# Role Mapping API not working
**URL:** https://discuss.elastic.co/t/role-mapping-api-not-working/139298
**Category:** Elasticsearch
**Created:** [July 10, 2018, 8:36am UTC](https://discuss.elastic.co/t/role-mapping-api-not-working/139298 "2018-07-10T08:36:56Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@sukeshss](https://discuss.elastic.co/u/sukeshss)
#### Post date: [July 10, 2018, 8:36am UTC](https://discuss.elastic.co/t/role-mapping-api-not-working/139298/1 "2018-07-10T08:36:57Z")
I have configured X-Pack with LDAP in my ES Cluster. I am able to create the roles and role mappings using APIs. But role mapping is not taking effect in ES Cluster.
It is working only If I update the role\_mapping,yml file.
create role mapping command
> curl -X POST "localhost:9200/\_xpack/security/role\_mapping/ES\_Readonly\_mapping" -H 'Content-Type: application/json' -d' '{"roles":["ES\_Readonly"],"enabled":true,"rules":{"field":{"dn":"cn=user1,ou=Production,ou=Users,ou=Accounts,dc=my,dc=t-example,dc=com"}}}'
curl -XGET -u elastic
localhost:9200/\_xpack/security/role\_mapping/ES\_Readonly\_mapping
> {"ES\_Readonly\_mapping":{"enabled":true,"roles":["ES\_Readonly"],"rules":{"field":{"dn":"cn=user1,ou=Production,ou=Users,ou=Accounts,dc=my,dc=example,dc=com"}}
---
### Author:  [@ikakavas](https://discuss.elastic.co/u/ikakavas)
#### Post date: [July 10, 2018, 8:57am UTC](https://discuss.elastic.co/t/role-mapping-api-not-working/139298/2 "2018-07-10T08:57:22Z")
The snippets above show that you have created a Role Mapping that would give the role `ES_Readonly` to the user with the DN : `cn=user1,ou=Production,ou=Users,ou=Accounts,dc=my,dc=example,dc=com`
You don't share any information on how you attempt to verify if this works or not, and what is the behavior you are seeing that makes you think it's not working. Please
1. Make sure that the DN of the user you attempt to login as, is indeed `cn=user1,ou=Production,ou=Users,ou=Accounts,dc=my,dc=example,dc=com`
2. Enable DEBUG level logging in Elasticsearch with
---
### Author:  [@sukeshss](https://discuss.elastic.co/u/sukeshss)
#### Post date: [July 10, 2018, 1:42pm UTC](https://discuss.elastic.co/t/role-mapping-api-not-working/139298/3 "2018-07-10T13:42:11Z")
> [@ikakavas](#):
>
> ```auto
> curl -u user1 -XGET "http://10.65.45.22:9200/_xpack/security/_authenticate"
>
> ```
curl -u user1 -XGET "[http://10.65.45.22:9200/\_xpack/security/\_authenticate](http://10.65.45.22:9200/_xpack/security/_authenticate)"
> {"username":"user1","roles":,"full\_name":null,"email":null,"metadata":{"ldap\_dn":"CN=user1,OU=Production,OU=Users,OU=Accounts,DC=my,DC=example,DC=com","ldap\_groups":["testusers"]}}
please find the permission I have given while creating the role
> {"cluster":["monitor","monitor\_ml","monitor\_watcher"],"indices":[{"names":["\*"],"privileges":["monitor","view\_index\_metadata","read","indices:admin/get"]}]}
---
### Author:  [@ikakavas](https://discuss.elastic.co/u/ikakavas)
#### Post date: [July 10, 2018, 2:03pm UTC](https://discuss.elastic.co/t/role-mapping-api-not-working/139298/4 "2018-07-10T14:03:33Z")
Which version are you using? The role mapping API was case sensitive and whitespace sensitive until 6.2 . So you would have to update your mapping as following:
```auto
curl -X POST "localhost:9200/_xpack/security/role_mapping/ES_Readonly_mapping" -H 'Content-Type: application/json' -d' '{"roles":["ES_Readonly"],"enabled":true,"rules":{"field":{"dn":"CN=user1,OU=Production,OU=Users,OU=Accounts,DC=my,DC=example,DC=com"}}}'
```
Note
```auto
CN=user1,OU=Production,OU=Users,OU=Accounts,DC=my,DC=example,DC=com
```
which is how your LDAP server returns the user's DN,instead of
```auto
cn=user1,ou=Production,ou=Users,ou=Accounts,dc=my,dc=example,dc=com
```
> [@sukeshss](#):
>
> It is working only If I update the role\_mapping,yml file.
File based role mapping is not case sensitive so that would explain why this works when the role mapping is defined in `role_mapping.yml`
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 7, 2018, 2:18pm UTC](https://discuss.elastic.co/t/role-mapping-api-not-working/139298/5 "2018-08-07T14:18:29Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.