Hello all & @Mantas,
I am not able to map the ldap group to admin roles. Able to login to the opensearch dashboard with ldap group but not the opensearch getting error.
{
"error": {
"root_cause": [
{
"type": "security_exception",
"reason": "no permissions for [cluster:monitor/main] and User [name=p3087732adm, backend_roles=[null], requestedTenant=null]"
}
],
"type": "security_exception",
"reason": "no permissions for [cluster:monitor/main] and User [name=p3087732adm, backend_roles=[null], requestedTenant=null]"
},
"status": 403
}
My config file.
---
_meta:
type: "config"
config_version: 2
config:
dynamic:
authc:
ldap:
description: "Authenticate via LDAP or Active Directory"
http_enabled: true
transport_enabled: true
order: 5
http_authenticator:
type: basic
challenge: false
authentication_backend:
type: ldap
config:
enable_ssl: false
enable_start_tls: false
enable_ssl_client_auth: false
verify_hostnames: true
hosts:
- vm0uwvdsxxa0001.corp.chartercom.com
bind_dn: cn=svc-vds-specenteradd,ou=users,ou=serviceaccts,ou=security,dc=corp,dc=chartercom,dc=com
password: XXXXXXX
userbase: 'ou=users,ou=authentication,ou=security,dc=corp,dc=chartercom,dc=com'
usersearch: '(sAMAccountName={0})'
username_attribute: uid
authz:
roles_from_myldap:
description: "Authorize via LDAP or Active Directory"
http_enabled: true
transport_enabled: true
authorization_backend:
type: ldap
config:
enable_ssl: false
enable_start_tls: false
enable_ssl_client_auth: false
verify_hostnames: true
hosts:
- vm0uwvdsxxa0001.corp.chartercom.com
bind_dn: cn=svc-vds-specenteradd,ou=users,ou=serviceaccts,ou=security,dc=corp,dc=chartercom,dc=com
password: 5hm8tCE5UVSJrFFw
rolebase: ou=users,ou=authentication,ou=security,dc=corp,dc=chartercom,dc=com
rolesearch: '(sAMAccountName={0})'
userroleattribute: roles
userrolename: memberOf
rolename: cn
resolve_nested_roles: false
userbase: ou=users,ou=authentication,ou=security,dc=corp,dc=chartercom,dc=com
usersearch: '(sAMAccountName={0})'
curl --insecure -u admin:XXXXX -XGET https://vm0unelkdla0001.corp.chartercom.com:9200/_plugins/_security/api/securityconfig?pretty
{
"config" : {
"dynamic" : {
"filtered_alias_mode" : "warn",
"disable_rest_auth" : false,
"disable_intertransport_auth" : false,
"respect_request_indices_options" : false,
"kibana" : {
"multitenancy_enabled" : true,
"private_tenant_enabled" : true,
"default_tenant" : "",
"server_username" : "kibanaserver",
"index" : ".kibana"
},
"http" : {
"anonymous_auth_enabled" : false,
"xff" : {
"enabled" : false,
"internalProxies" : "192\\.168\\.0\\.10|192\\.168\\.0\\.11",
"remoteIpHeader" : "X-Forwarded-For"
}
},
"authc" : {
"jwt_auth_domain" : {
"http_enabled" : false,
"order" : 0,
"http_authenticator" : {
"challenge" : false,
"type" : "jwt",
"config" : {
"signing_key" : "base64 encoded HMAC key or public RSA/ECDSA pem key",
"jwt_header" : "Authorization",
"jwt_clock_skew_tolerance_seconds" : 30
}
},
"authentication_backend" : {
"type" : "noop",
"config" : { }
},
"description" : "Authenticate via Json Web Token"
},
"ldap" : {
"http_enabled" : true,
"order" : 5,
"http_authenticator" : {
"challenge" : false,
"type" : "basic",
"config" : { }
},
"authentication_backend" : {
"type" : "ldap",
"config" : {
"enable_ssl" : false,
"enable_start_tls" : false,
"enable_ssl_client_auth" : false,
"verify_hostnames" : true,
"hosts" : [
"vm0uwvdsxxa0001.corp.chartercom.com"
],
"bind_dn" : "cn=svc-vds-specenteradd,ou=users,ou=serviceaccts,ou=security,dc=corp,dc=chartercom,dc=com",
"password" : "******",
"userbase" : "ou=users,ou=authentication,ou=security,dc=corp,dc=chartercom,dc=com",
"usersearch" : "(sAMAccountName={0})",
"username_attribute" : "uid"
}
},
"description" : "Authenticate via LDAP or Active Directory"
},
"basic_internal_auth_domain" : {
"http_enabled" : true,
"order" : 4,
"http_authenticator" : {
"challenge" : true,
"type" : "basic",
"config" : { }
},
"authentication_backend" : {
"type" : "intern",
"config" : { }
},
"description" : "Authenticate via HTTP Basic against internal users database"
},
"proxy_auth_domain" : {
"http_enabled" : false,
"order" : 3,
"http_authenticator" : {
"challenge" : false,
"type" : "proxy",
"config" : {
"user_header" : "x-proxy-user",
"roles_header" : "x-proxy-roles"
}
},
"authentication_backend" : {
"type" : "noop",
"config" : { }
},
"description" : "Authenticate via proxy"
