# Shield AD user is unauthorized only from a different subnet **URL:** \ **Category:** Elasticsearch\ **Tags:** elastic-stack-security\ **Created:** [June 26, 2016, 5:43pm UTC](https://discuss.elastic.co/t/shield-ad-user-is-unauthorized-only-from-a-different-subnet/53977 "2016-06-26T17:43:21Z")\ **Posts on this page:** 4\ **Page:** 2
**Author:** ![slalomnut](https://avatars.discourse-cdn.com/v4/letter/s/48db29/32.png) [@slalomnut](https://discuss.elastic.co/u/slalomnut)\ **Post date:** [June 29, 2016, 9:43pm UTC](https://discuss.elastic.co/t/shield-ad-user-is-unauthorized-only-from-a-different-subnet/53977/21 "2016-06-29T21:43:53Z")
Absolutely. Progress.... That allowed it to write to the topbeat and filebeat indexes. roles.yml snippet: # The required role for logstash users logstash: cluster: - manage\_index\_templates indices: # - names: ['logstash-_', 'filebeat-_', 'topbeat-_', 'cisco-_', 'netsyslog-\*'] ``` - names: '*' privileges: - write - delete - create_index ``` logstash.log snippet: client\_ip"=\>"127.0.0.1", "server"=\>"pulp01v", "method"=\>"find", "@version"=\>"1", "host"=\>"pulp01v", "tags"=\>["beats\_input\_raw\_event", "\_grokparsefailure", "generic\_log"], "syslog\_severity\_code"=\>5, "syslog\_facility\_code"=\>1, "syslog\_facility"=\>"user-level", "syslog\_severity"=\>"notice"}, "DestinationAddress"]}\>\>], :response=\>{"index"=\>{"\_index"=\>"packetbeat-2016.06.29", "\_type"=\>"mongodb", "\_id"=\>nil, "status"=\>403, "error"=\>{"type"=\>"security\_exception", "reason"=\>"action [indices:admin/create] is unauthorized for user [s\_logstash02v]"}}}, :level=\>:warn} elasticsearch.log snippet: [20:46:25,818][I][node] [node-01] started [20:47:33,447][D][shield.authc.activedirectory] [node-01] user not found in cache, proceeding with normal authentication [20:47:33,699][D][shield.authc.activedirectory] [node-01] group SID to DN search filter: [(|(objectSid=S-1-5-32-545)(objectSid=S-1-5-21-3672824143-1806866617-33 68692887-513)(objectSid=S-1-5-21-3672824143-1806866617-3368692887-1836)(objectSid=S-1-5-21-3672824143-1806866617-3368692887-1371))] [20:47:33,747][D][shield.authc.activedirectory] [node-01] found these groups [[CN=Users,CN=Builtin,DC=domain,DC=local, CN=Domain Users,CN=Users,DC=domain,DC=loc al, CN=PentahoRO,CN=Users,DC=domain,DC=local, CN=Desktop Admins,CN=Users,DC=domain,DC=local]] for userDN [CN=s\_logstash02v,OU=ServiceAccounts,OU=Employees,DC=do main,DC=local] [20:47:33,748][D][shield.authc.support] [node-01] the roles [[Desktop Admins, Domain Users, PentahoRO, Users]], are mapped from these [active\_directory] gr oups [[CN=Users,CN=Builtin,DC=domain,DC=local, CN=Domain Users,CN=Users,DC=domain,DC=local, CN=PentahoRO,CN=Users,DC=domain,DC=local, CN=Desktop Admins,CN=Users ,DC=domain,DC=local]] for realm [active\_directory/active\_directory] [20:47:33,748][D][shield.authc.support] [node-01] the roles [[logstash]], are mapped from the user [active\_directory] for realm [CN=s\_logstash02v,OU=Servic eAccounts,OU=Employees,DC=domain,DC=local/active\_directory] [20:47:33,753][D][shield.authc.activedirectory] [node-01] authenticated user [s\_logstash02v], with roles [[logstash, Desktop Admins, Domain Users, PentahoRO, Us ers]] [20:47:33,756][D][shield.audit.logfile] [node-01] [transport] [access\_granted] origin\_type=[rest], origin\_address=[10.1.x.x], principal=[s\_logstash02v] , action=[indices:admin/template/get], request=[GetIndexTemplatesRequest] [20:47:33,895][D][shield.authc.activedirectory] [node-01] authenticated user [s\_logstash02v], with roles [[logstash, Desktop Admins, Domain Users, PentahoRO, Us