# Using sAMAccountName instead of CN in role mapping file?
**URL:** https://discuss.elastic.co/t/using-samaccountname-instead-of-cn-in-role-mapping-file/88563
**Category:** Elasticsearch
**Created:** [June 7, 2017, 11:28am UTC](https://discuss.elastic.co/t/using-samaccountname-instead-of-cn-in-role-mapping-file/88563 "2017-06-07T11:28:49Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)
#### Post date: [June 7, 2017, 11:28am UTC](https://discuss.elastic.co/t/using-samaccountname-instead-of-cn-in-role-mapping-file/88563/1 "2017-06-07T11:28:49Z")
Hello.
I would like to ask question for role\_mapping file. Our environment uses [LDAP authentication module](https://www.elastic.co/guide/en/x-pack/current/ldap-realm.html)
First I understand that you will need to map distinguished name (_User_ or _Group_ object ) to kibana roles.
[https://www.elastic.co/guide/en/x-pack/current/mapping-roles.html](https://www.elastic.co/guide/en/x-pack/current/mapping-roles.html)
However, I have two obstacles for role mapping.
1. **Group object** mapping is not an option because group name includes Japanese characters (multibyte)
2. We are reluctant to use **User object** mapping because CN (User name) includes department ID which may change quite often
Therefore, since **sAMAccountName** remains solid , I would like to map kibana role to sAMAccountName.
Is this possible?
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [June 9, 2017, 6:39am UTC](https://discuss.elastic.co/t/using-samaccountname-instead-of-cn-in-role-mapping-file/88563/2 "2017-06-09T06:39:00Z")
> [@](#):
>
> I would like to map kibana role to sAMAccountName.
This is not possible in current releases, but improvements to role mapping are a priority for us, and we hope to be offer a better solution in the near future.
> [@](#):
>
> Group object mapping is not an option because group name includes Japanese characters (multibyte)
This is not intentional - you ought to be able to define role mappings for multibyte characters, if it doesn't work then that's a bug/oversight.
I'll have a look internally, but it would be helpful if you could file a support case and provide a clear reproduction of the problem.
---
### Author:  [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)
#### Post date: [June 9, 2017, 9:55am UTC](https://discuss.elastic.co/t/using-samaccountname-instead-of-cn-in-role-mapping-file/88563/3 "2017-06-09T09:55:01Z")
@TimV
> [@TimV](#):
>
> This is not possible in current releases, but improvements to role mapping are a priority for us, and we hope to be offer a better solution in the near future.
I will look forward it. Our customer's case looks like quite unique. So I appreciate role mapping becomes more flexible (e.g be able to use other object items like sAMAccountName)
> [@TimV](#):
>
> This is not intentional - you ought to be able to define role mappings for multibyte characters, if it doesn't work then that's a bug/oversight.
>
> I'll have a look internally, but it would be helpful if you could file a support case and provide a clear reproduction of the problem.
Cool. I will reproduce the problem and file a support case.
---
### Author:  [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)
#### Post date: [June 10, 2017, 2:07pm UTC](https://discuss.elastic.co/t/using-samaccountname-instead-of-cn-in-role-mapping-file/88563/4 "2017-06-10T14:07:56Z")
@TimV
Sorry I was totally misunderstanding. I was able to map the _multibyte group name_ to _alphabet role name_.
Here is what I have found.
## Mapping multibyte group name to multibyte role name does not work
This is because elasticsearch cannot store _multibyte role name_.
```
[root@rhel2 ~]# curl -XPUT -u elastic:changeme localhost:9200/_xpack/security/role/情報システム -d '
> {
> "run_as" : ["superuser"]
> }'
{"error":{"root_cause":[{"type":"validation_exception","reason":"Validation Failed: 1: A valid role name must be at least 1 character and no longer than 30 characters. It must begin with a letter (`a-z` or `A-Z`) or an underscore (`_`). Subsequent characters can be letters, underscores (`_`), digits (`0-9`) or any of the following symbols `@`, `-`, `.` or `$`;"}],"type":"validation_exception","reason":"Validation Failed: 1: A valid role name must be at least 1 character and no longer than 30 characters. It must begin with a letter (`a-z` or `A-Z`) or an underscore (`_`). Subsequent characters can be letters, underscores (`_`), digits (`0-9`) or any of the following symbols `@`, `-`, `.` or `$`;"},"status":400}[root@rhel2 ~]#
```
## Mapping multibyte group name to alphabet role name works
This is how I done.
