# Kibana SAML SSO Issue with spaces - "unauthorized to GetAll spaces"

**URL:** <https://discuss.elastic.co/t/kibana-saml-sso-issue-with-spaces-unauthorized-to-getall-spaces/297199>\
**Category:** Kibana\
**Tags:** elastic-stack-security\
**Created:** [February 14, 2022, 10:00pm UTC](https://discuss.elastic.co/t/kibana-saml-sso-issue-with-spaces-unauthorized-to-getall-spaces/297199 "2022-02-14T22:00:09Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![techguy20](https://avatars.discourse-cdn.com/v4/letter/t/a8b319/32.png) [@techguy20](https://discuss.elastic.co/u/techguy20)\
**Post date:** [February 14, 2022, 10:00pm UTC](https://discuss.elastic.co/t/kibana-saml-sso-issue-with-spaces-unauthorized-to-getall-spaces/297199/1 "2022-02-14T22:00:09Z")

</div>

Kibana 7.17 - self managed instance

We have SAML SSL working well Azure. We have 3 roles defined kibana.  
user, superuser, restricted\_spaces\_user,

Within the Enterprise App, the values are all assigned to the different User groups :  
Sec\_group\_user = user  
Sec\_group\_admin = superuser  
Sec\_group\_restricted = restricted\_spaces\_user

The role mappings are defined in kibana and the roles are mapped to spaces as required.  
The user is "You do not have permission to access the requested page"

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/8/b87ecbc1def9fa557ed7cbad8f483de6ab1ea663.png)

The issue encountered is the role 'restricted\_spaces\_user' is generating an error in kibana.yml

\<"[eventType":"spaces\_authorization\_failure","username":john.doe@email.com](mailto:eventType%22:%22spaces_authorization_failure%22,%22username%22:john.doe@email.com)","action":"getAll","message":"john.doe@email.com unauthorized to getAll spaces"/\>

I cant see where this is going wrong and why its not returning the single space that they are assigned.

---

<div class="post-metadata">

**Author:** ![wa7son](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wa7son/32/21259_2.png) [@wa7son](https://discuss.elastic.co/u/wa7son)\
**Post date:** [February 23, 2022, 10:04am UTC](https://discuss.elastic.co/t/kibana-saml-sso-issue-with-spaces-unauthorized-to-getall-spaces/297199/2 "2022-02-23T10:04:47Z")

</div>

Hi,

Sorry to hear about the issue you're facing.

Unless you've encountered a bug, the issue here is that the `restricted_spaces_user` is trying to load a page in Kibana which the user does not have permissions to see. So it's probably related to the roles the user has.

Can you please verify when exactly this error screen is show? Does it happen right after the `restricted_spaces_user` has logged in before seeing the Kibana home screen? If not, which page is the user trying to navigate to when seeing this error screen?

Regards,  
Thomas

---

<div class="post-metadata">

**Author:** ![techguy20](https://avatars.discourse-cdn.com/v4/letter/t/a8b319/32.png) [@techguy20](https://discuss.elastic.co/u/techguy20)\
**Post date:** [February 23, 2022, 1:00pm UTC](https://discuss.elastic.co/t/kibana-saml-sso-issue-with-spaces-unauthorized-to-getall-spaces/297199/3 "2022-02-23T13:00:49Z")

</div>

I enabled trace logs and was able to identify the issue being related to the '\_' underscore. I changed all our role values to hyphens and the issue is resolved.

Support also mentioned that the UUID from the group in Azure can also be used

---

<div class="post-metadata">

**Author:** ![wa7son](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wa7son/32/21259_2.png) [@wa7son](https://discuss.elastic.co/u/wa7son)\
**Post date:** [February 24, 2022, 6:25am UTC](https://discuss.elastic.co/t/kibana-saml-sso-issue-with-spaces-unauthorized-to-getall-spaces/297199/4 "2022-02-24T06:25:51Z")

</div>

Great to hear that you were able to solve the issue 👍

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 24, 2022, 6:26am UTC](https://discuss.elastic.co/t/kibana-saml-sso-issue-with-spaces-unauthorized-to-getall-spaces/297199/5 "2022-03-24T06:26:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.