# Super user Role not working for SAML users **URL:** \ **Category:** Kibana\ **Created:** [October 23, 2018, 4:52pm UTC](https://discuss.elastic.co/t/super-user-role-not-working-for-saml-users/153651 "2018-10-23T16:52:04Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Hanciv](https://avatars.discourse-cdn.com/v4/letter/h/ea666f/32.png) [@Hanciv](https://discuss.elastic.co/u/Hanciv)\ **Post date:** [October 23, 2018, 4:52pm UTC](https://discuss.elastic.co/t/super-user-role-not-working-for-saml-users/153651/1 "2018-10-23T16:52:04Z")
Hi, We are in the process of setting up SAML authentication with ELK. From Elastic Search, we are integrating with OneLogin, The integreation is successful and I am able to login with SAML user. I have given the role of superuser to the SAML user (by logging as elastic). When I login as the saml user, I am able to access all the menus in the "Management" tab except the Users and Roles for which I am getting Permission denied You do not have permission to manage users. Kindly let me know how this can be resolved ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [October 24, 2018, 6:20am UTC](https://discuss.elastic.co/t/super-user-role-not-working-for-saml-users/153651/2 "2018-10-24T06:20:10Z")
> [@Hanciv](#): > > I have given the role of superuser to the SAML user (by logging as elastic). What do you mean by this? That your OneLogin user is called `elastic`? That doesn't make them a superuser. Users are contained entirely within their own realms, so the builtin `elastic` user is not the same as a saml `elastic` user. The only way to make a SAML user a `superuser` is to grant them that role through the role-mapping API in Elasticsearch. ---
**Author:** ![Hanciv](https://avatars.discourse-cdn.com/v4/letter/h/ea666f/32.png) [@Hanciv](https://discuss.elastic.co/u/Hanciv)\ **Post date:** [October 24, 2018, 7:14pm UTC](https://discuss.elastic.co/t/super-user-role-not-working-for-saml-users/153651/3 "2018-10-24T19:14:20Z")
No, My onelogin user name is not elastic. What I meant is, I provided super user role to my saml user by logging in to Kibana and adding roles through the management tab. I tried setting up the role through Role Mapping API and it worked 🙂 Wonder why its not working when setting it up through Kibana Management menu ---
**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\ **Post date:** [October 25, 2018, 2:17am UTC](https://discuss.elastic.co/t/super-user-role-not-working-for-saml-users/153651/4 "2018-10-25T02:17:55Z")
> [@Hanciv](#): > > Wonder why its not working when setting it up through Kibana Management menu This is the same reason as above - when you assign roles in the Kibana Management UI, you were acting on a user in the "native" realm, not the saml realm. It short, the "hanciv" user in that UI is unrelated to a "hanciv" user that authenticates via SAML. ---
**Author:** ![Hanciv](https://avatars.discourse-cdn.com/v4/letter/h/ea666f/32.png) [@Hanciv](https://discuss.elastic.co/u/Hanciv)\ **Post date:** [October 25, 2018, 1:17pm UTC](https://discuss.elastic.co/t/super-user-role-not-working-for-saml-users/153651/5 "2018-10-25T13:17:13Z")
Thanks, got it. So i dont have to provision the users locally in Kibana if they are coming through saml realm.. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 22, 2018, 1:17pm UTC](https://discuss.elastic.co/t/super-user-role-not-working-for-saml-users/153651/6 "2018-11-22T13:17:16Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.