1 Assing multibyte security group name to a user on Active Directory side. Make sure the group is not set to _Primary Group_
2 ldap search returns awkward result but this is okay
> dn:: Q0495rih6L66IOijlSxDTj1Vc2VycyxEQz1leGFtcGxlLERDPWNvbQ==
> objectClass: top
> objectClass: person
> objectClass: organizationalPerson
> objectClass: user
> ...
> memberOf:: **Q0495oOF5aCx44K344K544OG44OgLENOPVVzZXJzLERDPWV4YW1wbGUsREM9Y29t**
> memberOf: CN=Remote Desktop Users,CN=Builtin,DC=example,DC=com
> ...
> sAMAccountName: y-watanabe
3 elasticsearch.yml
> ldap1:
> type: ldap
> order: 0
> url: ldap://ad:389
> bind\_dn: "cn=creationline,cn=Users,dc=example,dc=com"
> bind\_password: YuTennis123!
> user\_search:
> base\_dn: cn=Users,dc=example,dc=com
> scope: sub\_tree
> attribute: sAMAccountName
> group\_search:
> base\_dn: cn=Users,dc=example,dc=com
> files:
> role\_mapping: "/opt/elasticsearch/elasticsearch-5.4.0/config/x-pack/role\_mapping.yml"
> unmapped\_groups\_as\_roles: false
> follow\_referrals: false
4 role\_mapping.yml
> superuser:
>
> - "cn=情報システム,cn=Users,dc=example,dc=com"
5 elasticsearch log . **CN** for _group name_ was empty but it worked.
```
[2017-06-10T22:54:30,318][DEBUG][o.e.x.s.a.e.ReservedRealm] [Y_0s9_g] user [y-watanabe] not found in cache for realm [reserved], proceeding with normal authentication
[2017-06-10T22:54:30,318][DEBUG][o.e.x.s.a.l.LdapRealm] [Y_0s9_g] user [y-watanabe] not found in cache for realm [ldap1], proceeding with normal authentication
...
[2017-06-10T22:54:35,639][DEBUG][o.e.i.f.p.ParentChildIndexFieldData] [Y_0s9_g] [.security_audit_log-2017.06.10] global-ordinals [_parent] took [5micros]
[2017-06-10T22:54:36,660][DEBUG][o.e.x.s.a.s.DnRoleMapper] [Y_0s9_g] the roles [[superuser]], are mapped from these [ldap] groups [[CN=,CN=Users,DC=example,DC=com]] for realm [ldap/ldap1]
```
6 Kibana login success
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [July 7, 2017, 2:27am UTC](https://discuss.elastic.co/t/using-samaccountname-instead-of-cn-in-role-mapping-file/88563/5 "2017-07-07T02:27:13Z")
> [@YuWatanabe](#):
>
> I will look forward it. Our customer's case looks like quite unique. So I appreciate role mapping becomes more flexible (e.g be able to use other object items like sAMAccountName)
X-Pack 5.5 was released today and contains a new role-mapping API that is more powerful than the old role mapping files.
The [Mapping Users and Groups to Roles](https://www.elastic.co/guide/en/x-pack/current/mapping-roles.html) documentation has been updated.
---
### Author:  [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)
#### Post date: [July 21, 2017, 6:56am UTC](https://discuss.elastic.co/t/using-samaccountname-instead-of-cn-in-role-mapping-file/88563/6 "2017-07-21T06:56:22Z")
@TimV
Thanks for the update . I will check it out.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 18, 2017, 6:56am UTC](https://discuss.elastic.co/t/using-samaccountname-instead-of-cn-in-role-mapping-file/88563/7 "2017-08-18T06:56:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.