# Security Exception in ES

**URL:** <https://discuss.elastic.co/t/security-exception-in-es/41806>\
**Category:** Elasticsearch\
**Created:** [February 15, 2016, 4:27pm UTC](https://discuss.elastic.co/t/security-exception-in-es/41806 "2016-02-15T16:27:49Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![sombilat](https://avatars.discourse-cdn.com/v4/letter/s/779978/32.png) [@sombilat](https://discuss.elastic.co/u/sombilat)\
**Post date:** [February 15, 2016, 4:27pm UTC](https://discuss.elastic.co/t/security-exception-in-es/41806/1 "2016-02-15T16:27:49Z")

</div>

Hello,

We have enabled Elastic Shield on our Elasticsearch plugin, however we are unable to create restorepoints as seen below.

![](https://us1.discourse-cdn.com/elastic/original/2X/4/4dfe30be2d5eaef78410d3fff4aeb1b1ddbe33ac.png)

Problem is, it keeps giving us a security exception when the acct has all the priveleges possible.

I tried googling the WWW-Authenticate, but it just points to ES's Documentation.

Can you guys help me on determining why cant this user access the Snapshots? I want to view them first before I create some snapshots. 😃

Thanks,

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [February 15, 2016, 4:30pm UTC](https://discuss.elastic.co/t/security-exception-in-es/41806/2 "2016-02-15T16:30:21Z")

</div>

Can you provide the role and role mapping for the user?

---

<div class="post-metadata">

**Author:** ![dadoonet](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dadoonet/32/137187_2.png) [@dadoonet](https://discuss.elastic.co/u/dadoonet)\
**Post date:** [February 15, 2016, 4:40pm UTC](https://discuss.elastic.co/t/security-exception-in-es/41806/3 "2016-02-15T16:40:55Z")

</div>

Yeah a common error (I ran into it) is to invert roles and users in `role_mapping.yml`...

---

<div class="post-metadata">

**Author:** ![sombilat](https://avatars.discourse-cdn.com/v4/letter/s/779978/32.png) [@sombilat](https://discuss.elastic.co/u/sombilat)\
**Post date:** [February 15, 2016, 4:59pm UTC](https://discuss.elastic.co/t/security-exception-in-es/41806/4 "2016-02-15T16:59:34Z")

</div>

Hey,

@warkolm, @dadoonet

Appreciate the Help, but apologies from my end. Was a typo on my end, I am probably dyslexic now.  
🙂

It is working now, just probably gonna take this Topic down.

Thanks,

---

<div class="post-metadata">

**Author:** ![srikanth\_muddu](https://avatars.discourse-cdn.com/v4/letter/s/9e8a1a/32.png) [@srikanth\_muddu](https://discuss.elastic.co/u/srikanth_muddu)\
**Post date:** [December 7, 2016, 1:02pm UTC](https://discuss.elastic.co/t/security-exception-in-es/41806/5 "2016-12-07T13:02:25Z")

</div>

I face the same error when i try to perform any operation in ES-5.0.0

Ex:  
curl -XPOST 'localhost:9200/elk/elastic?pretty' -d '

> {  
> "tag" : "working out with ES"  
> }'

Result:  
{  
"error" : {  
"root\_cause" : [  
{  
"type" : "security\_exception",  
"reason" : "missing authentication token for REST request [/elk/elastic?pretty]",  
"header" : {  
"WWW-Authenticate" : "Basic realm="security" charset="UTF-8""  
}  
}  
],  
"type" : "security\_exception",  
"reason" : "missing authentication token for REST request [/elk/elastic?pretty]",  
"header" : {  
"WWW-Authenticate" : "Basic realm="security" charset="UTF-8""  
}  
},  
"status" : 401  
}

role\_mapping.yml:

# Role mapping configuration file which has elasticsearch roles as keys

# that map to one or more user or group distinguished names

#roleA: this is an elasticsearch role

# - groupA-DN this is a group distinguished name

# - groupB-DN

# - user1-DN this is the full user distinguished name

#power\_user:

# - "cn=admins,dc=example,dc=com"

#user:

# - "cn=users,dc=example,dc=com"

# - "cn=admins,dc=example,dc=com"

# - "cn=John Doe,cn=other users,dc=example,dc=com"

what do i do to make it work,Please do help

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [December 7, 2016, 8:28pm UTC](https://discuss.elastic.co/t/security-exception-in-es/41806/6 "2016-12-07T20:28:44Z")

</div>

Please start your own thread.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [December 7, 2016, 8:28pm UTC](https://discuss.elastic.co/t/security-exception-in-es/41806/7 "2016-12-07T20:28:47Z")

</div>