```
The problem is that when I try to connect with the "firstuser" I access to kibana but I have this error: "You are not authorized to access Monitoring. To use Monitoring, you need the privileges granted by both the `kibana_user` and `monitoring_user` roles"
Where I wrong?
Thank you
---
### Author:  [@ikakavas](https://discuss.elastic.co/u/ikakavas)
#### Post date: [February 12, 2019, 9:28am UTC](https://discuss.elastic.co/t/roles-problem-with-x-pack-and-ldap/167986/2 "2019-02-12T09:28:42Z")
Please use `` or backticks (`) to format your message - instead of quotes. This will allow you to maintain format and will be much easier to read. It would be great if you can update your post
> [@DevXoo](#):
>
> "You are not authorized to access Monitoring. To use Monitoring, you need the privileges granted by both the `kibana_user` and `monitoring_user` roles"
The error message tells you that your user needs to have the `kibana_user` and the `monitoring_user` roles.
> [@DevXoo](#):
>
> Where I wrong?
Your role mapping
```auto
monitoring:
- "cn=admin,dc=example,dc=com"
user:
- "cn=user,dc=example,dc=com"
```
is assigning the `monitoring` role to the members of the `cn=admin,dc=example,dc=com` group and the `user` role to the members of the `cn=user,dc=example,dc=com` group.
In your LDAP, neither your `cn=user,dc=example,dc=com` group, nor your `cn=admin,dc=example,dc=com` group contain any `member`s.
So, you need to correct a few things:
- Add your `firstuser` to the `cn=user,dc=example,dc=com` group in your LDAP.
- Give the users of your `cn=user,dc=example,dc=com` group the correct roles in role mapping with the following rules:
```auto
monitoring_user:
- "cn=user,dc=example,dc=com"
kibana_user:
- "cn=user,dc=example,dc=com"
```
As a side note, I'd suggest that you look into the [role mapping API](https://www.elastic.co/guide/en/elasticsearch/reference/6.6/security-api-put-role-mapping.html) and potentially use this instead of file based role mappings.
---
### Author:  [@DevXoo](https://discuss.elastic.co/u/DevXoo)
#### Post date: [February 12, 2019, 10:38am UTC](https://discuss.elastic.co/t/roles-problem-with-x-pack-and-ldap/167986/3 "2019-02-12T10:38:11Z")
Hi ikakavas,
I have the 'firstuser' under 'cn=admin,dc=example,dc=com':
```
dn: cn=firstuser,cn=admin,dc=example,dc=com
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: top
cn: firstuser
sn: firstuser
userPassword: {SSHA}
```
infact if I modify the roles as follows work fine:
```
monitoring_user:
- "cn=firstuser,cn=admin,dc=example,dc=com"
kibana_user:
- "cn=firstuser,cn=admin,dc=example,dc=com"
```
Do I have insert the user name on the file "role\_mapping.yml"? is this the right mode?
Thank you
---
### Author:  [@ikakavas](https://discuss.elastic.co/u/ikakavas)
#### Post date: [February 12, 2019, 11:07am UTC](https://discuss.elastic.co/t/roles-problem-with-x-pack-and-ldap/167986/4 "2019-02-12T11:07:11Z")
> [@DevXoo](#):
>
> I have the 'firstuser' under 'cn=admin,dc=example,dc=com':
This is _not_ the same as the user being member of the group. You can read more on ldap group membership, this is unrelated to elasticsearch ( see for example [https://ldapwiki.com/wiki/LDAP%20Group](https://ldapwiki.com/wiki/LDAP%20Group) )
> [@DevXoo](#):
>
> infact if I modify the roles as follows work fine:
Our role mapping works with either user DNs or with group DNs as you can read in the documentation. What uou did works ,but will only work for your firstuser as you have specified them by user DN .
---
### Author:  [@DevXoo](https://discuss.elastic.co/u/DevXoo)
#### Post date: [February 12, 2019, 1:13pm UTC](https://discuss.elastic.co/t/roles-problem-with-x-pack-and-ldap/167986/5 "2019-02-12T13:13:30Z")
I added the user on the group and now work fine
> ADD on 'admin' group this attribute: "member: cn=firstuser,cn=admin,dc=example,dc=com"
Thank you for your support
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 12, 2019, 1:15pm UTC](https://discuss.elastic.co/t/roles-problem-with-x-pack-and-ldap/167986/6 "2019-03-12T13:15:47Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.