Map azureAD roles or groups with elasticsearch roles

Elastic Stack Elasticsearch
2

I would like to map azureAD roles or groups with elasticsearch roles, I have no idea how to start.

Also, how can I get fill "Full name" and "Email" fields?

The path I would recommend is:

  1. Login via AzureAD into Kibana using a user that is a representative example of how your users are setup
  2. In the Kibana left hand menu, select Dev Tools (in the Management section at the bottom), and open the Console tab (default)
  3. Run GET /_security/_authenticate
  4. The response will contain a metadata object with a bunch of oidc(some_name_here) fields. Those fields contain the OpenId Connect claim fields that were received from AzureAD.
  5. Find the names of claims that give you the groups/roles, full name, and email from AzureAD. Since you have the profile and email scopes set you should have a " name" and "email" claim. (If they're not there, then you will need to change something in AzureAD to provide those claims).
  6. Then set claims.name and claims.mail to the claim names you found above. You've already set claims.groups to "groups". If that doesn't match what you saw in Dev Console, then change it to the correct claim.
  7. Restart your Elasticsearch node, and then login again.
  8. Your name & email should now be populated.
  9. To assign ES roles from your AzureAD groups, you can follow the example here: Configuring single sign-on to the Elastic Stack using OpenID Connect | Elasticsearch Guide [8.7] | Elastic
1 Like