourse-cdn.com/v4/letter/w/bc8723/32.png) [@wiliamauc85](https://discuss.elastic.co/u/wiliamauc85)\
**Post date:** [April 9, 2019, 10:14am UTC](https://discuss.elastic.co/t/ad-authentication-not-working-correctly/176006/1 "2019-04-09T10:14:55Z")

</div>

Hi,

I'm trying out AD authentication and managed to get it working when I map a group to the superuser role, however when i create a new mapping and map it to a role that has less privileges, i always get the following error

```
$ curl -XGET -u elasticuser@somedomain.co.uk:password! "http://elastic1:9200/products/_search"
{"error":{"root_cause":[{"type":"security_exception","reason":"action [indices:data/read/search] is unauthorized for user [elasticuser@somedomain.co.uk]"}],"type":"security_exception","reason":"action [indices:data/read/search] is unauthorized for user [elasticuser@somedomain.co.uk]"},"status":403}

```

The test user is in a the ElasticUsers group and I have this role\_mapping in place

```
  "mapping1" : {
    "enabled" : true,
    "roles" : [
      "test_role1",
      "kibana_user"
    ],
    "rules" : {
      "field" : {
        "groups" : "CN=ElasticUsers,OU=ElasticGroups,OU=Elasticsearch,DC=somedomain,DC=co,DC=uk"
      }
    },
    "metadata" : { }
  }
}

```

Admins have this mapping

```
{
  "mapping2" : {
    "enabled" : true,
    "roles" : [
      "superuser"
    ],
    "rules" : {
      "field" : {
        "groups" : "CN=ElasticAdmins,OU=ElasticGroups,OU=Elasticsearch,DC=somedomain,DC=co,DC=uk"
      }
    },
    "metadata" : { }
  }
}

```

Here's my elasticsearch.yml realm settings

```
#AD realm
xpack:
  security:
    authc:
      realms:
        active_directory:
          type: active_directory
          order: 0
          domain_name: somedomain.co.uk
          url: ldap://AS-server:389
          bind_dn: elasticldap@somedomain.co.uk
          bind_password: password
          group_search:
            base_dn: "OU=ElasticGroups,OU=Elasticsearch,DC=somedomain,DC=co,DC=uk"
          follow_referrals: false

```

Any ideas as to why it's working for users in the ElasticAdmins group, but not for the ElasticUsers group?

Thanks

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [April 9, 2019, 10:49am UTC](https://discuss.elastic.co/t/ad-authentication-not-working-correctly/176006/2 "2019-04-09T10:49:22Z")

</div>

> [@wiliamauc85](#):
>
> Any ideas as to why it's working for users in the ElasticAdmins group, but not for the ElasticUsers group?

Hi there,

You didn't explain exactly what doesn't work. Your error message says that the `elasticuser@somedomain.co.uk` user doesn't have read privileges in your `products` index.

Now, you have a role mapping that gives the role `test_role1` to users that belong to the `CN=ElasticUsers` group .  
What is the definition of this `test_role1` ? Does it give the necessary permissions to the index you need ?

You can check all the roles that the user gets with the Authenticate API :

```auto
curl -XGET -u elasticuser@somedomain.co.uk:password! "http://elastic1:9200/_xpack/security/_authenticate"

```

this will tell you if the role is mapped to the user or not.

Then, can you share the output of (authenticating as the `elastic` user, or an AD user that gets the superuser role)

```auto
curl -XGET -u elastic:YOURPASSWD "http://elastic1:9200/_xpack/security/role/test_role1"

```

this will let us know if the `test_role1` definition is correct, as in if it grants the necessary permissions to your users to access what you want them to access

---

<div class="post-metadata">

**Author:** ![wiliamauc85](https://avatars.discourse-cdn.com/v4/letter/w/bc8723/32.png) [@wiliamauc85](https://discuss.elastic.co/u/wiliamauc85)\
**Post date:** [April 9, 2019, 12:42pm UTC](https://discuss.elastic.co/t/ad-authentication-not-working-correctly/176006/3 "2019-04-09T12:42:58Z")

</div>

Thanks for the tip, checked and the roles and mappings were correct, I actually managed to found out what the issue was and turns out there was a typo for the ElasticUsers group in AD.  
When I corrected the typo, I was able to log into Kibana as the the elasticuser

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 7, 2019, 12:46pm UTC](https://discuss.elastic.co/t/ad-authentication-not-working-correctly/176006/4 "2019-05-07T12:46:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.