# Seprating groups from SAML response

**URL:** <https://discuss.elastic.co/t/seprating-groups-from-saml-response/146492>\
**Category:** Elasticsearch\
**Created:** [August 29, 2018, 9:01am UTC](https://discuss.elastic.co/t/seprating-groups-from-saml-response/146492 "2018-08-29T09:01:09Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Indisol](https://avatars.discourse-cdn.com/v4/letter/i/5f8ce5/32.png) [@Indisol](https://discuss.elastic.co/u/Indisol)\
**Post date:** [August 29, 2018, 9:01am UTC](https://discuss.elastic.co/t/seprating-groups-from-saml-response/146492/1 "2018-08-29T09:01:09Z")

</div>

Dear Team,

I am trying to setup SAML integration for Kibana access.  
my login works but i am facing a challenge to assign roles to the user.

on enabling Debug tracing i see that all the groups that user is member of in User repository is mapped as one string e.g.

[2018-08-29T10:03:41,585][DEBUG][o.e.x.s.a.s.m.NativeRoleMappingStore] [fvn010107] Mapping user [UserData{username:GOO03803; dn:null; groups:[CN=E1 contr. doc OPS ,OU=Groups,OU=ENO,OU=services,o=ed, CN=E1 system administration,OU=Groups,OU=ENO,OU=services,o=ed, CN=E1 contr. doc OPS acc&cust,OU=Groups,OU=ENO,OU=services,o=ed, CN=E1 PCC control,OU=Groups,OU=ENO,OU=services,o=ed, CN=E1 rep. doc CRM C&MB,OU=Groups,OU=ENO,OU=services,o=ed, CN=EO System Administrator LU,OU=Groups,OU=ENO,OU=services,o=ed, CN=E1 rep. doc OPS ,OU=Groups,OU=ENO,OU=services,o=ed, CN=E1 rep. doc OPS acc&cust,OU=Groups,OU=ENO,OU=services,o=ed, CN=E1 PCC Servicedesk create,OU=Groups,OU=ENO,OU=services,o=ed];

every entry from CN=E1 contr. doc OPS ,OU=Groups,OU=ENO,OU=services,o=ed till here, is one group.  
And i am trying to map it to one role.

I feel if i can i specify a separator character and tell ES to make use of it to map to roles.

can you please guide how this can be achieved.

regards,  
indi

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [August 30, 2018, 2:16am UTC](https://discuss.elastic.co/t/seprating-groups-from-saml-response/146492/2 "2018-08-30T02:16:10Z")

</div>

> [@Indisol](#):
>
> see that all the groups that user is member of in User repository is mapped as one string e.g

That's probably not the case. The debug logging is ambiguous, but this looks like it is actually a list.

> groups:[CN=E1 contr. doc OPS ,OU=Groups,OU=ENO,OU=services,o=ed, CN=E1 system administration,OU=Groups,OU=ENO,OU=services,o=ed, CN=E1 contr. doc OPS acc&cust,OU=Groups,OU=ENO,OU=services,o=ed, CN=E1 PCC control,OU=Groups,OU=ENO,OU=services,o=ed, CN=E1 rep. doc CRM C&MB,OU=Groups,OU=ENO,OU=services,o=ed, CN=EO System Administrator LU,OU=Groups,OU=ENO,OU=services,o=ed, CN=E1 rep. doc OPS ,OU=Groups,OU=ENO,OU=services,o=ed, CN=E1 rep. doc OPS acc&cust,OU=Groups,OU=ENO,OU=services,o=ed, CN=E1 PCC Servicedesk create,OU=Groups,OU=ENO,OU=services,o=ed]

Is probably actually this, but the log representation doesn't make that clear.

- CN=E1 contr. doc OPS ,OU=Groups,OU=ENO,OU=services,o=ed
- CN=E1 system administration,OU=Groups,OU=ENO,OU=services,o=ed
- CN=E1 contr. doc OPS acc&cust,OU=Groups,OU=ENO,OU=services,o=ed
- CN=E1 PCC control,OU=Groups,OU=ENO,OU=services,o=ed
- CN=E1 rep. doc CRM C&MB,OU=Groups,OU=ENO,OU=services,o=ed
- CN=EO System Administrator LU,OU=Groups,OU=ENO,OU=services,o=ed
- CN=E1 rep. doc OPS ,OU=Groups,OU=ENO,OU=services,o=ed
- CN=E1 rep. doc OPS acc&cust,OU=Groups,OU=ENO,OU=services,o=ed
- CN=E1 PCC Servicedesk create,OU=Groups,OU=ENO,OU=services,o=ed

Where there is a `", "`, then that's (probably) due to the way the log entry formats the list entries.

---

<div class="post-metadata">

**Author:** ![Indisol](https://avatars.discourse-cdn.com/v4/letter/i/5f8ce5/32.png) [@Indisol](https://discuss.elastic.co/u/Indisol)\
**Post date:** [September 3, 2018, 10:11am UTC](https://discuss.elastic.co/t/seprating-groups-from-saml-response/146492/3 "2018-09-03T10:11:46Z")

</div>

thanks for the response Tim,

i modified the SAML response so instead of returning CN=E1 contr. doc OPS ,OU=Groups,OU=ENO,OU=services,o=ed  
It now returns only E1 contr. doc OPS  
that way now i have a comma seprated list of groups.

I was able to map them to roles defined in role\_mapping.yml via API command  
POST /\_xpack/security/role\_mapping/

regards,  
Indi

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 1, 2018, 10:11am UTC](https://discuss.elastic.co/t/seprating-groups-from-saml-response/146492/4 "2018-10-01T10:11:55Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.