# X-pack and Active directory integration **URL:** \ **Category:** Elasticsearch\ **Created:** [March 1, 2017, 11:58pm UTC](https://discuss.elastic.co/t/x-pack-and-active-directory-integration/77066 "2017-03-01T23:58:09Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![adityajain19](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adityajain19/32/23171_2.png) [@adityajain19](https://discuss.elastic.co/u/adityajain19)\ **Post date:** [March 1, 2017, 11:58pm UTC](https://discuss.elastic.co/t/x-pack-and-active-directory-integration/77066/1 "2017-03-01T23:58:09Z")
We are trying to integrate Elasticsearch and Kibana with Active directory for authentication. we are able to see connectivity btw elasticsearch and AD. we are trying to se roles.yml as # The default roles file is empty as the preferred method of defining roles is # through the API/UI. File based roles are useful in error scenarios when the # API based roles may not be available. # All cluster rights # All operations on all indices admin: cluster: all indices: '\*': all # Monitoring cluster privileges # All operations on all indices power\_user: cluster: monitor indices: '\*': all # Only read operations on indices user: indices: '\*': read # Only read operations on indices named events\_\* events\_user: indices: 'events\_\*': read and role\_mapping.yml as # Role mapping configuration file which has elasticsearch roles as keys # that map to one or more user or group distinguished names #roleA: this is an elasticsearch role # - groupA-DN this is a group distinguished name # - groupB-DN # - user1-DN this is the full user distinguished name power\_user: - "cn=user,cn=people,dc=company,dc=com" superuser: # - "cn=users,dc=example,dc=com" # - "cn=admins,dc=example,dc=com" - "cn=user,cn=people,dc=company,dc=com" we need to control authentication using AD and manage Roles in Elastic. any help is appreciated. in elastic\*.yml we have given xpack: security: authc: realms: active\_directory: type: active\_directory order: 0 domain\_name: [company.com](http://company.com) url: ldap://company.com:389 unmapped\_groups\_as\_roles: true ---
**Author:** ![Sherry\_Ger](https://avatars.discourse-cdn.com/v4/letter/s/bc79bd/32.png) [@Sherry\_Ger](https://discuss.elastic.co/u/Sherry_Ger)\ **Post date:** [March 2, 2017, 12:52am UTC](https://discuss.elastic.co/t/x-pack-and-active-directory-integration/77066/2 "2017-03-02T00:52:17Z")
Hi Aditya, You can definitely define roles in roles.yml file (file realm) or through the API (Native realm). You can map the roles via the role\_mapping.yml. I am a bit unclear as what issues you are facing. Are you saying you would like to manage file based roles via the UI? Regards Sherry ---
**Author:** ![adityajain19](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adityajain19/32/23171_2.png) [@adityajain19](https://discuss.elastic.co/u/adityajain19)\ **Post date:** [March 2, 2017, 1:14am UTC](https://discuss.elastic.co/t/x-pack-and-active-directory-integration/77066/3 "2017-03-02T01:14:01Z")
Hi Sherry, I want to set up authorization and authentication using active dir I did some config but I am not able to use it properly when I go to localhost:9200 I do get prompt for user is and password and if I give wrong password it does not go further but when I give correct password I get 403. I need to setup user and there role using AD. Regards Aditya ---
**Author:** ![adityajain19](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adityajain19/32/23171_2.png) [@adityajain19](https://discuss.elastic.co/u/adityajain19)\ **Post date:** [March 2, 2017, 1:36am UTC](https://discuss.elastic.co/t/x-pack-and-active-directory-integration/77066/4 "2017-03-02T01:36:45Z")
@Sherry_Ger i have X-pack installed. Regards Aditya ---
**Author:** ![adityajain19](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adityajain19/32/23171_2.png) [@adityajain19](https://discuss.elastic.co/u/adityajain19)\ **Post date:** [March 2, 2017, 1:44am UTC](https://discuss.elastic.co/t/x-pack-and-active-directory-integration/77066/5 "2017-03-02T01:44:37Z")
I get {"error":{"root\_cause":[{"type":"security\_exception","reason":"action [cluster:monitor/main] is unauthorized for user [90008322]"}],"type":"security\_exception","reason":"action [cluster:monitor/main] is unauthorized for user [90008322]"},"status":403} when accessing local:9200 even though i added like this in my role mapping yml # Role mapping configuration file which has elasticsearch roles as keys # that map to one or more user or group distinguished names #roleA: this is an elasticsearch role # - groupA-DN this is a group distinguished name # - groupB-DN # - user1-DN this is the full user distinguished name power\_user: - "uid=user,cn=user,ou=people,dc=company,dc=com" superuser: # - "cn=users,dc=example,dc=com" # - "cn=admins,dc=example,dc=com" - "uid=user,cn=user,ou=people,dc=company,dc=com" ---
**Author:** ![adityajain19](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adityajain19/32/23171_2.png) [@adityajain19](https://discuss.elastic.co/u/adityajain19)\ **Post date:** [March 2, 2017, 2:38am UTC](https://discuss.elastic.co/t/x-pack-and-active-directory-integration/77066/6 "2017-03-02T02:38:29Z")
I found the issue i was giving wrong CN in DN. Thanks everyone ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 30, 2017, 2:38am UTC](https://discuss.elastic.co/t/x-pack-and-active-directory-integration/77066/7 "2017-03-30T02:38:46Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.