# SAML error with ELK Stack **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [January 17, 2019, 3:44pm UTC](https://discuss.elastic.co/t/saml-error-with-elk-stack/164673 "2019-01-17T15:44:38Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [February 26, 2019, 2:31pm UTC](https://discuss.elastic.co/t/saml-error-with-elk-stack/164673/21 "2019-02-26T14:31:21Z")
> [@vapetri](#): > > If there a role mapping to force users to go to specific space in Kibana? No. You need to create specific roles that have the privileges that are required for the given space. See [our documentation](https://www.elastic.co/guide/en/kibana/current/spaces-securing.html) > [@vapetri](#): > > Can i create another dashboard user role which i can add/inherit to be force via SAML? Can you clarify what you mean by this? > [@vapetri](#): > > this is the role mapping i try to use: > > ```auto > PUT /_xpack/security/role_mapping/Role.AT > { > "roles": ["Role.AT"], > "enabled": true, > "rules": { "all": [ > { "field": { "realm.name": "saml1" } }, > { "field": { "groups": "Role.AT" } }, > { "field": { "role": "Role.AT" } } > ] } > } > > ``` You cannot use `role` as a field in role mapping rules ( this part: `{ "field": { "role": "Role.AT" } }`). Role mapping rules assign roles to users based on some other properties, if the user had the role already, you wouldn't need a role mapping rule to assign the role to the user. Please read through our documentation [here](https://www.elastic.co/guide/en/elasticsearch/reference/6.6/security-api-put-role-mapping.html) and [here](https://www.elastic.co/guide/en/elastic-stack-overview/current/saml-role-mapping.html) again, I'm certain it will be beneficial for you. > [@vapetri](#): > > Is it enough to use only the groups field to map the SAML Group to ELK role? Yes. > [@vapetri](#): > > If i enter with a local user with the same role, the user is using only one space. > If i come via SAML i am redirect to space default. I can only assume that because your role mapping or the SAML attribute mapping is wrong, the user doesn't get the necessary roles when logging in via SAML. - What is the value for `attributes.groups:` in your configuration? - Does the user belong to the group `Role.AT` in your SAML IDP or the underlying LDAP? - Please enable trace logging for the SAML Realm as described in [our troubleshooting docs](https://www.elastic.co/guide/en/elastic-stack-overview/current/trb-security-saml.html) and review the logs. We are printing out helpful information for debugging there. If you still can't make sense of it, please share the relevant parts here so that we can take a look Hope this helps ---
**Author:** ![vapetri](https://avatars.discourse-cdn.com/v4/letter/v/3d9bf3/32.png) [@vapetri](https://discuss.elastic.co/u/vapetri)\ **Post date:** [February 26, 2019, 2:51pm UTC](https://discuss.elastic.co/t/saml-error-with-elk-stack/164673/22 "2019-02-26T14:51:59Z")
Hi Thanks for the answer. attribute.groups from SAML is "role" as my idp is sending me in SAML token the role: look here SAML token: \ \Role.AT\ \ Still my question, can i create a second dashboard user role? I tried to add it to Kibana Advanced Setting and according to document but still i see entire applications list not only dashboard. What i want to achieve is that SAML users have a dashboard only role on one specific Space. Can i force in the role mapping api for saml realm to force what space to be used? The kibana dashboard only user has access to all spaces and cannot be modified. If i manually create a clone of it, with the same .kibana\* index, the users who have it doesnt act the same. Thank you, Victor ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [February 26, 2019, 3:17pm UTC](https://discuss.elastic.co/t/saml-error-with-elk-stack/164673/23 "2019-02-26T15:17:40Z")
> [@vapetri](#): > > Thanks for the answer. > attribute.groups from SAML is "role" as my idp is sending me in SAML token the role: > look here SAML token: I see. You still need to remove `{ "field": { "role": "Role.AT" } }` from your role mapping, ```auto PUT /_xpack/security/role_mapping/Role.AT { "roles": ["Role.AT"], "enabled": true, "rules": { "all": [ { "field": { "realm.name": "saml1" } }, { "field": { "groups": "Role.AT" } }, ] } } ``` should work fine for you. `kibana_dashboard_only_user` role is not compatible with spaces in the way you try to use it. See [this answer](https://discuss.elastic.co/t/kibana-user-roles-kibana-dashboard-only-and-limit-spaces/161905/4?) from @Brandon_Kobel explaining why and what you can do instead ---
