# SAML Role mapping (Keycloak Idp)

**URL:** <https://discuss.elastic.co/t/saml-role-mapping-keycloak-idp/302270>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [April 12, 2022, 7:29pm UTC](https://discuss.elastic.co/t/saml-role-mapping-keycloak-idp/302270 "2022-04-12T19:29:39Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vitali\_Lushchyk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vitali_lushchyk/32/104120_2.png) [@Vitali\_Lushchyk](https://discuss.elastic.co/u/Vitali_Lushchyk)\
**Post date:** [April 12, 2022, 7:29pm UTC](https://discuss.elastic.co/t/saml-role-mapping-keycloak-idp/302270/1 "2022-04-12T19:29:39Z")

</div>

**cluster elasticsearch configuration** :

```auto
xpack.security.authc.realms.saml.saml1:
  order: 2
  idp.metadata.path: https://login-uat.exadel.com/auth/realms/exadel-uat/protocol/saml/descriptor
  idp.entity_id: "https://login-uat.exadel.com/auth/realms/exadel-uat"
  sp.entity_id: "elastic.co"
  sp.acs: "https://exadel.kb.westeurope.azure.elastic-cloud.com:9243/api/security/saml/callback"
  sp.logout: "https://exadel.kb.westeurope.azure.elastic-cloud.com:9243/logout"
  attributes.principal: "urn:oid:0.9.2342.19200300.100.1.1"
  attributes.groups: "roles"

```

**Create role mapping:**

```auto
PUT /_security/role_mapping/saml-example
{
  "roles": ["superuser"],
  "enabled": true,
  "rules": { "all": [
    { "field": { "realm.name": "saml1" } },
    { "field": { "groups": "/kibana_admin" } }
  ]}
}

```

**Logs:**

```auto
[instance-0000000000] SAML user = [User[username=user1,roles=[],fullName=null,email=null,metadata={saml(member)=[/kibana_admin], saml_nameid=user1, saml(email)=[user1@exadel.com], saml_email=[user1@exadel.com], saml_username=[user1], saml_group_mapping=[/kibana_admin], saml_nameid_format=urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified, saml(urn:oid:0.9.2342.19200300.100.1.1)=[user1]}]]

```

```auto
[instance-0000000000] SAML attribute mapping = [UserData{username:user1; dn:null; groups:[]; metadata:{saml(member)=[/kibana_admin], saml_nameid=user1, saml(email)=[user1@exadel.com], saml_email=[user1@exadel.com], saml_username=[user1], saml_group_mapping=[/kibana_admin], saml_nameid_format=urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified, saml(urn:oid:0.9.2342.19200300.100.1.1)=[user1]}; realm=saml1}]

```

Error: When connect to kibana URL

## You do not have permission to access the requested page

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [April 12, 2022, 11:18pm UTC](https://discuss.elastic.co/t/saml-role-mapping-keycloak-idp/302270/2 "2022-04-12T23:18:26Z")

</div>

> [@Vitali\_Lushchyk](#):
>
> `saml(member)=[/kibana_admin],`

Keycloak is sending the groups list in an attribute named `member`.  
You need to change your realm config to

```auto
attributes.groups: "member"

```

---

<div class="post-metadata">

**Author:** ![Vitali\_Lushchyk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vitali_lushchyk/32/104120_2.png) [@Vitali\_Lushchyk](https://discuss.elastic.co/u/Vitali_Lushchyk)\
**Post date:** [April 13, 2022, 5:46am UTC](https://discuss.elastic.co/t/saml-role-mapping-keycloak-idp/302270/3 "2022-04-13T05:46:45Z")

</div>

Thx a lot @TimV. That is works.

---

<div class="post-metadata">

**Author:** ![Vitali\_Lushchyk](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vitali_lushchyk/32/104120_2.png) [@Vitali\_Lushchyk](https://discuss.elastic.co/u/Vitali_Lushchyk)\
**Post date:** [April 13, 2022, 11:49am UTC](https://discuss.elastic.co/t/saml-role-mapping-keycloak-idp/302270/4 "2022-04-13T11:49:47Z")

</div>

@TimV How to pass roles from our idp

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 11, 2022, 11:49am UTC](https://discuss.elastic.co/t/saml-role-mapping-keycloak-idp/302270/5 "2022-05-11T11:49:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.