# SAML Group Attributes with more than one group **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [October 25, 2019, 3:34pm UTC](https://discuss.elastic.co/t/saml-group-attributes-with-more-than-one-group/205295 "2019-10-25T15:34:41Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![ramss](https://avatars.discourse-cdn.com/v4/letter/r/977dab/32.png) [@ramss](https://discuss.elastic.co/u/ramss)\ **Post date:** [October 25, 2019, 3:34pm UTC](https://discuss.elastic.co/t/saml-group-attributes-with-more-than-one-group/205295/1 "2019-10-25T15:34:41Z")
Hi All, I am trying to integrate Kibana running on Kuberenetes with on-prem ADFS with the below mapping. SAML Config SAML Config saml: saml1: order: 1 ssl.verification\_mode: none idp.metadata.path: adfs.xml idp.entity\_id: "http://\" sp.entity\_id: "https://\" sp.acs: "https://\/api/security/v1/saml" sp.logout: "https://\/logout" attributes.principal: "nameid:persistent" attributes.groups: "[http://schemas.microsoft.com/ws/2008/06/identity/claims/role](http://schemas.microsoft.com/ws/2008/06/identity/claims/role)" { "type": "server", "timestamp": "2019-10-25T15:22:49,133+0000", "level": "DEBUG", "component": "o.e.x.s.a.s.SamlRealm", "cluster.name": "elasticsearch", "node.name": "elasticsearch-master-2", "cluster.uuid": "DNY-11", "node.id": "NP5gGFycRZ-", "message": "Parsed token [SamlToken{}] to attributes [SamlAttributes(null)[null]{[nameid:persistent=[[username@email.com](mailto:username@email.com)], [http://schemas.xmlsoap.org/claims/Group=](http://schemas.xmlsoap.org/claims/Group=)[Domain Users, APP1\_Group, APP2\_Group, ELK\_Group, APP4\_Group]]}]" } I would like to do the SAML role Mapping for all the users in the group ELK\_Group to have superuser privileges. However, the below role\_mapping is not working. PUT /\_security/role\_mapping/saml-superuser { "roles": ["superuser"], "enabled": true, "rules": { "all": [ { "field": { "realm.name": "saml1" } }, { "field": { "Group": "ELK\_Group" } } ] } } Can anyone help Thanks Ram ---
**Author:** ![Yogesh\_Gaikwad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yogesh_gaikwad/32/27025_2.png) [@Yogesh\_Gaikwad](https://discuss.elastic.co/u/Yogesh_Gaikwad)\ **Post date:** [October 28, 2019, 5:13am UTC](https://discuss.elastic.co/t/saml-group-attributes-with-more-than-one-group/205295/2 "2019-10-28T05:13:01Z")
Hi @ramss, I see a typo in your request for creating role-mapping. Instead of `Group` the field name should be `groups`. > The user fields that are provided to the role mapping are derived from the SAML attributes as follows: > > - `username` : The `principal` attribute > - `dn` : The `dn` attribute > - `groups` : The `groups` attribute Referenced from the docs: [https://www.elastic.co/guide/en/elasticsearch/reference/current/saml-role-mapping.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/saml-role-mapping.html) Hope this helps. Thanks and Regards, Yogesh Gaikwad ---
**Author:** ![ramss](https://avatars.discourse-cdn.com/v4/letter/r/977dab/32.png) [@ramss](https://discuss.elastic.co/u/ramss)\ **Post date:** [October 28, 2019, 4:29pm UTC](https://discuss.elastic.co/t/saml-group-attributes-with-more-than-one-group/205295/3 "2019-10-28T16:29:31Z")
Hi Yogesh, Thanks for your reply. Changed and tested {"statusCode":403,"error":"Forbidden","message":"Forbidden"} I have changed that to groups, still there is no progress. Basically, it is not mapping properly as the return gives a list and mapping is matching with a string "ELK\_Group", there should be a mechanism to search through the list provided `[SamlAttributes(null)[null]{[nameid:persistent=[[username@email.com](mailto:username@email.com)], http://schemas.xmlsoap.org/claims/Group=[Domain Users, APP1_Group, APP2_Group, ELK_Group, APP4_Group]]}]"` and then pick the ELK\_Group. If he is part of any ELK group, then I should do the role mapping. Came across role\_templates: ````auto POST /_security/role_mapping/adfs_role_owner { "role_templates": [ { "template": { "source": "{\"query\":{\"match\":{\"title\":\"{{query_string}}\"}}}" "{{#tojson}}http:\/\/schemas.xmlsoap.org\/claims\/Group{{/tojson}}" }, "format" : "json" } ], "rules": { all: [ { "field": { "realm.name" : "saml1" } }, { "field": { "Group": "ELK_Group" } } ] }, "enabled": true }``` However, this is not solving as well. Any idea??? Thanks & Regards Ram ```` ---
