# SAML attributes.groups has multiple groups, role mapping does not work

**URL:** <https://discuss.elastic.co/t/saml-attributes-groups-has-multiple-groups-role-mapping-does-not-work/286151>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [October 7, 2021, 4:53pm UTC](https://discuss.elastic.co/t/saml-attributes-groups-has-multiple-groups-role-mapping-does-not-work/286151 "2021-10-07T16:53:33Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![iti](https://avatars.discourse-cdn.com/v4/letter/i/b19c9b/32.png) [@iti](https://discuss.elastic.co/u/iti)\
**Post date:** [October 7, 2021, 4:53pm UTC](https://discuss.elastic.co/t/saml-attributes-groups-has-multiple-groups-role-mapping-does-not-work/286151/1 "2021-10-07T16:53:33Z")

</div>

I have the following saml response:

```auto
<?xml version="1.0" encoding="UTF-8"?>
<samlp:Response xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" >
   <saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Format="urn:oasis:names:tc:SAML:2.0:nameid-format:entity">https://postprod.ams.hhs.gov/</saml:Issuer>
...
      <saml:AuthnStatement AuthnInstant="2021-10-07T16:24:49Z" SessionIndex="id-iThZONsBYRpxNv6Pm6hlUHk6b6aJrLBPjcjRB2rx" SessionNotOnOrAfter="2021-10-07T17:25:20Z">
         <saml:AuthnContext>
            <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef>
         </saml:AuthnContext>
      </saml:AuthnStatement>
      <saml:AttributeStatement>
         <saml:Attribute Name="roles" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
            <saml:AttributeValue xmlns:xsd="http://www.w3.org/2001/XMLSchema" xsi:type="xsd:string">role1,role2,role3....</saml:AttributeValue>
         </saml:Attribute>
      </saml:AttributeStatement>
   </saml:Assertion>
</samlp:Response>

```

SAML definition is:  
attributes.groups: "roles"

if the roles has only one value it work. When it is like "role1,role2.." role mapping does not work. (role1 or role2 etc. has its own role mapping)  
Any advice?

Thanks

---

<div class="post-metadata">

**Author:** ![iti](https://avatars.discourse-cdn.com/v4/letter/i/b19c9b/32.png) [@iti](https://discuss.elastic.co/u/iti)\
**Post date:** [October 7, 2021, 5:57pm UTC](https://discuss.elastic.co/t/saml-attributes-groups-has-multiple-groups-role-mapping-does-not-work/286151/2 "2021-10-07T17:57:57Z")

</div>

I have used:

```auto
attribute_patterns.groups: "(role\\w*)"

```

This extract 1 role and works.  
Anyway groups can have multiple roles?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [October 11, 2021, 12:43am UTC](https://discuss.elastic.co/t/saml-attributes-groups-has-multiple-groups-role-mapping-does-not-work/286151/3 "2021-10-11T00:43:02Z")

</div>

Is this in relation to the Security functionality in Elasticsearch?

---

<div class="post-metadata">

**Author:** ![iti](https://avatars.discourse-cdn.com/v4/letter/i/b19c9b/32.png) [@iti](https://discuss.elastic.co/u/iti)\
**Post date:** [October 11, 2021, 2:43pm UTC](https://discuss.elastic.co/t/saml-attributes-groups-has-multiple-groups-role-mapping-does-not-work/286151/4 "2021-10-11T14:43:21Z")

</div>

Yeah. This is related to ELK single sing on.

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [October 12, 2021, 6:21am UTC](https://discuss.elastic.co/t/saml-attributes-groups-has-multiple-groups-role-mapping-does-not-work/286151/5 "2021-10-12T06:21:11Z")

</div>

> [@iti](#):
>
> Any advice?

Convince your identity provider to use multi-valued SAML attributes?

SAML supports having multiple values for a single attribute. Perhaps there's a configuration option in your IdP to get it behave more politely and send the separate roles as separate values.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 9, 2021, 6:21am UTC](https://discuss.elastic.co/t/saml-attributes-groups-has-multiple-groups-role-mapping-does-not-work/286151/6 "2021-11-09T06:21:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.