**Author:** ![vapetri](https://avatars.discourse-cdn.com/v4/letter/v/3d9bf3/32.png) [@vapetri](https://discuss.elastic.co/u/vapetri)\ **Post date:** [February 26, 2019, 5:42pm UTC](https://discuss.elastic.co/t/saml-error-with-elk-stack/164673/24 "2019-02-26T17:42:14Z")
Hi, thanks for fast reply. I have removed the field "role" entry. How can i add a second role, on that dashboard only advanced setting as i can write any string there and is not verified.I have added with comas , in the advances setting dashboard only setting Role A Role B and if i set to some user Role A or B i still have all the applications. Also, i've set this Rola.AT to space "Engineer". If i enter with Role AT use via SAML i am redirected to default space. If i enter with a local user i am redirect to Engineer space but with all the applications, not only Dashboard. Can i "clone" kibana dashboard only user to another role and use that instead for my dashboard only users? Thank you, Victor ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [February 26, 2019, 5:57pm UTC](https://discuss.elastic.co/t/saml-error-with-elk-stack/164673/25 "2019-02-26T17:57:59Z")
> [@vapetri](#): > > How can i add a second role, on that dashboard only advanced setting you can add comma separated role names Please share all the steps you have done with the relevant output. Without this, it's very hard for anyone in the forums to meaningfully assist you. Have you created the custom role as instructed in the link I shared above? Is that role name `Role.AT` ? If so , how did you go about creating it? Did you also follow all the subsequent steps that are described there? > [@vapetri](#): > > Also, i've set this Rola.AT to space "Engineer". Please share details. How did you do this? Share the API calls you executed or describe how you did this in the UI. ---
**Author:** ![vapetri](https://avatars.discourse-cdn.com/v4/letter/v/3d9bf3/32.png) [@vapetri](https://discuss.elastic.co/u/vapetri)\ **Post date:** [February 26, 2019, 6:44pm UTC](https://discuss.elastic.co/t/saml-error-with-elk-stack/164673/26 "2019-02-26T18:44:29Z")
Hi, So step by step. The role definition: ```auto GET /_xpack/security/role/Role.AT { "Role.AT" : { "cluster" : [], "indices" : [ { "names" : [ "index1-*", "index2-*", "index3-*" ], "privileges" : [ "all" ], "field_security" : { "grant" : [ "*" ] }, "query" : """{"match": {"providedAttributes.user.countryCode": "AT"}}""" } ], "applications" : [ { "application" : "kibana-.kibana", "privileges" : [ "space_read" ], "resources" : [ "space:engineer" ] } ], "run_as" : [], "metadata" : { }, "transient_metadata" : { "enabled" : true } } ``` The Role Mapping for saml1 realm: ```auto GET /_xpack/security/role_mapping/Role.AT { "Role.AT" : { "enabled" : true, "roles" : [ "Role.AT" ], "rules" : { "all" : [ { "field" : { "realm.name" : "saml1" } }, { "field" : { "groups" : "Role.AT" } } ] }, "metadata" : { } } } ``` The SAML part of elasticsearch yml: ```auto nameid_format: "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified" attributes.principal: "nameid" attributes.groups: "role" ``` As my IdP send the Role in the SAML Role attribute as seen in another post above. I have added the role as is Brandon example: ```auto curl -k -H "kbn-xsrf:true" -H "content-type:application/json" -u elastic:changeme -X PUT https://localhost:5601/elk/api/security/role/Role_AT_Dashboard_Only -d ' { "kibana": { "space": { "engineer": ["read"] } } } ' ``` When i enter with the use i still have all the applications and not just the dashboard application. This is the role when i GET it: ```auto { "Role_AT_Dashboard_Only" : { "cluster" : [], "indices" : [], "applications" : [ { "application" : "kibana-.kibana", "privileges" : [ "space_read" ], "resources" : [ "space:engineer" ] } ], "run_as" : [], "metadata" : { }, "transient_metadata" : { "enabled" : true } } } ``` I have replaced on dashboard only advanced setting the default role with my new role and still all the applications are shown. ![adv_1](https://us1.discourse-cdn.com/elastic/original/3X/8/0/808e19b6dd03737d28c15ebfa0a44347634dd37e.png) if i enter with a local user: i enter in my engineer space. if i enter with a saml user, he is going by default to default space. ![pic_saml](https://us1.discourse-cdn.com/elastic/original/3X/a/9/a9af6298f615e936e8ef3288caa510221932ab5b.png) If i have an user with a role A for indexes A and B and space X and in the same time a role B witch is dashboard only role, is the user be able to see only the dashboards for A and B indexes on space X? ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [February 26, 2019, 9:11pm UTC](https://discuss.elastic.co/t/saml-error-with-elk-stack/164673/27 "2019-02-26T21:11:56Z")
We will take a look at first opportunity but in the meantime please use the `` button and/or triple backquotes like ```` ``` preformatted text here ``` ```` to format your text in order for it to be readable. You can use the preview window in the right to make sure it looks fine ! ---
