# AD User and AD Group in Single Role Mapping

**URL:** <https://discuss.elastic.co/t/ad-user-and-ad-group-in-single-role-mapping/244088>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [August 6, 2020, 7:39pm UTC](https://discuss.elastic.co/t/ad-user-and-ad-group-in-single-role-mapping/244088 "2020-08-06T19:39:42Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tony\_Chirillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tony_chirillo/32/22647_2.png) [@Tony\_Chirillo](https://discuss.elastic.co/u/Tony_Chirillo)\
**Post date:** [August 6, 2020, 7:39pm UTC](https://discuss.elastic.co/t/ad-user-and-ad-group-in-single-role-mapping/244088/1 "2020-08-06T19:39:42Z")

</div>

Is it possible to have a role mapping that targets an AD group as well as a single AD user? I am trying the following code from DEV Tools, but can't get it work. I have only been able to get a list of groups to work and a list of users (dn's), not a combo of the two in a role mapping. Thoughts?

```
PUT /_security/role_mapping/exchange_ad
{
  "roles" : ["exchange_ad","kibana_user", "monitoring_user", "reporting_user"],
  "rules" : {
      { "field" : { "dn" : "CN=chirilloj,OU=Active,OU=UMAD\ Users,DC=my,DC=domain,DC=com" } },
      { "field" : { "groups" : "CN=UM\ -\ IT\ Email\ Server\ Team,CN=Users,DC=my,DC=domain,DC=com" } }
  },
  "enabled": true
}
```

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [August 6, 2020, 8:13pm UTC](https://discuss.elastic.co/t/ad-user-and-ad-group-in-single-role-mapping/244088/2 "2020-08-06T20:13:41Z")

</div>

Hi there,

You need to combine your two rules with an `any` clause, see an example here [https://www.elastic.co/guide/en/elasticsearch/reference/7.8/security-api-put-role-mapping.html](https://www.elastic.co/guide/en/elasticsearch/reference/7.8/security-api-put-role-mapping.html)

---

<div class="post-metadata">

**Author:** ![Tony\_Chirillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tony_chirillo/32/22647_2.png) [@Tony\_Chirillo](https://discuss.elastic.co/u/Tony_Chirillo)\
**Post date:** [August 6, 2020, 8:45pm UTC](https://discuss.elastic.co/t/ad-user-and-ad-group-in-single-role-mapping/244088/3 "2020-08-06T20:45:27Z")

</div>

Ok. I think my syntax is correct now, with the "any" statement. Does this look correct? Dev Tools does not like it.

```
PUT /_security/role_mapping/exchange_ad
{
  "roles" : ["exchange_ad","kibana_user", "monitoring_user", "reporting_user"],
  "rules" : { "any" : [
      { "field" : { "dn" : "CN=chirilloj,OU=Active,OU=UMAD\ Users,DC=my,DC=domain,DC=com" } },
      { "field" : { "groups" : "CN=UM\ -\ IT\ Email\ Server\ Team,CN=Users,DC=my,DC=domain,DC=com" } }
  ] },
  "enabled": true
}

```

Red "x" shows bad string.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/b/3bafba70b15e0824054631e87679f65e212743ed.png)

Errors from Dev Tools:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/b/6bf99bcc5c4381d0e9e5c9d792c7d0610ce65097.png)

---

<div class="post-metadata">

**Author:** ![Tony\_Chirillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tony_chirillo/32/22647_2.png) [@Tony\_Chirillo](https://discuss.elastic.co/u/Tony_Chirillo)\
**Post date:** [August 6, 2020, 8:59pm UTC](https://discuss.elastic.co/t/ad-user-and-ad-group-in-single-role-mapping/244088/4 "2020-08-06T20:59:02Z")

</div>

I tried double slashes to escape the space, which got the red X to go away, but then dev tools returned:

{  
"role\_mapping" : {  
"created" : false  
}  
}

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [August 6, 2020, 9:02pm UTC](https://discuss.elastic.co/t/ad-user-and-ad-group-in-single-role-mapping/244088/5 "2020-08-06T21:02:14Z")

</div>

Not sure what space you are referring to, but `created: false` is fine. It just means that if updated the existing `exchange_ad` role mapping and didn't create a new one.

---

<div class="post-metadata">

**Author:** ![Tony\_Chirillo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tony_chirillo/32/22647_2.png) [@Tony\_Chirillo](https://discuss.elastic.co/u/Tony_Chirillo)\
**Post date:** [August 6, 2020, 9:32pm UTC](https://discuss.elastic.co/t/ad-user-and-ad-group-in-single-role-mapping/244088/6 "2020-08-06T21:32:42Z")

</div>

Ahh, thanks for the info! I checked and both the user and group are listed now. I have to escape out the spaces in the DN Active Directory path.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 3, 2020, 9:32pm UTC](https://discuss.elastic.co/t/ad-user-and-ad-group-in-single-role-mapping/244088/7 "2020-09-03T21:32:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.