# Configuring AD realm to authenticate to Elastic Search **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [December 27, 2019, 6:07pm UTC](https://discuss.elastic.co/t/configuring-ad-realm-to-authenticate-to-elastic-search/213218 "2019-12-27T18:07:47Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![rambaliga](https://avatars.discourse-cdn.com/v4/letter/r/5f9b8f/32.png) [@rambaliga](https://discuss.elastic.co/u/rambaliga)\ **Post date:** [December 27, 2019, 6:07pm UTC](https://discuss.elastic.co/t/configuring-ad-realm-to-authenticate-to-elastic-search/213218/1 "2019-12-27T18:07:47Z")
Hi, I am trying to configure AD realm inorder to authenticate to Elastic search ( version 6.6.1). My elasticsearch.yml and role\_mapping.yml looks like below. elasticsearch.yml: ```auto Xpack: security: authc: realms: active_directory: type: active_directory order: 0 domain_name: ds.dev.accenture.com url: ldap://amrdc1711.ds.dev.accenture.com:389 bind_dn: adt_ldap@ds.dev.accenture.com ``` role\_mapping.yml : ```auto power_user: - "CN=ALMADMINDEV,OU=Groups,DC=ds,DC=dev,DC=accenture,DC=com" user: - "CN=ads.rullas,OU=Operations,DC=ds,DC=dev,DC=accenture,DC=com" ``` ALMADMINDEV is the AD group in DS domain that I am trying to map to, and ads.rullas is a member of that group. Whenever I try authenticating Elastic search over a browser i.e : [http://10.140.7.4:9200/](http://10.140.7.4:9200/) , I get 403 error. Although in the logs I am not seeing any error : ```auto [2019-12-27T06:48:54,876][DEBUG][o.e.x.s.a.l.ActiveDirectorySessionFactory] [WMDjAWI] Resolving LDAP groups + meta-data for user [CN=ads.rullas,OU=Operations,DC=ds,DC=dev,DC=accenture,DC=com] [2019-12-27T06:48:54,966][DEBUG][o.e.x.s.a.l.ActiveDirectorySessionFactory] [WMDjAWI] group SID to DN [CN=ads.rullas,OU=Operations,DC=ds,DC=dev,DC=accenture,DC=com] search filter: [(|(objectSid=S-1-5-21-861567501-413027322-1801674531-4620177)(objectSid=S-1-5-21-861567501-413027322-1801674531-2835479)(objectSid=S-1-5-21-861567501-413027322-1801674531-513)(objectSid=S-1-5-21-861567501-413027322-1801674531-2936633)(objectSid=S-1-5-21-861567501-413027322-1801674531-2835475)(objectSid=S-1-5-21-861567501-413027322-1801674531-4012821))] [2019-12-27T06:48:55,056][DEBUG][o.e.x.s.a.l.ActiveDirectorySessionFactory] [WMDjAWI] Resolved 6 LDAP groups [[CN=Domain Users,OU=Operations,DC=ds,DC=dev,DC=accenture,DC=com, CN=CIO.SmartKeepAlive.HubViewers,OU=Groups,DC=ds,DC=dev,DC=accenture,DC=com, CN=CIO.SmartKeepAlive.Viewers,OU=Groups,DC=ds,DC=dev,DC=accenture,DC=com, CN=CIORDS.GW.Access,OU=Groups,DC=ds,DC=dev,DC=accenture,DC=com, CN=AZRSG.CIORDS.DEV.SQL.Access,OU=Groups,DC=ds,DC=dev,DC=accenture,DC=com, CN=ALMADMINDEV,OU=Groups,DC=ds,DC=dev,DC=accenture,DC=com]] for user [CN=ads.rullas,OU=Operations,DC=ds,DC=dev,DC=accenture,DC=com] [2019-12-27T06:48:55,056][DEBUG][o.e.x.s.a.l.ActiveDirectorySessionFactory] [WMDjAWI] Resolved 0 meta-data fields [{}] for user [CN=ads.rullas,OU=Operations,DC=ds,DC=dev,DC=accenture,DC=com] [2019-12-27T06:48:55,057][DEBUG][o.e.x.s.a.s.DnRoleMapper] [WMDjAWI] the roles [[power_user]], are mapped from these [active_directory] groups [[CN=CIO.SmartKeepAlive.Viewers,OU=Groups,DC=ds,DC=dev,DC=accenture,DC=com, CN=CIORDS.GW.Access,OU=Groups,DC=ds,DC=dev,DC=accenture,DC=com, CN=ALMADMINDEV,OU=Groups,DC=ds,DC=dev,DC=accenture,DC=com, CN=AZRSG.CIORDS.DEV.SQL.Access,OU=Groups,DC=ds,DC=dev,DC=accenture,DC=com, CN=Domain Users,OU=Operations,DC=ds,DC=dev,DC=accenture,DC=com, CN=CIO.SmartKeepAlive.HubViewers,OU=Groups,DC=ds,DC=dev,DC=accenture,DC=com]] using file [role_mapping.yml] for realm [active_directory/active_directory] [2019-12-27T06:48:55,057][DEBUG][o.e.x.s.a.s.DnRoleMapper] [WMDjAWI] the roles [[user]], are mapped from the user [cn=ads.rullas,ou=operations,dc=ds,dc=dev,dc=accenture,dc=com] using file [role_mapping.yml] for realm [active_directory/active_directory] [2019-12-27T06:48:55,057][INFO][o.e.x.s.a.s.m.NativeRoleMappingStore] [WMDjAWI] The security index is not yet available - no role mappings can be loaded [2019-12-27T06:48:55,057][DEBUG][o.e.x.s.a.s.m.NativeRoleMappingStore] [WMDjAWI] Security Index [.security] [exists: false] [available: false] [mapping up to date: true] [2019-12-27T06:48:55,057][DEBUG][o.e.x.s.a.s.m.NativeRoleMappingStore] [WMDjAWI] Mapping user [UserData{username:ads.rullas; dn:CN=ads.rullas,OU=Operations,DC=ds,DC=dev,DC=accenture,DC=com; groups:[CN=CIO.SmartKeepAlive.Viewers,OU=Groups,DC=ds,DC=dev,DC=accenture,DC=com, CN=CIORDS.GW.Access,OU=Groups,DC=ds,DC=dev,DC=accenture,DC=com, CN=ALMADMINDEV,OU=Groups,DC=ds,DC=dev,DC=accenture,DC=com, CN=AZRSG.CIORDS.DEV.SQL.Access,OU=Groups,DC=ds,DC=dev,DC=accenture,DC=com, CN=Domain Users,OU=Operations,DC=ds,DC=dev,DC=accenture,DC=com, CN=CIO.SmartKeepAlive.HubViewers,OU=Groups,DC=ds,DC=dev,DC=accenture,DC=com]; metadata:{ldap_dn=CN=ads.rullas,OU=Operations,DC=ds,DC=dev,DC=accenture,DC=com, ldap_groups=[CN=Domain Users,OU=Operations,DC=ds,DC=dev,DC=accenture,DC=com, CN=CIO.SmartKeepAlive.HubViewers,OU=Groups,DC=ds,DC=dev,DC=accenture,DC=com, CN=CIO.SmartKeepAlive.Viewers,OU=Groups,DC=ds,DC=dev,DC=accenture,DC=com, CN=CIORDS.GW.Access,OU=Groups,DC=ds,DC=dev,DC=accenture,DC=com, CN=AZRSG.CIORDS.DEV.SQL.Access,OU=Groups,DC=ds,DC=dev,DC=accenture,DC=com, CN=ALMADMINDEV,OU=Groups,DC=ds,DC=dev,DC=accenture,DC=com]}; realm=active_directory}] to roles [[]] [2019-12-27T06:50:49,386][DEBUG][o.e.x.s.a.l.LdapRealm] [WMDjAWI] realm [active_directory] authenticated user [ads.rullas], with roles [[power_user, user]] [2019-12-27T06:53:13,357][DEBUG][o.e.x.s.a.l.LdapRealm] [WMDjAWI] realm [active_directory] authenticated user [ads.rullas], with roles [[power_user, user]] ``` When I do a curl on my linux box, I get below 403 error. ```auto [ads.rullas@vw526474 config]$ curl -u ads.rullas "http://10.140.17.4:9200/" Enter host password for user 'ads.rullas': {"error":{"root_cause":[{"type":"security_exception","reason":"action [cluster:monitor/main] is unauthorized for user [ads.rullas]" tion","reason":"action [cluster:monitor/main] is unauthorized for user [ads.rullas]"},"status":403} ``` I am able to access the url only through the built in user "elastic" for which the password is set in bootstrap.password [ads.rullas@vw526474 bin]$ ./elasticsearch-keystore list ```auto bootstrap.password keystore.seed xpack.security.authc.realms.active_directory.secure_bind_password xpack.security.http.ssl.keystore.secure_password xpack.security.http.ssl.truststore.secure_password xpack.security.transport.ssl.keystore.secure_password xpack.security.transport.ssl.truststore.secure_password ``` Not sure what I am missing in role\_mapping.yml that is causing the issue. Kindly suggest. Note : I only one have ES node and trying to integrate with AD for now. Regards Ram ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [December 29, 2019, 11:52pm UTC](https://discuss.elastic.co/t/configuring-ad-realm-to-authenticate-to-elastic-search/213218/2 "2019-12-29T23:52:24Z")
Did you create `power_user` and `user` roles? Your role mappping is working fine: ```auto [2019-12-27T06:53:13,357][DEBUG][o.e.x.s.a.l.LdapRealm] [WMDjAWI] realm [active_directory] authenticated user [ads.rullas], with roles [[power_user, user]] ``` But you haven't shown us any definition of those 2 roles, so my guess is that you simply copied them from the example in the docs, and didn't actually define them anywhere. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 26, 2020, 11:52pm UTC](https://discuss.elastic.co/t/configuring-ad-realm-to-authenticate-to-elastic-search/213218/3 "2020-01-26T23:52:34Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.