**Author:** ![vapetri](https://avatars.discourse-cdn.com/v4/letter/v/3d9bf3/32.png) [@vapetri](https://discuss.elastic.co/u/vapetri)\ **Post date:** [February 27, 2019, 8:32am UTC](https://discuss.elastic.co/t/saml-error-with-elk-stack/164673/28 "2019-02-27T08:32:25Z")
Hi Ioannis, The only thing which i have now is the dashboard only roles, which are not working as they should. I made the steps as in Brandon blog page and still not working for me. I replaced the dashboard only role in the Kibana Advanced Setting page, didn't work. I have created more roles and add them coma separated to Kibana Advanced Setting page and still didn't work. What i need is that i have 4 roles and each role goes to his designated space and in dashboard only. Somebody did configured this way? Thank you, Victor ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [February 27, 2019, 8:45am UTC](https://discuss.elastic.co/t/saml-error-with-elk-stack/164673/29 "2019-02-27T08:45:13Z")
Can you please format your previous post as it is really hard to go through this now? ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [February 27, 2019, 9:32am UTC](https://discuss.elastic.co/t/saml-error-with-elk-stack/164673/30 "2019-02-27T09:32:36Z")
Your role mapping gives your user the role `Role.AT` but your dashboard only role is `Role_AT_Dashboard_Only`. Change your role mapping to give the `Role_AT_Dashboard_Only` instead of the `Role.AT` role. ---
**Author:** ![vapetri](https://avatars.discourse-cdn.com/v4/letter/v/3d9bf3/32.png) [@vapetri](https://discuss.elastic.co/u/vapetri)\ **Post date:** [February 27, 2019, 10:03am UTC](https://discuss.elastic.co/t/saml-error-with-elk-stack/164673/31 "2019-02-27T10:03:00Z")
Hi, i will do that. What about with a local user. Cause i have the same error. Meaning with a dashboard only role i see all the apps not only dashboard. For me looks like dashboard only roles in Kibana advanced settings is not working: Role.AT: ```auto { "Role.AT" : { "cluster" : [], "indices" : [ { "names" : [ ".kibana*" ], "privileges" : [ "read", "view_index_metadata" ], "field_security" : { "grant" : [ "*" ] } } ], "applications" : [ { "application" : "kibana-.kibana", "privileges" : [ "space_read" ], "resources" : [ "space:engineer" ] } ], "run_as" : [], "metadata" : { }, "transient_metadata" : { "enabled" : true } } } ``` Dashboard advanced setting: ![pic1-img](https://us1.discourse-cdn.com/elastic/original/3X/3/5/35aa438723f0760c3eca83941f0ec3eae8eedf08.jpeg) Local User page: ![pic2-img](https://us1.discourse-cdn.com/elastic/original/3X/8/7/8792eb9b153c36e06c010fd3f92f7fbbf6ac9ede.jpeg) Local User after login see all apps: ![pic3-img](https://us1.discourse-cdn.com/elastic/original/3X/6/0/6080aa2c29402253014acaff3fdb60fbb9441482.jpeg) ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [February 27, 2019, 11:07am UTC](https://discuss.elastic.co/t/saml-error-with-elk-stack/164673/32 "2019-02-27T11:07:01Z")
> [@vapetri](#): > > What about with a local user. There is nothing different for the local user. This is about the role, no matter if you add the role to the user manually, or if they get it from a role mapping. As said before, the `Role.AT` has more permissions than a dashboard only role needs. ( For example `read` access to the `.kibana` index ) Don't use `Role.AT` or change `Role.AT` to a role definition that has only the necessary permissions and not more. See also our [docs](https://www.elastic.co/guide/en/kibana/6.6/advanced-dashboard-mode-configuration.html) ---
**Author:** ![vapetri](https://avatars.discourse-cdn.com/v4/letter/v/3d9bf3/32.png) [@vapetri](https://discuss.elastic.co/u/vapetri)\ **Post date:** [February 27, 2019, 11:27am UTC](https://discuss.elastic.co/t/saml-error-with-elk-stack/164673/33 "2019-02-27T11:27:52Z")
Hi, I have successfully understood how is the space - role inheritance in Kibana: So, the kibana dashboard advanced setting is different stored for each space. So if you need different dashbaord only users and roles in different spaces, this must be set in the dashboard advanced setting inside each space. Maybe should be written more explicit in the documentation, i believe. Thank you for the help and effort, Victor ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [February 27, 2019, 11:30am UTC](https://discuss.elastic.co/t/saml-error-with-elk-stack/164673/34 "2019-02-27T11:30:42Z")
> [@vapetri](#): > > Maybe should be written more explicit in the documentation, i believe. We would really appreciate it if you can open a relevant issue in the [GitHub - elastic/kibana: Your window into the Elastic Stack](https://github.com/elastic/kibana) repository and describe exactly what your issues were and where documentation was not as clear as it could be, so that we can address it ! Glad you got this working in the end ---