**Author:** ![Yogesh\_Gaikwad](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yogesh_gaikwad/32/27025_2.png) [@Yogesh\_Gaikwad](https://discuss.elastic.co/u/Yogesh_Gaikwad)\ **Post date:** [October 29, 2019, 12:03am UTC](https://discuss.elastic.co/t/saml-group-attributes-with-more-than-one-group/205295/4 "2019-10-29T00:03:49Z")
Hi @ramss, In your SAML realm configuration I see that the attribute name is different than the list of SAML attributes that are parsed from the token. From elasticsearch.yml: `attributes.groups: "http://schemas.microsoft.com/ws/2008/06/identity/claims/role"` and from the log message "" ```auto "message": "Parsed token [SamlToken{}] to attributes [SamlAttributes(null)[null]{[nameid:persistent=[username@email.com], http://schemas.xmlsoap.org/claims/Group=[Domain Users, APP1_Group, APP2_Group, ELK_Group, APP4_Group]]}]" ``` I think we should be using the `http://schemas.xmlsoap.org/claims/Group` as the `attributes.groups:` setting in elasticsearch.yml. This might be the reason for the role mapping failure, can you please try changing this and see how it goes. Regards, Yogesh Gaikwad ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [October 29, 2019, 5:37am UTC](https://discuss.elastic.co/t/saml-group-attributes-with-more-than-one-group/205295/5 "2019-10-29T05:37:34Z")
> [@ramss](#): > > Parsed token [SamlToken{}] to attributes [SamlAttributes(null)[null]{[nameid:persistent=[[username@email.com](mailto:username@email.com)], [http://schemas.xmlsoap.org/claims/Group=](http://schemas.xmlsoap.org/claims/Group=)[Domain Users, APP1\_Group, APP2\_Group, ELK\_Group, APP4\_Group]]}]" > } It looks like you have a misconfiguration here. `nameid:persistent=[[username@email.com](mailto:username@email.com)]` This means that you have configured ADFS to release a SAML _attribute_ with the name `nameid:persistent`. That works, but it's always a bad idea. In Elasticsearch `nameid:persistent` is a magic value that means _Don't read the value from a SAML attribute, read it from the `` (but only if the nameid is persistent)_. Naming an attribute `nameid:persistent` is just asking for trouble. ---
**Author:** ![ramss](https://avatars.discourse-cdn.com/v4/letter/r/977dab/32.png) [@ramss](https://discuss.elastic.co/u/ramss)\ **Post date:** [October 29, 2019, 10:13am UTC](https://discuss.elastic.co/t/saml-group-attributes-with-more-than-one-group/205295/6 "2019-10-29T10:13:32Z")
Hi Yogesh, I tried changing the Group and received the below error. {"type": "server", "timestamp": "2019-10-29T08:34:00,125+0000", "level": "WARN", "component": "o.e.x.s.a.AuthenticationService", "cluster.name": "elasticsearch", "node.name": "elasticsearch-master-1", "cluster.uuid": "DNY-13ojQOKW5ex36jzTJw", "node.id": "Ngh6YsWIQQ2TfRZkkoeetA", "messag e": "An error occurred while attempting to authenticate [] against realm [saml1]" , "stacktrace": ["org.elasticsearch.common.xcontent.XContentParseException: Roles template must generate a string or an array of strings, but foun d [null]", "at org.elasticsearch.xpack.core.security.authc.support.mapper.TemplateRoleName.convertJsonToList(TemplateRoleName.java:121) ~[?:?]", "at org.elasticsearch.xpack.core.security.authc.support.mapper.TemplateRoleName.getRoleNames(TemplateRoleName.java:91) ~[?:?]", "at org.elasticsearch.xpack.core.security.authc.support.mapper.ExpressionRoleMapping.lambda$getRoleNames$3(ExpressionRoleMapping.java:258) ~[?:? ]", I am new to Elastic as well as SAML. sorry for very basic questions. Your help would be much appreciated Thanks Ram ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [October 29, 2019, 11:44am UTC](https://discuss.elastic.co/t/saml-group-attributes-with-more-than-one-group/205295/7 "2019-10-29T11:44:33Z")
