# How to use ldap realm for authorisation for SAML realm

**URL:** <https://discuss.elastic.co/t/how-to-use-ldap-realm-for-authorisation-for-saml-realm/183095>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [May 28, 2019, 12:41pm UTC](https://discuss.elastic.co/t/how-to-use-ldap-realm-for-authorisation-for-saml-realm/183095 "2019-05-28T12:41:34Z")\
**Posts on this page:** 1\
**Showing post:** 7

<div class="post-metadata">

**Author:** ![Ronnie16](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ronnie16/32/66399_2.png) [@Ronnie16](https://discuss.elastic.co/u/Ronnie16)\
**Post date:** [June 11, 2019, 3:45pm UTC](https://discuss.elastic.co/t/how-to-use-ldap-realm-for-authorisation-for-saml-realm/183095/7 "2019-06-11T15:45:13Z")

</div>

@ikakavas Yes I'm considering value of groups attribute to do role mappings for SAML. I have followed this  
[https://www.elastic.co/guide/en/elastic-stack-overview/6.7/saml-role-mapping.html](https://www.elastic.co/guide/en/elastic-stack-overview/6.7/saml-role-mapping.html)

I'm able to do mappings with username but not with groups.  
The below works-

```
PUT _security/role_mapping/saml-kibana' -H 'Content-Type: application/json' -d'
{
"roles": ["events-admin"],
"enabled": true,
"rules": { "all": [
{ "field": { "realm.name": "saml1" } },
{ "field": { "username": "rgujral@apple.com" } }
]}
}'

```

But not when I try to map group for accessing saml (already mapped in IDP)

```
PUT _security/role_mapping/saml-kibana-group" -H 'Content-Type: application/json' -d'
{
"roles": ["superuser"],
"enabled": true,
"rules": { "all": [
{ "field": { "realm.name": "saml1" } },
{ "field": { "groups": "10606723" } }
] 
} 
}'
```

---

_[View the full topic](https://discuss.elastic.co/t/how-to-use-ldap-realm-for-authorisation-for-saml-realm/183095)._