# LDAP user, local group? **URL:** \ **Category:** Elasticsearch\ **Created:** [February 10, 2018, 12:07pm UTC](https://discuss.elastic.co/t/ldap-user-local-group/119337 "2018-02-10T12:07:44Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Turbo\_Fredriksson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/turbo_fredriksson/32/27696_2.png) [@Turbo\_Fredriksson](https://discuss.elastic.co/u/Turbo_Fredriksson)\ **Post date:** [February 10, 2018, 12:07pm UTC](https://discuss.elastic.co/t/ldap-user-local-group/119337/1 "2018-02-10T12:07:44Z")
I have a user in LDAP (can authenticate fine), but this is a "simple" user ("person" and "uidObject" object classes only). How can I add this user to a local ('file') group? Is there any LDAP schema that I can use to add an attribute to the user to mapp it to the local group? How can I give an LDAP user access to "something"? The documentation only talks about mapping groups and roles, but not how to setup those groups/roles.. ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [February 12, 2018, 4:22am UTC](https://discuss.elastic.co/t/ldap-user-local-group/119337/2 "2018-02-12T04:22:14Z")
Let me start by clarifying some terminology that is used in X-Pack security: - **groups** only exist _outside_ of X-Pack. The are groups in your LDAP tree, or provided in a SAML assertion. X-Pack itself has no notion of a group, except as something that is provided by your external identity provider. - **roles** exist within X-Pack. The simplest definition of a role is that is is a named collection of permissions. Assigning roles to users is the means by which you grant them permissions. Not all identity providers have a concept of "groups". There are no groups for _Native_ users, or _File_ users, or _PKI_ users. If you identity provider does not provide a list of groups, that's fine, you just map users directly to roles. _However_, I would surprised to find that your LDAP server does not support groups. Groups in LDAP operate in the reverse way to most people's expections - Users aren't _in_ groups, Groups _contain_ users. A user with an `objectClass` of [`person`](http://www.zytrax.com/books/ldap/ape/core-schema.html#person) can be a [`member`](http://www.zytrax.com/books/ldap/ape/core-schema.html#member) of a [`groupOfNames`](http://www.zytrax.com/books/ldap/ape/core-schema.html#groupofnames) object - all it needs is a `distinguishedName` (which it must have). I don't know whether your directory actually _has_ any groups, but it should have the capability. However, if you can't use groups from your directory, you just need to map by user (userid/DN) instead. Both the role mapping file and the role mapping API support assigning roles directly to users: - [https://www.elastic.co/guide/en/x-pack/6.2/mapping-roles.html](https://www.elastic.co/guide/en/x-pack/6.2/mapping-roles.html) ---
**Author:** ![Turbo\_Fredriksson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/turbo_fredriksson/32/27696_2.png) [@Turbo\_Fredriksson](https://discuss.elastic.co/u/Turbo_Fredriksson)\ **Post date:** [February 12, 2018, 2:10pm UTC](https://discuss.elastic.co/t/ldap-user-local-group/119337/3 "2018-02-12T14:10:09Z")
That's all well and good, but how do role and a group "match"? Do they have to have the same name? Say I have the LDAP group "admins", do I also have to have/create the ES role "admins" (which will then contain the ES access controls)? Or can I call the role something else? If so, how to I "mapp" the two? Can I add the ES access control directly in LDAP [group]? I've read up on mappings, but they're not very clear. It only say "this is how you map groups, add the DN to the groups in this file". Nothing else! ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [February 13, 2018, 3:16am UTC](https://discuss.elastic.co/t/ldap-user-local-group/119337/4 "2018-02-13T03:16:59Z")
> [@Turbo\_Fredriksson](#): > > It only say "this is how you map groups, add the DN to the groups in this file". Nothing else! I'm sorry, but that's simply untrue. The link I posted has about 12 pages of documentation including examples that specifically cover your questions. > [@Turbo\_Fredriksson](#): > > how do role and a group "match" That's what role mapping provides, via a file, or via an API. Here's an example taken directly from the documentation: _the following snippet uses the file-based method to map the admins group to the monitoring role and map the John Doe user, the users group, and the admins group to the user role_. ```auto monitoring: - "cn=admins,dc=example,dc=com" user: - "cn=John Doe,cn=contractors,dc=example,dc=com" - "cn=users,dc=example,dc=com" - "cn=admins,dc=example,dc=com" ``` - `monitoring` and `user` are Elasticsearch roles. - `cn=admins,dc=example,dc=com` and `cn=users,dc=example,dc=com` are LDAP groups - `cn=John Doe,cn=contractors,dc=example,dc=com` is an LDAP user. ---
**Author:** ![Turbo\_Fredriksson](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/turbo_fredriksson/32/27696_2.png) [@Turbo\_Fredriksson](https://discuss.elastic.co/u/Turbo_Fredriksson)\ **Post date:** [February 13, 2018, 7:25pm UTC](https://discuss.elastic.co/t/ldap-user-local-group/119337/5 "2018-02-13T19:25:08Z")
In retrospect, this all sounds perfectly easy and simple. I still think the documentation is slightly unclear on the subject, but I understand it now so I'm willing to let that slide.. Thanx for the clarifications! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 13, 2018, 7:25pm UTC](https://discuss.elastic.co/t/ldap-user-local-group/119337/6 "2018-03-13T19:25:16Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.