# Kibana SSO via Azure user unauthorized

**URL:** <https://discuss.elastic.co/t/kibana-sso-via-azure-user-unauthorized/160187>\
**Category:** Kibana\
**Created:** [December 10, 2018, 1:57pm UTC](https://discuss.elastic.co/t/kibana-sso-via-azure-user-unauthorized/160187 "2018-12-10T13:57:00Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![rani](https://avatars.discourse-cdn.com/v4/letter/r/f4b2a3/32.png) [@rani](https://discuss.elastic.co/u/rani)\
**Post date:** [December 10, 2018, 1:57pm UTC](https://discuss.elastic.co/t/kibana-sso-via-azure-user-unauthorized/160187/1 "2018-12-10T13:57:01Z")

</div>

Hello there

I'm currently trying to set up single sign-on via Azure.  
If I log in with my test account I can pass the authentication but I get the following error message:

{"message":"action [indices:data/read/search] is unauthorized for user [stde-test@zde.onmicrosoft.com]: [security\_exception] action [indices:data/read/search] is unauthorized for user [stde-test@zde.onmicrosoft.com]","statusCode":403,"error":"Forbidden"}

Where can I set up the rights for the user, which is not managed by Kibana?  
Thanks in advance.

---

<div class="post-metadata">

**Author:** ![rashmi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rashmi/32/16391_2.png) [@rashmi](https://discuss.elastic.co/u/rashmi)\
**Post date:** [December 12, 2018, 9:57pm UTC](https://discuss.elastic.co/t/kibana-sso-via-azure-user-unauthorized/160187/2 "2018-12-12T21:57:12Z")

</div>

@Brandon_Kobel - can u please provide more insights into this ? Thanks  
Rashmi

---

<div class="post-metadata">

**Author:** ![Brandon\_Kobel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/brandon_kobel/32/14829_2.png) [@Brandon\_Kobel](https://discuss.elastic.co/u/Brandon_Kobel)\
**Post date:** [December 12, 2018, 10:02pm UTC](https://discuss.elastic.co/t/kibana-sso-via-azure-user-unauthorized/160187/3 "2018-12-12T22:02:34Z")

</div>

Hey @rani, assuming that you're using SAML, have you configured your role mappings per [https://www.elastic.co/guide/en/x-pack/current/saml-role-mapping.html](https://www.elastic.co/guide/en/x-pack/current/saml-role-mapping.html)?

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [December 13, 2018, 6:25am UTC](https://discuss.elastic.co/t/kibana-sso-via-azure-user-unauthorized/160187/4 "2018-12-13T06:25:59Z")

</div>

You probably want

- [https://www.elastic.co/guide/en/elastic-stack-overview/6.5/saml-role-mapping.html](https://www.elastic.co/guide/en/elastic-stack-overview/6.5/saml-role-mapping.html)

which is the up date version of those docs (the previous link is for 6.2)

---

<div class="post-metadata">

**Author:** ![rani](https://avatars.discourse-cdn.com/v4/letter/r/f4b2a3/32.png) [@rani](https://discuss.elastic.co/u/rani)\
**Post date:** [December 17, 2018, 8:51am UTC](https://discuss.elastic.co/t/kibana-sso-via-azure-user-unauthorized/160187/5 "2018-12-17T08:51:35Z")

</div>

Yes, I was looking for this.  
Even though I was searching on the internet for a long time, I couldn't find this page.  
Anyway, thanks to all of you for the kind help!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 14, 2019, 8:51am UTC](https://discuss.elastic.co/t/kibana-sso-via-azure-user-unauthorized/160187/6 "2019-01-14T08:51:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.