# After enabling SAML Role mapping not working

**URL:** <https://discuss.elastic.co/t/after-enabling-saml-role-mapping-not-working/286041>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [October 6, 2021, 2:19pm UTC](https://discuss.elastic.co/t/after-enabling-saml-role-mapping-not-working/286041 "2021-10-06T14:19:48Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![muralikri32](https://avatars.discourse-cdn.com/v4/letter/m/4af34b/32.png) [@muralikri32](https://discuss.elastic.co/u/muralikri32)\
**Post date:** [October 6, 2021, 2:19pm UTC](https://discuss.elastic.co/t/after-enabling-saml-role-mapping-not-working/286041/1 "2021-10-06T14:19:49Z")

</div>

Hi Chaps,

I am trying to configure SSO in On-premises Elasticsearch setup. After configuring SAML (Azure AD) users are able to login to domain password. But users are not been restricted based the roles which i defined. If i set only one role to view one set of indexes alone, it works fine as expected. if I add other Role mapping to allow users to view selective indexes, it consider both roles and whatever usesr I am adding at AD end it give both permission to them.

These are working fine for local users, but this issue persist only on SAML configs. Please help to fix this.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/e/1e5cf051e6f649a5454f755568e3440623d70d22.png)  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/b/1be6999f567372884ebbcc8b7dae8d9c59168929.png)  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/f/bf30028729b38beb8582b60255e5579256889aed.png)

---

<div class="post-metadata">

**Author:** ![Yang\_Wang](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yang_wang/32/48857_2.png) [@Yang\_Wang](https://discuss.elastic.co/u/Yang_Wang)\
**Post date:** [October 7, 2021, 12:11am UTC](https://discuss.elastic.co/t/after-enabling-saml-role-mapping-not-working/286041/2 "2021-10-07T00:11:52Z")

</div>

What exactly are the role mapping rules you are using? Based on the screenshot, they look identical to me (both based on `realm.name`). If you want to grant users from the same AD with different roles, you need differentiate these users based on something that is not just `realm.name`.

---

<div class="post-metadata">

**Author:** ![muralikri32](https://avatars.discourse-cdn.com/v4/letter/m/4af34b/32.png) [@muralikri32](https://discuss.elastic.co/u/muralikri32)\
**Post date:** [October 7, 2021, 9:15am UTC](https://discuss.elastic.co/t/after-enabling-saml-role-mapping-not-working/286041/3 "2021-10-07T09:15:18Z")

</div>

Hi,

But we have only 4 options (username,groups,DN) to declare in the role mapping apart from real.name. I am trying to grant user privileges from same AD with different roles. I thought that users will be differentiate based on the roles which we create. from AD end end whenever users I am adding i will assign the role accordingly, based on that role assigned the user will get access isn't?  
I am sharing the role mapping setting for both for referrence, just let me know is this right one.  
Produser rolemapping:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/3/8394311e8c3bdaaa6bc9854498a8e62b3c3f5e19.png)

Nonproduser role mapping:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/1/b11413da80398deeb7ea1211dc2173d68b78e5a0.png)

if i need to differentiate te users which coming from same ad, what value do i need to provide in rule options apart from realm.name ? if i have 5 roles to be create then how it is feasible here. Please suggest.

---

<div class="post-metadata">

**Author:** ![legoguy1000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/legoguy1000/32/54301_2.png) [@legoguy1000](https://discuss.elastic.co/u/legoguy1000)\
**Post date:** [October 7, 2021, 12:30pm UTC](https://discuss.elastic.co/t/after-enabling-saml-role-mapping-not-working/286041/4 "2021-10-07T12:30:56Z")

</div>

If u have groups in AD, you'll need to add conditions in ur role mappings to require those groups. That way different AD groups get different roles in elastic.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 4, 2021, 12:30pm UTC](https://discuss.elastic.co/t/after-enabling-saml-role-mapping-not-working/286041/5 "2021-11-04T12:30:59Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.