# Use group cn in LDAP role mapping

**URL:** <https://discuss.elastic.co/t/use-group-cn-in-ldap-role-mapping/118642>\
**Category:** Elasticsearch\
**Created:** [February 6, 2018, 12:31pm UTC](https://discuss.elastic.co/t/use-group-cn-in-ldap-role-mapping/118642 "2018-02-06T12:31:27Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![adam.laczynski](https://avatars.discourse-cdn.com/v4/letter/a/b5e925/32.png) [@adam.laczynski](https://discuss.elastic.co/u/adam.laczynski)\
**Post date:** [February 6, 2018, 12:31pm UTC](https://discuss.elastic.co/t/use-group-cn-in-ldap-role-mapping/118642/1 "2018-02-06T12:31:27Z")

</div>

I can use group dn in ldap role mapping but I would like to use group cn instead from maintainability perspective. In my LDAP setup group dn contain unique id while group cn is human oriented name.

I have following LDAP setup:

```
Users (o=users,dc=example,dc=com)
- user 1
    dn: guid=u111,o=users,dc=example,dc=com
    cn: user1
- user 2
    dn: guid=u222,o=users,dc=example,dc=com
    cn: user2  

Groups (o=groups,dc=example,dc=com)
- admin group
    dn: guid=g111,o=groups,dc=example,dc=com
    cn: admin
    uniqueMember: guid=u111,o=users,dc=example,dc=com
    uniqueMember: guid=u222,o=users,dc=example,dc=com
    uniqueMember: guid=u333,o=users,dc=example,dc=com

- readonly group
    dn: guid=g222,o=groups,dc=example,dc=com
    cn: readonly
    uniqueMember: guid=u444,o=users,dc=example,dc=com

```

X-Pack settings:

```
xpack:
  security:
    authc:
      realms:
        ldap1:
          type: ldap
          order: 0
          url: ...
          bind_dn: ...
          bind_password: ...
          user_search:
            base_dn: "o=users,dc=example,dc=com"
            attribute: cn
          group_search:
            base_dn: "o=groups,dc=example,dc=com"
            filter: "uniqueMember={0}"
          files:
            role_mapping: "role_mapping.yml"
          unmapped_groups_as_roles: false

```

Role mapping settings:

```
admin: 
  - "guid=g111,o=groups,dc=example,dc=com"

```

The above config works but i would like use group name (cn), sth like:

```
  - "cn=admin,o=groups,dc=example,dc=com"

```

Is it possible? With such LDAP setup I can use group cn e.g. in Splunk or Spring Ldap Security.

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [February 6, 2018, 11:55pm UTC](https://discuss.elastic.co/t/use-group-cn-in-ldap-role-mapping/118642/2 "2018-02-06T23:55:39Z")

</div>

> [@adam.laczynski](#):
>
> Is it possible?

No, it is not possible. Group role mapping can only use the _Distinguished Name_.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 6, 2018, 11:55pm UTC](https://discuss.elastic.co/t/use-group-cn-in-ldap-role-mapping/118642/3 "2018-03-06T23:55:51Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.