# Elastic Cloud: Defining roles to user in Okta using SAML

**URL:** <https://discuss.elastic.co/t/elastic-cloud-defining-roles-to-user-in-okta-using-saml/343153>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [September 15, 2023, 4:02pm UTC](https://discuss.elastic.co/t/elastic-cloud-defining-roles-to-user-in-okta-using-saml/343153 "2023-09-15T16:02:36Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Buddha](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/buddha/32/101523_2.png) [@Buddha](https://discuss.elastic.co/u/Buddha)\
**Post date:** [September 15, 2023, 4:02pm UTC](https://discuss.elastic.co/t/elastic-cloud-defining-roles-to-user-in-okta-using-saml/343153/1 "2023-09-15T16:02:36Z")

</div>

Hello,

Right now, I'm defining roles for user using the security api

```plaintext
POST /_security/role_mapping/viewer_mapping
{
  "roles": ["custome_role_viewer"],
  "enabled": true, 
  "rules": {
    "field" : { "username" : ["username.one@email.com", "username.two@email.com"] }
  },
  "metadata" : { 
    "version" : 1
  }
}

POST /_security/role_mapping/admin_mapping
{
  "roles": ["custome_role_admin"],
  "enabled": true, 
  "rules": {
    "field" : { "username" : ["username.eight@email.com", "username.nine@email.com"] }
  },
  "metadata" : { 
    "version" : 1
  }
}

```

I would like to handle this within Otka, is this possible?

Mike

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [September 20, 2023, 1:59am UTC](https://discuss.elastic.co/t/elastic-cloud-defining-roles-to-user-in-okta-using-saml/343153/2 "2023-09-20T01:59:37Z")

</div>

> [@Buddha](#):
>
> I would like to handle this within Otka, is this possible?

Yes.

What fields do you have in Okta that you want to use for this?

The usual approach is to configure Okta to send a list of _groups_ or _teams_ within the SAML assertion, and them map those teams to Elasticsearch roles.  
That prevents internal ES role names from being embedded in Okta configuration - the on-wire protocol represents your organisational structure and ES knows how to map your org structure into specific roles.  
You can, however, send actual role names across to ES and automatically assign them to users if you want to align your ES role names to a set of names that exist in Okta.

The Create role mappings API docs have examples of both options.

- [Create or update role mappings API | Elasticsearch Guide [8.11] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-put-role-mapping.html)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 18, 2023, 1:59am UTC](https://discuss.elastic.co/t/elastic-cloud-defining-roles-to-user-in-okta-using-saml/343153/3 "2023-10-18T01:59:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.