# SAML SSO - Associate the roles to the user (not groups) **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [October 31, 2018, 10:21am UTC](https://discuss.elastic.co/t/saml-sso-associate-the-roles-to-the-user-not-groups/154810 "2018-10-31T10:21:11Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![bruno.henriques](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bruno.henriques/32/36920_2.png) [@bruno.henriques](https://discuss.elastic.co/u/bruno.henriques)\ **Post date:** [October 31, 2018, 10:21am UTC](https://discuss.elastic.co/t/saml-sso-associate-the-roles-to-the-user-not-groups/154810/1 "2018-10-31T10:21:11Z")
Hello, I have set up a IdP ([simplesamlphp.org](http://simplesamlphp.org)) with a User with the following attributes: - `'email' => 'user1@system.com'` - `'User.fullname' => 'User 1'` - `'User.roles' => array('admin')` And have setup elasticsearch's SAML setting: - `attributes.principal:"email"` - `attributes.groups:"User.roles"` However, as far as I understood, I still have to create a role mapping that will map, for example, the group `admin` to the role `superuser` (`/_xpack/security/role_mapping/`) How can I avoid this step? More context: The roles and permissions are managed externally (we use custom realms for this purpose). I just need that Elasticsearch resolves the permissions using the roles defined in the IdP without the need to have the association `Group -> Role` for each role possble. ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [October 31, 2018, 10:37am UTC](https://discuss.elastic.co/t/saml-sso-associate-the-roles-to-the-user-not-groups/154810/2 "2018-10-31T10:37:40Z")
Hi, Apologies, but can you clarify what you want to achieve ? > [@bruno.henriques](#): > > However, as far as I understood, I still have to create a role mapping that will map, for example, the group `admin` to the role `superuser` ( `/_xpack/security/role_mapping/` ) Yes, this is the usual step to get the SAML attributes that the IDP sends mapped to Elasticsearch roles. > [@bruno.henriques](#): > > I just need that Elasticsearch resolves the permissions using the roles defined in the IdP without the need to have the association `Group -*> Roles` . If you don't want to do this via the Role Mapping API, how will your user get the Roles? Is that via a custom Role Provider ? And if so, is that already in place and working or is it something that you plan on building? ---
**Author:** ![bruno.henriques](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bruno.henriques/32/36920_2.png) [@bruno.henriques](https://discuss.elastic.co/u/bruno.henriques)\ **Post date:** [October 31, 2018, 11:13am UTC](https://discuss.elastic.co/t/saml-sso-associate-the-roles-to-the-user-not-groups/154810/3 "2018-10-31T11:13:45Z")
> [@ikakavas](#): > > API, how will your user get the Roles? Hello. We have a: - Custom Realm that delegates authentication to our system which returns the user and its roles. - Custom Roles Provider that given a user's roles (retrieved in our customs authentication Realm) retrieves from our system the set of roles and their permissions and tells if the user is authorized to access a Elastic stack resource. I am testing replacing this custom realm with a SAML IdP however this SAML realm returns the groups and not the roles which led me to the roles mapping endpoint. My goal and question is for the SAML realm to create a model of the user when authenticating that already includes the roles from the SAML attributes (inside `User.roles`) ---
**Author:** ![bruno.henriques](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bruno.henriques/32/36920_2.png) [@bruno.henriques](https://discuss.elastic.co/u/bruno.henriques)\ **Post date:** [October 31, 2018, 11:39am UTC](https://discuss.elastic.co/t/saml-sso-associate-the-roles-to-the-user-not-groups/154810/4 "2018-10-31T11:39:31Z")
> [@ikakavas](#): > > Yes, this is the usual step to get the SAML attributes that the IDP sends mapped to Elasticsearch roles. Can't the SAML Realm automatically retrieve the `User.roles` attribute and map it to a Elasticsearch role (instead of group)? ---
**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Post date:** [October 31, 2018, 11:54am UTC](https://discuss.elastic.co/t/saml-sso-associate-the-roles-to-the-user-not-groups/154810/5 "2018-10-31T11:54:23Z")
> [@bruno.henriques](#): > > Can't the SAML Realm automatically retrieve the `User.roles` attribute and map it to a Elasticsearch role (instead of group)? No, unfortunately this is not possible. Elasticsearch is authoritative for its own Authorization logic so you can't just pass it the Elasticsearch Role names via SAML. You don't need to map it to `groups` per se, but you would still need to statically create 1 role mapping per IDP role as ```auto PUT _xpack/security/role_mapping/role_1 { "roles" : ["role_1"], "rules" : { "field" : { "metadata.saml(User.roles )" : "role_1" } }, "enabled": true } ``` Then you could keep on using your existing Custom Role Provider to resolve `role_1` to permissions. ---
**Author:** ![bruno.henriques](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bruno.henriques/32/36920_2.png) [@bruno.henriques](https://discuss.elastic.co/u/bruno.henriques)\ **Post date:** [October 31, 2018, 1:15pm UTC](https://discuss.elastic.co/t/saml-sso-associate-the-roles-to-the-user-not-groups/154810/6 "2018-10-31T13:15:01Z")
Thank you for your feedback! This step is a bit cumbersome in my use-case but I understand the limitation. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 28, 2018, 1:15pm UTC](https://discuss.elastic.co/t/saml-sso-associate-the-roles-to-the-user-not-groups/154810/7 "2018-11-28T13:15:06Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.