},
"clientcert_auth_domain" : {
"http_enabled" : false,
"order" : 2,
"http_authenticator" : {
"challenge" : false,
"type" : "clientcert",
"config" : {
"username_attribute" : "cn"
}
},
"authentication_backend" : {
"type" : "noop",
"config" : { }
},
"description" : "Authenticate via SSL client certificates"
},
"kerberos_auth_domain" : {
"http_enabled" : false,
"order" : 6,
"http_authenticator" : {
"challenge" : true,
"type" : "kerberos",
"config" : {
"krb_debug" : false,
"strip_realm_from_principal" : true
}
},
"authentication_backend" : {
"type" : "noop",
"config" : { }
}
}
},
"authz" : {
"roles_from_another_ldap" : {
"http_enabled" : false,
"authorization_backend" : {
"type" : "ldap",
"config" : { }
},
"description" : "Authorize via another Active Directory"
},
"roles_from_myldap" : {
"http_enabled" : true,
"authorization_backend" : {
"type" : "ldap",
"config" : {
"enable_ssl" : false,
"enable_start_tls" : false,
"enable_ssl_client_auth" : false,
"verify_hostnames" : true,
"hosts" : [
"vm0uwvdsxxa0001.corp.chartercom.com"
],
"bind_dn" : "cn=svc-vds-specenteradd,ou=users,ou=serviceaccts,ou=security,dc=corp,dc=chartercom,dc=com",
"password" : "******",
"rolebase" : "ou=users,ou=authentication,ou=security,dc=corp,dc=chartercom,dc=com",
"rolesearch" : "(sAMAccountName={0})",
"userroleattribute" : "roles",
"userrolename" : "memberOf",
"rolename" : "cn",
"resolve_nested_roles" : false,
"userbase" : "ou=users,ou=authentication,ou=security,dc=corp,dc=chartercom,dc=com",
"usersearch" : "(sAMAccountName={0})"
}
},
"description" : "Authorize via LDAP or Active Directory"
}
},
"auth_failure_listeners" : { },
"do_not_fail_on_forbidden" : false,
"multi_rolespan_enabled" : true,
"hosts_resolver_mode" : "ip-only",
"do_not_fail_on_forbidden_empty" : false,
"on_behalf_of" : {
"enabled" : false
}
}
}
}
curl --insecure -u p3087732adm:XXXXXXX -XGET https://vm0unelkdla0001.corp.chartercom.com:9200/_plugins/_security/authinfo?pretty
{
"user" : "User [name=p3087732adm, backend_roles=[null], requestedTenant=null]",
"user_name" : "p3087732adm",
"user_requested_tenant" : null,
"remote_address" : "22.242.73.84:54320",
"backend_roles" : [
null
],
"custom_attribute_names" : [
"attr.ldap.unixHomeDirectory",
"attr.ldap.cacheModifiersName",
"attr.ldap.objectGUID",
"attr.ldap.userAccountControl",
"ldap.original.username",
"attr.ldap.prismuser",
"attr.ldap.cacheCreatorsName",
"attr.ldap.employeeType",
"attr.ldap.sAMAccountName",
"attr.ldap.uid",
"attr.ldap.givenName",
"ldap.dn",
"attr.ldap.cn",
"attr.ldap.cacheModifyTimestamp",
"attr.ldap.description",
"attr.ldap.gidNumber",
"attr.ldap.name",
"attr.ldap.cacheCreateTimestamp",
"attr.ldap.uidNumber",
"attr.ldap.displayName",
"attr.ldap.objectSid",
"attr.ldap.sn",
"attr.ldap.cnmemberof",
"attr.ldap.objectclass",
"attr.ldap.uuid",
"attr.ldap.loginShell"
],
"roles" : [
"a_role",
"own_index"
],
"tenants" : {
"p3087732adm" : true
},
"principal" : null,
"peer_certificates" : "0",
"sso_logout_url" : null
}
Roles_mapping.yml
---
# In this file users, backendroles and hosts can be mapped to Security roles.
# Permissions for OpenSearch roles are configured in roles.yml
_meta:
type: "rolesmapping"
config_version: 2
# Define your roles mapping here
## Demo roles mapping
all_access:
reserved: false
backend_roles:
- "admin"
- "UX-RG-ElasticTeam"
- "CN=UX-RG-ElasticTeam,OU=Role,OU=Unix,OU=Groups,OU=SPECTRUM,DC=CORP,DC=CHARTERCOM,DC=com"
description: "Maps admin to all_access"
UX-RG-ElasticTeam:
backend_roles:
- "admin"
description: "Maps custom access"
own_index:
reserved: false
users:
- "*"
backend_roles:
- "kibanauser"
- "UX-RG-ElasticTeam"
- "CN=UX-RG-ElasticTeam,OU=Role,OU=Unix,OU=Groups,OU=SPECTRUM,DC=CORP,DC=CHARTERCOM,DC=com"
description: "Allow full access to an index named like the username"
logstash:
reserved: false
backend_roles:
- "logstash"
kibana_user:
reserved: false
backend_roles:
- "kibanauser"
description: "Maps kibanauser to kibana_user"
readall:
reserved: false
backend_roles:
- "readall"
manage_snapshots:
reserved: false
backend_roles:
- "snapshotrestore"
kibana_server:
reserved: true
users:
- "kibanaserver"
a_role:
reserved: false
users:
- "p3087732adm"
backend_roles:
- "kibanauser"
- "UX-RG-ElasticTeam"
- "CN=UX-RG-ElasticTeam,OU=Role,OU=Unix,OU=Groups,OU=SPECTRUM,DC=CORP,DC=CHARTERCOM,DC=com"