# LDAP group authentication for Kibana

**URL:** <https://discuss.elastic.co/t/ldap-group-authentication-for-kibana/64785>\
**Category:** Kibana\
**Created:** [November 3, 2016, 12:18am UTC](https://discuss.elastic.co/t/ldap-group-authentication-for-kibana/64785 "2016-11-03T00:18:05Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![stecino](https://avatars.discourse-cdn.com/v4/letter/s/ea666f/32.png) [@stecino](https://discuss.elastic.co/u/stecino)\
**Post date:** [November 3, 2016, 12:18am UTC](https://discuss.elastic.co/t/ldap-group-authentication-for-kibana/64785/1 "2016-11-03T00:18:05Z")

</div>

I need to be able to allow anyone in group x in ActiveDirectory.

CN=SiteReliability,OU=Roles,OU=Groups,DC=corp,DC=example,DC=com

in my elasticsearch.yml i have

shield:  
authc:  
realms:  
ldap1:  
type: ldap  
order: 0  
url: "ldap://blah.com"  
user\_dn\_templates:  
- "CN=SiteReliability,OU=Roles,OU=Groups,DC=corp,DC=example,DC=com"  
group\_search:  
base\_dn: "DC=corp,DC=example,DC=com"  
files:  
role\_mapping: "/role\_mapping.yml"  
unmapped\_groups\_as\_roles: false

where role\_mapping.yml

admin:  
CN=SiteReliability,OU=Roles,OU=Groups,DC=corp,DC=example,DC=com

in my kibana installation directory under shield/ i have

role\_mapping.yml

admin:  
CN=SiteReliability,OU=Roles,OU=Groups,DC=corp,DC=example,DC=com

At the moment I can't get this working, what else am I missing?

---

<div class="post-metadata">

**Author:** ![jbudz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jbudz/32/45922_2.png) [@jbudz](https://discuss.elastic.co/u/jbudz)\
**Post date:** [November 3, 2016, 9:33pm UTC](https://discuss.elastic.co/t/ldap-group-authentication-for-kibana/64785/2 "2016-11-03T21:33:51Z")

</div>

What errors are you running into?

On first glance, In role\_mapping.yml it looks like it wants group: [],  
`  
admin:

- CN=SiteReliability,OU=Roles,OU=Groups,DC=corp,DC=example,DC=com  
`

The role\_mapping path looks suspect too, I have a hunch it's treating that as an absolute path.

---

<div class="post-metadata">

**Author:** ![stecino](https://avatars.discourse-cdn.com/v4/letter/s/ea666f/32.png) [@stecino](https://discuss.elastic.co/u/stecino)\
**Post date:** [November 7, 2016, 7:33pm UTC](https://discuss.elastic.co/t/ldap-group-authentication-for-kibana/64785/3 "2016-11-07T19:33:25Z")

</div>

It's actually working now, I updated role\_mapping.yml. One thing I noticed was that since I am using F5 Load Balanced VIPs for my query nodes and my Kibana servers are pointing to that, there were authentication token issues. So I had to enable persistent session on the load balancer level. So it's working with this role mapping

dmin:

- "CN=SiteReliability,OU=Roles,OU=Groups,DC=corp,DC=example,DC=com"

kibana4\_server:

- "CN=KibanaServer,OU=Security,OU=Groups,DC=corp,DC=example,DC=com"

My question was the following, if from now on I want to add a user or a group that will have access based on the role, do I update user\_dn\_templates in elasticsearch.yml or I just update role\_mappings.yml where roles I have noticed are reloaded by ElasticSearch. Do roles.yml also reloaded by ES?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 1:34pm UTC](https://discuss.elastic.co/t/ldap-group-authentication-for-kibana/64785/4 "2017-07-06T13:34:20Z")

</div>