# Kibana authentication error **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [October 4, 2016, 4:52pm UTC](https://discuss.elastic.co/t/kibana-authentication-error/62189 "2016-10-04T16:52:30Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![piyush](https://avatars.discourse-cdn.com/v4/letter/p/ecb155/32.png) [@piyush](https://discuss.elastic.co/u/piyush)\ **Post date:** [October 4, 2016, 4:52pm UTC](https://discuss.elastic.co/t/kibana-authentication-error/62189/1 "2016-10-04T16:52:30Z")
Hi Team, I configured shield and trying to connect from Kibana for different Active Directory group. The 1st group is working properly but when i put two roles in roles\_mapping.yml file, kibana is throwing error: And do we need to restart elasticsearch nodes after roles\_mapping.yml changes? i believe NO but please confirm. PFB error: Error: unhandled courier request error: [security\_exception] action [indices:data/read/mget] is unauthorized for user [USER-1] at handleError ([http://1.1.1.1:5601/bundles/kibana.bundle.js?v=9889:89247:23](http://1.1.1.1:5601/bundles/kibana.bundle.js?v=9889:89247:23)) at DocRequest.AbstractReqProvider.AbstractReq.handleFailure ([http://1.1.1.1:5601/bundles/kibana.bundle.js?v=9889:89167:15](http://1.1.1.1:5601/bundles/kibana.bundle.js?v=9889:89167:15)) at [http://1.1.1.1:5601/bundles/kibana.bundle.js?v=9889:89061:18](http://1.1.1.1:5601/bundles/kibana.bundle.js?v=9889:89061:18) at Array.forEach (native) at [http://1.1.1.1:5601/bundles/kibana.bundle.js?v=9889:89059:19](http://1.1.1.1:5601/bundles/kibana.bundle.js?v=9889:89059:19) at processQueue ([http://1.1.1.1:5601/bundles/commons.bundle.js?v=9889:41836:29](http://1.1.1.1:5601/bundles/commons.bundle.js?v=9889:41836:29)) at [http://1.1.1.1:5601/bundles/commons.bundle.js?v=9889:41852:28](http://1.1.1.1:5601/bundles/commons.bundle.js?v=9889:41852:28) at Scope.$eval ([http://1.1.1.1:5601/bundles/commons.bundle.js?v=9889:43080:29](http://1.1.1.1:5601/bundles/commons.bundle.js?v=9889:43080:29)) at Scope.$digest ([http://1.1.1.1:5601/bundles/commons.bundle.js?v=9889:42891:32](http://1.1.1.1:5601/bundles/commons.bundle.js?v=9889:42891:32)) at Scope.$apply ([http://1.1.1.1:5601/bundles/commons.bundle.js?v=9889:43188:25](http://1.1.1.1:5601/bundles/commons.bundle.js?v=9889:43188:25)) roles\_mapping.yml: admin: - "CN=gp-ops-es-admin,OU=groups,OU=ops,OU=ccs,DC=ad,DC=dsi,DC=----,DC=com" abcdadmin: - "CN=gp------es-admin,OU=groups,OU=----,OU=ccs,DC=ad,DC=----,DC=----,DC=com" Thanks & Regards ---
**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\ **Post date:** [October 10, 2016, 7:50pm UTC](https://discuss.elastic.co/t/kibana-authentication-error/62189/2 "2016-10-10T19:50:19Z")
There is no need to restart for changes in the role mapping. Are there any errors on the elasticsearch side? Is the user supposed to be mapped to both roles? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:41pm UTC](https://discuss.elastic.co/t/kibana-authentication-error/62189/3 "2017-07-06T13:41:38Z")