# Group\_dn\_templates

**URL:** <https://discuss.elastic.co/t/group-dn-templates/178050>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [April 23, 2019, 1:54pm UTC](https://discuss.elastic.co/t/group-dn-templates/178050 "2019-04-23T13:54:28Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![JamesNotJamez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jamesnotjamez/32/45736_2.png) [@JamesNotJamez](https://discuss.elastic.co/u/JamesNotJamez)\
**Post date:** [April 23, 2019, 1:54pm UTC](https://discuss.elastic.co/t/group-dn-templates/178050/1 "2019-04-23T13:54:28Z")

</div>

Hi,

In the LDAP realm is there an equivalent version of user\_dn\_templates that works for group search? (other than group\_search)

From [https://www.elastic.co/guide/en/elasticsearch/reference/current/configuring-ldap-realm.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/configuring-ldap-realm.html)

Cheers

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [April 23, 2019, 1:59pm UTC](https://discuss.elastic.co/t/group-dn-templates/178050/2 "2019-04-23T13:59:09Z")

</div>

No, not really. `user_dn_templates` is useful as there is a very common case where all users are under the same `OrganizationalUnit` in LDAP and as such their DN has a very predictable and static relation to the `uid` they are used to enter in the login forms. This is not the case for groups.

Maybe if you explain what you want to achieve, we could offer some possible solutions.

---

<div class="post-metadata">

**Author:** ![JamesNotJamez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jamesnotjamez/32/45736_2.png) [@JamesNotJamez](https://discuss.elastic.co/u/JamesNotJamez)\
**Post date:** [April 23, 2019, 2:05pm UTC](https://discuss.elastic.co/t/group-dn-templates/178050/3 "2019-04-23T14:05:09Z")

</div>

Thanks for the speedy reply,  
Like with users all of our groups lie under the same Organization unit, so I was hoping by having a more specific search in the yml we could avoid having to define the whole group path when creating role mappings and just give the group name, much like we do with users.

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [April 23, 2019, 3:49pm UTC](https://discuss.elastic.co/t/group-dn-templates/178050/4 "2019-04-23T15:49:49Z")

</div>

I see. So this is not about group search per se, but more about group name resolution when it comes to role mapping.

If I get this right, you have  
`cn=group1,ou=groups,dc=company,dc=com`  
`cn=group2,ou=groups,dc=company,dc=com`  
...  
`cn=group100,ou=groups,dc=company,dc=com`

and you would like to set role mappings like

```auto
POST /_xpack/security/role_mapping/mapping1
{
  "roles": ["user"],
  "enabled": true, 
  "rules": {
    "field" : { "groups" : "group1" }
  },
  "metadata" : { 
    "version" : 1
  }
}

```

or file based like

```auto
admin:
  - "group100"

```

instead of

```auto
POST /_xpack/security/role_mapping/mapping1
{
  "roles": ["user"],
  "enabled": true, 
  "rules": {
    "field" : { "groups" : "group1,ou=groups,dc=company,dc=com" }
  },
  "metadata" : { 
    "version" : 1
  }
}

```

or

```auto
admin:
  - "group100,ou=groups,dc=company,dc=com"

```

There is unfortunately no setting/option that can help you with this at this time.

---

<div class="post-metadata">

**Author:** ![JamesNotJamez](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jamesnotjamez/32/45736_2.png) [@JamesNotJamez](https://discuss.elastic.co/u/JamesNotJamez)\
**Post date:** [April 24, 2019, 7:29am UTC](https://discuss.elastic.co/t/group-dn-templates/178050/5 "2019-04-24T07:29:38Z")

</div>

> [@ikakavas](#):
>
> ...

Yeah this is exactly what I was thinking. No worries, thanks for the clarification 😃

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 22, 2019, 7:29am UTC](https://discuss.elastic.co/t/group-dn-templates/178050/6 "2019-05-22T07:29:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.