> [@ramss](#): > > I tried changing the Group and received the below error. You need to tell us exactly what you changed, so please share your updated configuration. Also , you shouldn't need to user role templates for your use case. If I understand this correctly, you need all users that are members of the `ELK_Group` to get the superuser role, correct ? Then, the following: ```auto PUT /_security/role_mapping/saml-superuser { "roles": ["superuser"], "enabled": true, "rules": { "all": [ { "field": { "realm.name": "saml1" } }, { "field": { "groups": "ELK_Group" } } ] } } ``` should be enough. So in summary, and as @Yogesh_Gaikwad already suggested above: 1. Change 2. Create the role mapping, as I shared it above. Your users will then be able to authenticate and the members of the `ELK_Group` will get the `superuser` role in elasticsearch ---
**Author:** ![ramss](https://avatars.discourse-cdn.com/v4/letter/r/977dab/32.png) [@ramss](https://discuss.elastic.co/u/ramss)\ **Post date:** [October 29, 2019, 11:51am UTC](https://discuss.elastic.co/t/saml-group-attributes-with-more-than-one-group/205295/8 "2019-10-29T11:51:01Z")
Hi Tim, Thanks for your reply. I have added your changes and I think it is matching the values now. However, the TRACE/DEBUG error messages are not informing me a lot. Would you mind looking at it once please? I have also added changes which was mentioned by Yogesh. ADFS Config: =\> issue(store = "Active Directory", types = ("[http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier](http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier)", "[http://schemas.xmlsoap.org/claims/Group](http://schemas.xmlsoap.org/claims/Group)"), query = ";userPrincipalName,tokenGroups;{0}", param = c.Value); SAML Config: saml: saml1: order: 1 ssl.verification\_mode: none idp.metadata.path: adfs.xml idp.entity\_id: "http://ADFS\_LINK" sp.entity\_id: "https://KIBANA\_LINK" sp.acs: "https://KIBANA\_LINK/api/security/v1/saml" sp.logout: "https://KIBANA\_LINK/logout" attributes.principal: "nameid:persistent" attributes.groups: "[http://schemas.xmlsoap.org/claims/Group](http://schemas.xmlsoap.org/claims/Group)" nameid\_format: urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified Error Messages I am getting now: ```auto [SamlToken{3c73616d--------------2049443d225f63306433383232352d393961622d343939302d396562392d63353230393735316634393622205665727369...}] to attributes [SamlAttributes(NameId(null)=username@email.com) {[_3f3a807d-----4810-84d0-1ecd5faa62b4]{[http://schemas.xmlsoap.org/claims/Group=[Domain Users, APP1_Group, APP2_Group, ELK_Group, APP4_Group]]}]" ``` And also the browser display a error messages, where the realm is switched back to basic {"statusCode":401,"error":"Unauthorized","message":"[security\_exception] unable to authenticate user [] for action [cluster:admin/xpack/security/saml/authenticate], with { header={ WWW-Authenticate={ 0="Bearer realm=\"security\"" & 1="ApiKey" & 2="Basic realm=\"security\" charset=\"UTF-8\"" } } }"} Thanks & Regards Ram ---