**Author:** ![vapetri](https://avatars.discourse-cdn.com/v4/letter/v/3d9bf3/32.png) [@vapetri](https://discuss.elastic.co/u/vapetri)\ **Post date:** [February 27, 2019, 2:24pm UTC](https://discuss.elastic.co/t/saml-error-with-elk-stack/164673/35 "2019-02-27T14:24:24Z")
Hi, Thank you, i will make an account and write on github the Space-Role-Kibana Advanced Mapping Dashboard Only Inheritance. One more thing here. for SAML Attibute mapping, can the country attribute be part of the mapping? According to documentation i have only 5 attributes: principal, groups, name, mail, dn. Meaning, if in elasticsearch.yml i can set like this: ``` attributes.principal: "nameid" attributes.groups: "role" attributes.c: "c" ``` where c is the iso country code, which i am receiving via SAML. I want to use this country code in a granted document query match like: ```auto {"match": {"providedAttributes.user.countryCode": "user.c"}} ``` where the user.c should be received via SAML from IdP. In this way i can create a "dynamic role" based on a SAML attribute received from IdP. Thank you, Victor ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [February 27, 2019, 2:43pm UTC](https://discuss.elastic.co/t/saml-error-with-elk-stack/164673/36 "2019-02-27T14:43:25Z")
Hi > [@vapetri](#): > > Thank you, i will make an account and write on github the Space-Role-Kibana Advanced Mapping Dashboard Only Inheritance. Great ! > [@vapetri](#): > > One more thing here. > for SAML Attibute mapping, can the country attribute be part of the mapping? Yes, and it looks similar to what you are describing. All the SAML Attributes that your IDP sends [become available as user metadata](https://www.elastic.co/guide/en/elastic-stack-overview/current/saml-user-metadata.html) and can be used in role mapping rules and [templated role queries](https://www.elastic.co/guide/en/x-pack/current/field-and-document-access-control.html#templating-role-query) . Assuming that the name of the country code is `countryCode`, i.e. something like ```xml GB ``` this will be available in the metadata of the user as `saml(countryCode)`. So an example templated role query for DLS that would give read access to the documents in `my_index` that have the same country code as the user ( assuming your documents have an `country_code` field) would look like ```auto { "indices" : [ { "names" : ["my_index"], "privileges" : ["read"], "query" : { "template" : { "source" : { "term" : { "country_code" : "{{_user.metadata.saml(countryCode)}}" } } } } } ] } ``` ---
**Author:** ![vapetri](https://avatars.discourse-cdn.com/v4/letter/v/3d9bf3/32.png) [@vapetri](https://discuss.elastic.co/u/vapetri)\ **Post date:** [February 27, 2019, 3:01pm UTC](https://discuss.elastic.co/t/saml-error-with-elk-stack/164673/37 "2019-02-27T15:01:24Z")
Hi, Thank you for answer: ```auto AT ``` This is how we have it. Also should not be add this c attribute to the role mapping in Kibana?. ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [February 27, 2019, 3:15pm UTC](https://discuss.elastic.co/t/saml-error-with-elk-stack/164673/38 "2019-02-27T15:15:29Z")
> [@vapetri](#): > > This is how we have it. ok, then it's `metadata.saml(c)`, nothing much changes. > [@vapetri](#): > > Also should not be add this c attribute to the role mapping in Kibana?. No. You don't want different roles depending on the country code. You want one role that gives access to different documents depending on the country code. It should be part of the role definition only, no the role mapping. ---
**Author:** ![vapetri](https://avatars.discourse-cdn.com/v4/letter/v/3d9bf3/32.png) [@vapetri](https://discuss.elastic.co/u/vapetri)\ **Post date:** [February 27, 2019, 3:20pm UTC](https://discuss.elastic.co/t/saml-error-with-elk-stack/164673/39 "2019-02-27T15:20:55Z")
Hi, I tried but was not working, What about if i set it in attribute.mail based on elasticsearch.yml. How ca i set it in the document query? ``` "term" : { "country_code" : "{{_user.mail}}" } ``` Thank you, Victor ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [February 27, 2019, 3:55pm UTC](https://discuss.elastic.co/t/saml-error-with-elk-stack/164673/40 "2019-02-27T15:55:08Z")
> [@vapetri](#): > > I tried but was not working, This is not helpful. What did you try, how , and how did it not work. > [@vapetri](#): > > What about if i set it in attribute.mail based on elasticsearch.yml. There is not reason to do this [Previous page](https://discuss.elastic.co/t/saml-error-with-elk-stack/164673.md?page=1) [Next page](https://discuss.elastic.co/t/saml-error-with-elk-stack/164673.md?page=3)