# PKI chain realms

**URL:** <https://discuss.elastic.co/t/pki-chain-realms/287126>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [October 19, 2021, 5:39pm UTC](https://discuss.elastic.co/t/pki-chain-realms/287126 "2021-10-19T17:39:46Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![pkward](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pkward/32/95305_2.png) [@pkward](https://discuss.elastic.co/u/pkward)\
**Post date:** [October 19, 2021, 5:39pm UTC](https://discuss.elastic.co/t/pki-chain-realms/287126/1 "2021-10-19T17:39:46Z")

</div>

I want to add two PKI authentication realms in order to map each one to a specific role-mapping. I know I can create a realm chain, but I'm in need of help with setting up my secondary PKI realm using the OU name. For example, the PKI users PKI will look something like this:

```auto
CN=Doe John D,OU=People,OU=Google,OU=ITAdmin,OU=IT,O=U.S.

```

I'm looking to authenticate all users with OU=ITAdmin to a specific role mapping. I've already created the role mapping.

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [October 20, 2021, 3:38am UTC](https://discuss.elastic.co/t/pki-chain-realms/287126/2 "2021-10-20T03:38:37Z")

</div>

Why do you want to do this with 2 realms? Do you have 2 different CAs?

---

<div class="post-metadata">

**Author:** ![pkward](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pkward/32/95305_2.png) [@pkward](https://discuss.elastic.co/u/pkward)\
**Post date:** [October 20, 2021, 10:54am UTC](https://discuss.elastic.co/t/pki-chain-realms/287126/3 "2021-10-20T10:54:55Z")

</div>

@TimV I want to do 2 realms so users can automatically be assigned a role-mapping based on a specific OU group in their PKI. I know I can add user's individually explicitly, but that can become a little tedious with over 100 users. In addition, we're not using LDAP or Active Directory which could also probably be useful in assigning a group of users to a role-mapping. I saw in the Elastic docs where you could specify two LDAP realms in the Realm chain, but just wanted to know if this was possible using the PKI realm. I've created two spaces where one is for a specific user, and a general space where any user with PKI can automatically access. The general PKI authentication works for the general space, but I would like to also have users to authenticate against a second PKI realm if they meet a certain criteria which in this case based on the OU.

---

<div class="post-metadata">

**Author:** ![pkward](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pkward/32/95305_2.png) [@pkward](https://discuss.elastic.co/u/pkward)\
**Post date:** [October 20, 2021, 11:46am UTC](https://discuss.elastic.co/t/pki-chain-realms/287126/4 "2021-10-20T11:46:47Z")

</div>

@TimV question, instead of mapping the full subject name to a role-mapping is it possible to do something like below?

```auto
curl -k -XPUT -u elastic https://localhost:9200/_security/role_mapping/<role-mapping name> -H "Content-Type: application/json" -d '{
  "roles" : ["<role-mapping>"],
  "rules" : {
    "field" : {
      "dn" : "OU=ITAdmin"
    }
  },
  "enabled": true
}'

```

---

<div class="post-metadata">

**Author:** ![pkward](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pkward/32/95305_2.png) [@pkward](https://discuss.elastic.co/u/pkward)\
**Post date:** [October 20, 2021, 1:49pm UTC](https://discuss.elastic.co/t/pki-chain-realms/287126/5 "2021-10-20T13:49:06Z")

</div>

I see there is a way to create `user_dn_templates` for LDAP realm, is there something similar in PKI realm? Something like `cn={0},OU=People,OU=Google,OU=ITAdmin,OU=IT,O=U.S. `

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 17, 2021, 1:49pm UTC](https://discuss.elastic.co/t/pki-chain-realms/287126/6 "2021-11-17T13:49:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.