**Author:** ![ramss](https://avatars.discourse-cdn.com/v4/letter/r/977dab/32.png) [@ramss](https://discuss.elastic.co/u/ramss)\ **Post date:** [October 29, 2019, 11:57am UTC](https://discuss.elastic.co/t/saml-group-attributes-with-more-than-one-group/205295/9 "2019-10-29T11:57:32Z")
> [@ikakavas](#): > > PUT /\_security/role\_mapping/saml-superuser { "roles": ["superuser"], "enabled": true, "rules": { "all": [{ "field": { "realm.name": "saml1" } }, { "field": { "groups": "ELK\_Group" } }] } } Thanks Ioannis, I have changed that configuration and I am receiving the below error {"type": "server", "timestamp": "2019-10-29T11:54:48,095+0000", "level": "WARN", "component": "o.e.x.s.a.AuthenticationService", "cluster.name": "elasticsearch", "node.name": "elasticsearch-master-2", "cluster.uuid": "DNY-13o", "node.id": "NP5gGFycRZ-3rXew6H\_GmA", "message": "Authentication to realm saml1 failed - SAML Attribute [nameid:persistent] for [xpack.security.authc.realms.saml.saml1.attributes.principal] not found in saml attributes[[http://schemas.xmlsoap.org/claims/Group=](http://schemas.xmlsoap.org/claims/Group=)[Domain Users, APP1\_Group, APP2\_Group, ELK\_Group, APP4\_Group]]}]" ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [October 29, 2019, 12:18pm UTC](https://discuss.elastic.co/t/saml-group-attributes-with-more-than-one-group/205295/10 "2019-10-29T12:18:12Z")
Let's take a step back. Many of us chimed in to help and it might got confusing, apologies. The latest error you get now isn't related to the changes I suggested, but to the changes you did due to what Tim was suggesting, which unfortunately weren't enough to address his points. > [@ramss](#): > > I have added your changes and I think it is matching the values now. It doesn't. What you have done now is configure ADFS to release a NameID without a format. This is again almost always wrong. You _don't have to_ use a NameID, but if you do, you need to configure it correctly. We can't help you much with your ADFS configuration, but you need to - either figure out how to release a NameID with persistent format ( based on the value of some attribute ) and configure elasticsearch to map this to the principal property - or use any other attribute to map to the principal property. I.e. UPN The possibilities for correct configuration are many and there isn't a better/simple/only one I can suggest. So I'll suggest _one_ that works and feel free to alter this to your liking. 1. Configure ADFS to release a persistent NameID. There's enough ADFS related documentation around this, i.e. see [Name Identifiers in SAML assertions | Microsoft Learn](https://blogs.msdn.microsoft.com/card/2010/02/17/name-identifiers-in-saml-assertions/) and check the section with subtitle " Persistent name identifier". You need to select which value AD you would pass as the value of the NameID ( == what you should select for `Incoming claim type" in the screenshot ), UPN is a good candidate. 2. Change `nameid_format: urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified` to `nameid_format: urn:oasis:names:tc:SAML:2.0:nameid-format:persistent` in your configuration. 3. Leave everything else as is. ---
**Author:** ![ramss](https://avatars.discourse-cdn.com/v4/letter/r/977dab/32.png) [@ramss](https://discuss.elastic.co/u/ramss)\ **Post date:** [October 29, 2019, 3:11pm UTC](https://discuss.elastic.co/t/saml-group-attributes-with-more-than-one-group/205295/11 "2019-10-29T15:11:39Z")
Hi Thanks for the clear steps The reason I made it `nameid_format: urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified` because the SAML Response was giving the invalidNameIDPolicy ```auto {"type": "server", "timestamp": "2019-10-29T14:46:03,856+0000", "level": "WARN", "component": "o.e.x.s.a.AuthenticationService", "cluster.name": "elasticsearch", "node.name": "elasticsearch-master-1", "cluster.uuid": "DNY-13ojQOKW5ex36jzTJw", "node.id": "Ngh6YsWIQQ2TfRZkkoeetA", "message": "Authentication to realm saml1 failed - Provided SAML response is not valid for realm saml/saml1 (Caused by ElasticsearchSecurityException[SAML Response is not a 'success' response: The SAML IdP did not grant the request. It indicated that the Elastic Stack side sent something invalid (urn:oasis:names:tc:SAML:2.0:status:Requester). Specific status code which might indicate what the issue is: [urn:oasis:names:tc:SAML:2.0:status:InvalidNameIDPolicy]])" } ``` ```auto {"type": "server", "timestamp": "2019-10-29T14:46:04,314+0000", "level": "TRACE", "component": "o.e.x.s.a.s.SamlRealm", "cluster.name": "elasticsearch", "node.name": "elasticsearch-master-1", "cluster.uuid": "DNY-13ojQOKW5ex36jzTJw", "node.id": "Ngh6YsWIQQ2TfRZkkoeetA", "message": "Constructed SAML Authentication Request: \n https://kibana\n \n\n" } ``` ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [October 29, 2019, 3:41pm UTC](https://discuss.elastic.co/t/saml-group-attributes-with-more-than-one-group/205295/12 "2019-10-29T15:41:05Z")
Does it still throw that error, even now after following the steps above when you have configure it to release a persistent Name ID ? ---
**Author:** ![ramss](https://avatars.discourse-cdn.com/v4/letter/r/977dab/32.png) [@ramss](https://discuss.elastic.co/u/ramss)\ **Post date:** [October 29, 2019, 4:03pm UTC](https://discuss.elastic.co/t/saml-group-attributes-with-more-than-one-group/205295/13 "2019-10-29T16:03:59Z")
Yes. I have made the changes and those error messages are after the changes. ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [October 29, 2019, 4:05pm UTC](https://discuss.elastic.co/t/saml-group-attributes-with-more-than-one-group/205295/14 "2019-10-29T16:05:18Z")
If you add it back, does it otherwise work with the instructions from the last post ? ---
**Author:** ![ramss](https://avatars.discourse-cdn.com/v4/letter/r/977dab/32.png) [@ramss](https://discuss.elastic.co/u/ramss)\ **Post date:** [October 29, 2019, 4:25pm UTC](https://discuss.elastic.co/t/saml-group-attributes-with-more-than-one-group/205295/15 "2019-10-29T16:25:23Z")
Yes I have reverted the configuration and I get the previous error ` {"type": "server", "timestamp": "2019-10-29T11:54:48,095+0000", "level": "WARN", "component": "o.e.x.s.a.AuthenticationService", "cluster.name": "elasticsearch", "node.name": "elasticsearch-master-2", "cluster.uuid": "DNY-13o", "node.id": "NP5gGFycRZ-3rXew6H_GmA", "message": "Authentication to realm saml1 failed - SAML Attribute [nameid:persistent] for [xpack.security.authc.realms.saml.saml1.attributes.principal] not found in saml attributes[http://schemas.xmlsoap.org/claims/Group=[Domain Users, APP1_Group, APP2_Group, ELK_Group, APP4_Group]]}]"` ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [October 29, 2019, 5:19pm UTC](https://discuss.elastic.co/t/saml-group-attributes-with-more-than-one-group/205295/16 "2019-10-29T17:19:25Z")
Did you do what I suggested on [SAML Group Attributes with more than one group](https://discuss.elastic.co/t/saml-group-attributes-with-more-than-one-group/205295/10) , especially in point 1. ? It doesnt look like you did that. Do only 1. and not 2. ---
**Author:** ![ramss](https://avatars.discourse-cdn.com/v4/letter/r/977dab/32.png) [@ramss](https://discuss.elastic.co/u/ramss)\ **Post date:** [October 30, 2019, 9:50am UTC](https://discuss.elastic.co/t/saml-group-attributes-with-more-than-one-group/205295/17 "2019-10-30T09:50:46Z")
Yes, I did the following changes at the AD level to transform ```auto IssuanceTransformRules : @RuleTemplate = "LdapClaims" @RuleName = "UPN" c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname", Issuer == "AD AUTHORITY"] => issue(store = "Active Directory", types = ("http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier", "http://schemas.xmlsoap.org/claims/Group"), query = ";userPrincipalName,tokenGroups;{0}", param = c.Value); @RuleTemplate = "MapClaims" @RuleName = "Name ID Persistent" c:[Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier", Properti es["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/format"] == "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified"] => issue(Type = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier", Issuer = c.Issuer, OriginalIssuer = c.OriginalIssuer, Value = c.Value, ValueType = c.ValueType, Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimpro perties/format"] = "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"); ``` ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [October 30, 2019, 10:09am UTC](https://discuss.elastic.co/t/saml-group-attributes-with-more-than-one-group/205295/18 "2019-10-30T10:09:49Z")
