# Get Shield to recognize the user using PKI auth

**URL:** <https://discuss.elastic.co/t/get-shield-to-recognize-the-user-using-pki-auth/58179>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [August 16, 2016, 7:54pm UTC](https://discuss.elastic.co/t/get-shield-to-recognize-the-user-using-pki-auth/58179 "2016-08-16T19:54:08Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![kqpr0](https://avatars.discourse-cdn.com/v4/letter/k/dc4da7/32.png) [@kqpr0](https://discuss.elastic.co/u/kqpr0)\
**Post date:** [August 16, 2016, 7:54pm UTC](https://discuss.elastic.co/t/get-shield-to-recognize-the-user-using-pki-auth/58179/1 "2016-08-16T19:54:08Z")

</div>

I am currently using Shield to auth users with PKI. Currently when a user with a **CN: John Doe jdoe** navigates to /\_search, the exception:

> type: security\_exception  
> reason: action [indices:data/read/search] is unauthorized for user [John Doe jdoe]

In the access log, it shows that

> access\_denied, principal = [John Doe jdoe], action = [indices:data/read/search], indices=

How do I create a role for this user and assign it to this user so shield can recognize it and show the appropriate data? I tried to add it in users\_roles.yml like below:

> admin:John Doe jdoe, es\_admin

But have no luck. Is it because the empty spaces or other problems?

---

<div class="post-metadata">

**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\
**Post date:** [August 17, 2016, 11:40am UTC](https://discuss.elastic.co/t/get-shield-to-recognize-the-user-using-pki-auth/58179/2 "2016-08-17T11:40:20Z")

</div>

Hi @kqpr0,

You need to edit the `role_mapping.yml` file to add a mapping to a role base on the DN of your certificate. Please see [https://www.elastic.co/guide/en/shield/current/pki-realm.html#assigning-roles-pki](https://www.elastic.co/guide/en/shield/current/pki-realm.html#assigning-roles-pki)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:42pm UTC](https://discuss.elastic.co/t/get-shield-to-recognize-the-user-using-pki-auth/58179/3 "2017-07-06T13:42:16Z")

</div>