# Setup AD authentication

**URL:** <https://discuss.elastic.co/t/setup-ad-authentication/168103>\
**Category:** Elasticsearch\
**Tags:** elastic-stack-security\
**Created:** [February 12, 2019, 7:39pm UTC](https://discuss.elastic.co/t/setup-ad-authentication/168103 "2019-02-12T19:39:11Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mbarker](https://avatars.discourse-cdn.com/v4/letter/m/b5a626/32.png) [@mbarker](https://discuss.elastic.co/u/mbarker)\
**Post date:** [February 12, 2019, 7:39pm UTC](https://discuss.elastic.co/t/setup-ad-authentication/168103/1 "2019-02-12T19:39:11Z")

</div>

I am new to ELK, I am trying to setup AD authentication but has run into issues. I am seeing the following error in my log.  
failed to parse role [admin]. skipping role...  
failed to parse role [power\_user]. skipping role..

My roles.yml config file

# All cluster rights

# All operations on all indices

admin:  
cluster: all  
indices:  
'\*': all

# 

# Monitoring cluster privileges

# All operations on all indices

power\_user:  
cluster: monitor  
indices:  
'\*': all

When I try to log into Kibana as the AD user I get the following

{"message":"action [indices:data/read/search] is unauthorized for user [es\_svc\_user@example.dom]: [security\_exception] action [indices:data/read/search] is unauthorized for user [es\_svc\_user@example.dom]","statusCode":403,"error":"Forbidden"}

Any hep will be appreciated

---

<div class="post-metadata">

**Author:** ![ikakavas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ikakavas/32/34430_2.png) [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Post date:** [February 13, 2019, 6:11am UTC](https://discuss.elastic.co/t/setup-ad-authentication/168103/2 "2019-02-13T06:11:36Z")

</div>

Hi,

As the error message is clearly saying, your role definitions are wrong and your user gets authenticated but is not authorized to do anything because they have no roles, thus no permissions. It's really hard for us to see what is wrong right now, so please update your post and add the text you copied from your `roles.yml` as preformatted text using the `</>` button. It's probably your `indices` field missing a `names`and a`privileges` subfield. See our [documentation](https://www.elastic.co/guide/en/elastic-stack-overview/current/defining-roles.html) about defining roles, this will help you immensely.

Defining the roles is step 1, you also need to setup the role mappings which are the rules that dictate which user get what roles, see [our documentation](https://www.elastic.co/guide/en/elastic-stack-overview/current/mapping-roles.html)

Finally, we'd suggest that you use the [Role Management APIs](https://www.elastic.co/guide/en/elasticsearch/reference/6.6/security-api-put-role.html) and the [Role Mapping API](https://www.elastic.co/guide/en/elasticsearch/reference/6.6/security-api-put-role-mapping.html) instead of the file based roles and mappings.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 13, 2019, 6:11am UTC](https://discuss.elastic.co/t/setup-ad-authentication/168103/3 "2019-03-13T06:11:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.