ers]] [20:48:33,803][D][shield.audit.logfile] [node-01] [transport] [access\_granted] origin\_type=[rest], origin\_address=[10.1.x.x], principal=[s\_logstash02v], action=[indices:data/write/bulk[s]], indices=[topbeat-2016.06.29,topbeat-2016.06.29,topbeat-2016.06.29,topbeat-2016.06.29,topbeat-2016.06.29], request=[BulkS hardRequest] [20:48:33,803][D][shield.audit.logfile] [node-01] [transport] [access\_granted] origin\_type=[rest], origin\_address=[10.1.x.x], principal=[s\_logstash02v], action=[indices:data/write/bulk[s][p]], indices=[topbeat-2016.06.29,topbeat-2016.06.29,topbeat-2016.06.29,topbeat-2016.06.29,topbeat-2016.06.29], request=[Bu lkShardRequest] [20:48:33,806][D][shield.audit.logfile] [node-01] [transport] [access\_granted] origin\_type=[transport], origin\_address=[10.1.x.x], principal=[s\_logsta sh02v], action=[indices:data/write/bulk[s][r]], indices=[topbeat-2016.06.29,topbeat-2016.06.29,topbeat-2016.06.29,topbeat-2016.06.29,topbeat-2016.06.29,topbeat- 2016.06.29], request=[BulkShardRequest] [20:48:33,817][W][action.bulk] [node-01] [topbeat-2016.06.29][0] failed to perform indices:data/write/bulk[s][r] on node {node-04-kibana}{YpmE06nG SQm\_qXhnYv2NKg}{10.1.x.x}{10.1.x.x:9300}{master=false} [20:48:33,820][D][shield.audit.logfile] [node-01] [transport] [access\_granted] origin\_type=[transport], origin\_address=[10.1.x.x], principal=[s\_logsta sh02v], action=[indices:data/write/bulk[s][r]], indices=[topbeat-2016.06.29,topbeat-2016.06.29,topbeat-2016.06.29,topbeat-2016.06.29,topbeat-2016.06.29,topbeat- 2016.06.29,topbeat-2016.06.29,topbeat-2016.06.29,topbeat-2016.06.29,topbeat-2016.06.29,topbeat-2016.06.29], request=[BulkShardRequest] ---
**Author:** ![jaymode](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jaymode/32/50103_2.png) [@jaymode](https://discuss.elastic.co/u/jaymode)\ **Post date:** [June 30, 2016, 10:46am UTC](https://discuss.elastic.co/t/shield-ad-user-is-unauthorized-only-from-a-different-subnet/53977/22 "2016-06-30T10:46:30Z")
I think the index names portion of your role isn't quite correct, it seems to be missing the wildcards and you also have packetbeat data coming in. So I think something like this would work: ``` - names: ['logstash-*', 'filebeat-*', 'topbeat-*', 'cisco-*', 'netsyslog-*', 'packetbeat-*'] ``` ---
**Author:** ![slalomnut](https://avatars.discourse-cdn.com/v4/letter/s/48db29/32.png) [@slalomnut](https://discuss.elastic.co/u/slalomnut)\ **Post date:** [June 30, 2016, 4:16pm UTC](https://discuss.elastic.co/t/shield-ad-user-is-unauthorized-only-from-a-different-subnet/53977/23 "2016-06-30T16:16:39Z")
I had the wildcards in the config but not packetbeat-_. It could be the packetbeat index requests over-ran everything else and all we saw in the logs were the denied requests for that index. After adding packetbeat-_ to the roles on the entire cluster, everything looks good but I still don't understand why I didn't see failures / denies when it was on the same subnet. roles.yml snippet: logstash: cluster: - manage\_index\_templates indices: # - names: ['logstash-_', 'filebeat-_', 'topbeat-_', 'cisco-_', 'netsyslog-\*'] ``` - names: ['logstash-*', 'filebeat-*', 'topbeat-*', 'cisco-*', 'netsyslog-*', 'packetbeat-*', 'winlogbeat-*', 'syslog-*'] ``` # - names: '\*' ``` privileges: - write - delete - create_index ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 1:43pm UTC](https://discuss.elastic.co/t/shield-ad-user-is-unauthorized-only-from-a-different-subnet/53977/24 "2017-07-06T13:43:14Z")
Closed on July 6, 2017, 1:43pm UTC [Previous page](https://discuss.elastic.co/t/shield-ad-user-is-unauthorized-only-from-a-different-subnet/53977.md?page=1)