# User impersonation does not work with Active directory realm, but it should

**URL:** <https://discuss.elastic.co/t/user-impersonation-does-not-work-with-active-directory-realm-but-it-should/100774>\
**Category:** Elasticsearch\
**Created:** [September 16, 2017, 8:12pm UTC](https://discuss.elastic.co/t/user-impersonation-does-not-work-with-active-directory-realm-but-it-should/100774 "2017-09-16T20:12:20Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![jetnet](https://avatars.discourse-cdn.com/v4/letter/j/a87d85/32.png) [@jetnet](https://discuss.elastic.co/u/jetnet)\
**Post date:** [September 16, 2017, 8:12pm UTC](https://discuss.elastic.co/t/user-impersonation-does-not-work-with-active-directory-realm-but-it-should/100774/1 "2017-09-16T20:12:20Z")

</div>

hi All,

I'm following up the previous topic [User impersonation does not work with Active directory realm](https://discuss.elastic.co/t/user-impersonation-does-not-work-with-active-directory-realm/91519), as the lastest x-pack version 5.6.0 should support [bind\_dn](https://www.elastic.co/guide/en/x-pack/5.6/active-directory-realm.html#ad-settings) parameter.

I tried to setup the user impersonation, but unfortunately it does not work, the system does not even try to contact AD-LDAP, giving immediately 403 error:

```
curl -u iis:secretpassword -H "es-security-runas-user: flast@domain.com" "localhost:19200/t/_search?pretty"

```

response:

```
  "type" : "security_exception",
  "reason" : "action [indices:data/read/search] is unauthorized for user [iis] run as [flast@domain.com]"

```

my realm config:

```auto
        search_ad:
          enabled: true
          type: active_directory
          order: 2
          domain_name: search.local
          user_search:
            base_dn: "DC=search,DC=local"
          group_search:
            base_dn: "DC=search,DC=local"
          url: ldap://dc.search.local:389
          bind_dn: "CN=First Last,OU=Users,OU=Country,DC=search,DC=local"
          bind_password: "XXXXXXX"
          unmapped_groups_as_roles: true
          follow_referrals: false
          cache.ttl: 30s

```

The same configuration works fine for LDAP realm (that means, all users, roles, mapping are setup correctly).  
What could be wrong with my configuration?  
Thank you!

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [September 18, 2017, 7:02am UTC](https://discuss.elastic.co/t/user-impersonation-does-not-work-with-active-directory-realm-but-it-should/100774/2 "2017-09-18T07:02:40Z")

</div>

> What could be wrong with my configuration?

Unfortunately there is a small bug which prevents user impersonation from working with Active Directory in 5.6.0.  
We hope to have a fix soon.

---

<div class="post-metadata">

**Author:** ![jetnet](https://avatars.discourse-cdn.com/v4/letter/j/a87d85/32.png) [@jetnet](https://discuss.elastic.co/u/jetnet)\
**Post date:** [September 18, 2017, 7:16am UTC](https://discuss.elastic.co/t/user-impersonation-does-not-work-with-active-directory-realm-but-it-should/100774/3 "2017-09-18T07:16:53Z")

</div>

Thank you for confirming that!  
I'm very keen to get it working as this would be a very useful feature.

---

<div class="post-metadata">

**Author:** ![jetnet](https://avatars.discourse-cdn.com/v4/letter/j/a87d85/32.png) [@jetnet](https://discuss.elastic.co/u/jetnet)\
**Post date:** [September 23, 2017, 2:29pm UTC](https://discuss.elastic.co/t/user-impersonation-does-not-work-with-active-directory-realm-but-it-should/100774/4 "2017-09-23T14:29:03Z")

</div>

5.6.1 - no improvement ☹

---

<div class="post-metadata">

**Author:** ![jetnet](https://avatars.discourse-cdn.com/v4/letter/j/a87d85/32.png) [@jetnet](https://discuss.elastic.co/u/jetnet)\
**Post date:** [September 27, 2017, 9:34am UTC](https://discuss.elastic.co/t/user-impersonation-does-not-work-with-active-directory-realm-but-it-should/100774/5 "2017-09-27T09:34:43Z")

</div>

5.6.2 - I can confirm - it is fixed!  
SSO with AD works for Kibana now. Great stuff! Thank you very much!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 25, 2017, 9:35am UTC](https://discuss.elastic.co/t/user-impersonation-does-not-work-with-active-directory-realm-but-it-should/100774/6 "2017-10-25T09:35:10Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.