I am not sure if this is a correct ADFS configuration but it looks like ADFS still doesn't send a persistent NameId. Please see on [https://www.elastic.co/guide/en/elasticsearch/reference/7.4/trb-security-saml.html](https://www.elastic.co/guide/en/elasticsearch/reference/7.4/trb-security-saml.html) how to enable trace logging ( towards the bottom of the page ) and share your elasticsearch logs from a failed authentication with us please. ---
**Author:** ![ramss](https://avatars.discourse-cdn.com/v4/letter/r/977dab/32.png) [@ramss](https://discuss.elastic.co/u/ramss)\ **Post date:** [November 12, 2019, 2:06pm UTC](https://discuss.elastic.co/t/saml-group-attributes-with-more-than-one-group/205295/19 "2019-11-12T14:06:17Z")
Hi, Apologies for the delay in response. Got into another production issue and got carried away. Managed to login to kibana with just user ID ```auto PUT /security/role_mapping/saml-kibana { "roles": ["kibana_user"], "enabled": true, "rules": { "field": { "realm.name": "saml1" } } } ``` This works!!! I am into role\_mapping now. Came across role\_templates --\> [https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-put-role-mapping.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-put-role-mapping.html) ```auto POST /_security/role_mapping/mapping5 { "role_templates": [ { "template": { "source": "{{#tojson}}groups{{/tojson}}" }, "format" : "json" } ], "rules": { "field" : { "realm.name" : "saml1" } }, "enabled": true } ``` However, I am not sure how many groups will be added in future and ideally I should not be maintaining the groups if I am enabling SAML I should pick and choose the user and assign him different role\_mappings as elk\_admin, elk\_reader, elk\_bus\_user with relevant privileges. User 1: ram-admin : Domain User, **elk\_admin** , k8s\_admin - role\_mapping: elk\_admin\_mapping User 2: ram-reader: Domain User, gcp\_reader, **elk\_reader** - role\_mapping: elk\_reader\_mapping ... Is this possible via role\_templates to only choose the highlighted groups and assign the role mapping accordingly Thanks & Regards Ram ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [November 12, 2019, 2:29pm UTC](https://discuss.elastic.co/t/saml-group-attributes-with-more-than-one-group/205295/20 "2019-11-12T14:29:13Z")
> [@ramss](#): > > I should pick and choose the user and assign him different role\_mappings as elk\_admin, elk\_reader, elk\_bus\_user with relevant privileges. You don't assign role mappings to users. You create role mappings that assign roles to users. The role mappings contain logic that dictates which roles users will get depending on some of their attributes in AD. > [@ramss](#): > > Is this possible via role\_templates to only choose the highlighted groups and assign the role mapping accordingly It is possible but you don't need role templates for this, this is a very common case and we already handle this. Check our docs [Configuring role mappings | Elasticsearch Guide [7.4] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/7.4/saml-role-mapping.html) As an example, If you want the users that are in the AD Group `elk_admin` to get the Elasticsearch role `ram-admin` you need something like: ```auto PUT /_security/role_mapping/saml-mapping-1 { "roles": ["ram-admin"], "enabled": true, "rules": { "all": [ { "field": { "realm.name": "saml1" } }, { "field": { "groups": "elk_admin" } } ] } } ``` [Next page](https://discuss.elastic.co/t/saml-group-attributes-with-more-than-one-group/205295.md?page=2)