# Role mapping on user's metadata

**URL:** <https://discuss.elastic.co/t/role-mapping-on-users-metadata/167990>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [February 12, 2019, 8:55am UTC](https://discuss.elastic.co/t/role-mapping-on-users-metadata/167990 "2019-02-12T08:55:29Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![misomij](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/misomij/32/10700_2.png) [@misomij](https://discuss.elastic.co/u/misomij)\
**Post date:** [February 12, 2019, 8:55am UTC](https://discuss.elastic.co/t/role-mapping-on-users-metadata/167990/1 "2019-02-12T08:55:29Z")

</div>

Hi all,  
I am on 6.5.4 and I am using AD for authentication.  
Authentication works correctly, now I am trying to create some role\_mapping.  
Following this guide I understand that it should be possible to create mappings using user's metadata (AD attributes) in rules:  
[https://www.elastic.co/guide/en/elasticsearch/reference/6.5/role-mapping-resources.html#\_user\_fields](https://www.elastic.co/guide/en/elasticsearch/reference/6.5/role-mapping-resources.html#_user_fields)

```
`metadata`

(object) Additional metadata for the user. For example, `"metadata": { "cn": "John Smith" }` .

```

This is what I am trying:

```
POST _xpack/security/role_mapping/mapping_test_user
{
  "enabled": true,
  "roles": [
    "read_only_logs",
    "kibana_dashboard_only_user"
  ],
  "rules": {
    "any": [
      {
        "field": {
          "metadata":{"cn": "testuser"}
        }
      }
    ]
  },
  "metadata": {}
}

```

But I get this error:

```
{
  "error": {
    "root_cause": [
      {
        "type": "parsing_exception",
        "reason": "[11:22] [role-mapping] failed to parse field [rules]",
        "line": 11,
        "col": 22
      }
    ],
    "type": "parsing_exception",
    "reason": "[11:22] [role-mapping] failed to parse field [rules]",
    "line": 11,
    "col": 22,
    "caused_by": {
      "type": "x_content_parse_exception",
      "reason": "[11:22] [role-mapping] failed to parse field [rules]",
      "caused_by": {
        "type": "parse_exception",
        "reason": "failed to parse rules expression. expected a field value but found [START_OBJECT] instead"
      }
    }
  },
  "status": 400
}

```

What am I doing wrong? Thanks in advance.

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [February 12, 2019, 10:27am UTC](https://discuss.elastic.co/t/role-mapping-on-users-metadata/167990/2 "2019-02-12T10:27:27Z")

</div>

In order for `cn` LDAP Attribute to end up in the authenticated user's metadata, you need to explicitly configure your AD realm ( see [here](https://www.elastic.co/guide/en/x-pack/current/active-directory-realm.html#ad-user-metadata) ) by setting the `metadata` realm configuration property.

> [@misomij](#):
>
> (object) Additional metadata for the user. For example, `"metadata": { "cn": "John Smith" }` .

The

```auto
(object) Additional metadata for the user. For example, `"metadata": { "cn": "John Smith" }` .

```

is an example of how the metadata can look like, not how to use it in the role mapping rule. You'd need to change this to

```auto
POST _xpack/security/role_mapping/mapping_test_user
{
  "enabled": true,
  "roles": [
    "read_only_logs",
    "kibana_dashboard_only_user"
  ],
  "rules": {
    "any": [
      {
        "field": { "metadata.cn": "testuser" }
      }
    ]
  },
  "metadata": {}
}

```

---

<div class="post-metadata">

**Author:** ![misomij](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/misomij/32/10700_2.png) [@misomij](https://discuss.elastic.co/u/misomij)\
**Post date:** [February 14, 2019, 4:46pm UTC](https://discuss.elastic.co/t/role-mapping-on-users-metadata/167990/3 "2019-02-14T16:46:46Z")

</div>

Thank you for the clarification 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 14, 2019, 4:46pm UTC](https://discuss.elastic.co/t/role-mapping-on-users-metadata/167990/4 "2019-03-14T16:46:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.