# Map azureAD roles or groups with elasticsearch roles **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [October 26, 2023, 1:10am UTC](https://discuss.elastic.co/t/map-azuread-roles-or-groups-with-elasticsearch-roles/345763 "2023-10-26T01:10:45Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![ebuildy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ebuildy/32/6070_2.png) [@ebuildy](https://discuss.elastic.co/u/ebuildy)\ **Post date:** [October 26, 2023, 1:10am UTC](https://discuss.elastic.co/t/map-azuread-roles-or-groups-with-elasticsearch-roles/345763/1 "2023-10-26T01:10:45Z")
We deploy ES 8.8.1 with ECK on kubernetes. We connect it to azureAD, login works fine. I would like to **map azureAD roles or groups with elasticsearch roles** , I have no idea how to start. Our config is: ```auto xpack.security.authc.realms.oidc.azuread: order: 1 rp.client_id: {{ .auth.azureAD.clientID }} rp.response_type: code rp.requested_scopes: [openid, email, profile] rp.redirect_uri: "https://kibana.tools.XXXXX/api/security/oidc/callback" op.issuer: "https://login.microsoftonline.com/{{ .auth.azureAD.tenantID }}/v2.0" op.authorization_endpoint: "https://login.microsoftonline.com/{{ .auth.azureAD.tenantID }}/oauth2/v2.0/authorize" op.token_endpoint: "https://login.microsoftonline.com/{{ .auth.azureAD.tenantID }}/oauth2/v2.0/token" op.userinfo_endpoint: "https://graph.microsoft.com/oidc/userinfo" op.endsession_endpoint: "https://login.microsoftonline.com/{{ .auth.azureAD.tenantID }}/oauth2/v2.0/logout" rp.post_logout_redirect_uri: "https://kibana.tools.XXXXX/logged_out" op.jwkset_path: "https://login.microsoftonline.com/{{ .auth.azureAD.tenantID }}/discovery/v2.0/keys" claims.principal: sub claims.groups: groups claims.roles: roles ``` I give superuser for all user so I can "login" and see my profile: ![Capture d’écran, le 2023-10-25 à 21.09.44](https://us1.discourse-cdn.com/elastic/original/3X/e/2/e254a77c68e36af47d27f5e126761cffd67524cd.png) **Also, how can I get fill "Full name" and "Email" fields?** ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [October 26, 2023, 5:49am UTC](https://discuss.elastic.co/t/map-azuread-roles-or-groups-with-elasticsearch-roles/345763/2 "2023-10-26T05:49:59Z")
> I would like to **map azureAD roles or groups with elasticsearch roles** , I have no idea how to start. > **Also, how can I get fill "Full name" and "Email" fields?** The path I would recommend is: 1. Login via AzureAD into Kibana using a user that is a representative example of how your users are setup 2. In the Kibana left hand menu, select **Dev Tools** (in the **Management** section at the bottom), and open the **Console** tab (default) 3. Run `GET /_security/_authenticate` 4. The response will contain a `metadata` object with a bunch of `oidc(some_name_here)` fields. Those fields contain the OpenId Connect claim fields that were received from AzureAD. 5. Find the names of claims that give you the groups/roles, full name, and email from AzureAD. Since you have the `profile` and `email` scopes set you should have a " name" and "email" claim. (If they're not there, then you will need to change something in AzureAD to provide those claims). 6. Then set `claims.name` and `claims.mail` to the claim names you found above. You've already set `claims.groups` to "groups". If that doesn't match what you saw in Dev Console, then change it to the correct claim. 7. Restart your Elasticsearch node, and then login again. 8. Your name & email should now be populated. 9. To assign ES roles from your AzureAD groups, you can follow the example here: [Configuring single sign-on to the Elastic Stack using OpenID Connect | Elasticsearch Guide [8.7] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/8.7/oidc-guide.html#oidc-role-mappings) ---
**Author:** ![ebuildy](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ebuildy/32/6070_2.png) [@ebuildy](https://discuss.elastic.co/u/ebuildy)\ **Post date:** [October 26, 2023, 12:30pm UTC](https://discuss.elastic.co/t/map-azuread-roles-or-groups-with-elasticsearch-roles/345763/3 "2023-10-26T12:30:14Z")
Fantastic!! Exactly what I was looking for, many thanks Tim. This was really straigthaway after: ![Capture d’écran, le 2023-10-26 à 08.29.22](https://us1.discourse-cdn.com/elastic/original/3X/b/5/b512be45ff69f276a43f3186fb4756ed54d08a52.png) ![Capture d’écran, le 2023-10-26 à 08.27.20](https://us1.discourse-cdn.com/elastic/original/3X/5/0/50e9ed672d7fd8b821e3de5792ac7175c806484b.png) Cherry on the cake --\> Claim for photo is missing ^^ [Configuring single sign-on to the Elastic Stack using OpenID Connect | Elasticsearch Guide [8.10] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/oidc-guide.html#oidc-user-properties) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 23, 2023, 12:30pm UTC](https://discuss.elastic.co/t/map-azuread-roles-or-groups-with-elasticsearch-roles/345763/4 "2023-11-23T12:30:27Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.