# Create users using API - unable to attach Roles while create **URL:** \ **Category:** Security\ **Created:** [August 24, 2021, 8:45pm UTC](https://forum.opensearch.org/t/create-users-using-api-unable-to-attach-roles-while-create/6848 "2021-08-24T20:45:44Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![psripathi](https://avatars.discourse-cdn.com/v4/letter/p/ce73a5/32.png) [@psripathi](https://forum.opensearch.org/u/psripathi)\ **Post date:** [August 24, 2021, 8:45pm UTC](https://forum.opensearch.org/t/create-users-using-api-unable-to-attach-roles-while-create/6848/1 "2021-08-24T20:45:45Z")
Hello, I am back with another question! šŸ™‚ I am trying to create an internal user in Kibana with FGAC, through OpenDistro API. I was able to create a user! Great! But I got two concerns with that - 1. The users that Iā€™ve created are visible in the `internal-users` section, but not able to filter by them in the Roles section. ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/1/10c1c61e8ed504bc8ce04097dccd7fff14a900a8.png) ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/d/d3d7e781b66134d6a088eac407edff1aa9dbc4fd.png) 2. I am wondering if above point-1 is happening because, I did not map the Roles properly to the user Iā€™ve created using this [api call](https://opendistro.github.io/for-elasticsearch-docs/old/0.9.0/docs/security/api/#create-user) - > `PUT _opendistro/_security/api/internalusers/` The documentation says you can pass the Roles using the parameter/attribute ā€˜rolesā€™ [https://opendistro.github.io/for-elasticsearch-docs/old/0.9.0/docs/security/api/#create-user](https://opendistro.github.io/for-elasticsearch-docs/old/0.9.0/docs/security/api/#create-user) But when I do that, I get a 400 error, the ā€˜docā€™ prefix roles are not pre-defined ones - `Request:` ```auto PUT _opendistro/_security/api/internalusers/new-user-1 { "password": "some1@pass", "roles": ["readall_and_monitor", "doc_alerting_access", "doc_tenants"] } ``` `Response:` ```auto { "status_code": 400, "response": { "status": "error", "reason": "Invalid configuration", "invalid_keys": { "keys": "roles" } } } ``` Can someone please help me understand what am I doing wrong, and help me fix this. _ **Update:** _ If I try to login with the newly created user - ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/4/4a6d1dc5d08f159c8105f2b0126d3749bdccb0f6.png) Best Prashanth Sripathi ---
**Author:** ![Anthony](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/anthony/32/9939_2.png) [@Anthony](https://forum.opensearch.org/u/Anthony)\ **Post date:** [August 25, 2021, 7:36am UTC](https://forum.opensearch.org/t/create-users-using-api-unable-to-attach-roles-while-create/6848/2 "2021-08-25T07:36:45Z")
@psripathi which version of odfe are you using? Can you change the ā€œrolesā€ to ā€œopendistro\_security\_rolesā€ and make sure the roles listed already exist in the security configuration. Hope this helps ---
**Author:** ![psripathi](https://avatars.discourse-cdn.com/v4/letter/p/ce73a5/32.png) [@psripathi](https://forum.opensearch.org/u/psripathi)\ **Post date:** [August 25, 2021, 9:27pm UTC](https://forum.opensearch.org/t/create-users-using-api-unable-to-attach-roles-while-create/6848/3 "2021-08-25T21:27:05Z")
@Anthony Our Kibana sits on top of AWS Elasticsearch service. I am not exactly sure on the ODFE version. But running Kibana 7.10 But I followed your suggestion, and was able to create a user with ā€˜opendistro\_security\_rolesā€™ (Should the API document reflect this change?) - ```auto { "status_code": 201, "response": { "status": "CREATED", "message": "'new-user-1' created." } ``` And, the weird part is that, I couldnā€™t see the user in the Roles section under ā€˜Internal usersā€™ column. ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/8/81ceed696c039dc6e185e8e5dd4ce506dbbf84b9.png) But interestingly was able to login with the created test user and has all the access I assigned while making the api call. Is that a bug in the UI? Because, from the front-end I wont be able to check what roles the user is assigned with during an audit or something. Best Prashanth Sripathi ---
**Author:** ![Anthony](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/anthony/32/9939_2.png) [@Anthony](https://forum.opensearch.org/u/Anthony)\ **Post date:** [August 26, 2021, 7:28am UTC](https://forum.opensearch.org/t/create-users-using-api-unable-to-attach-roles-while-create/6848/4 "2021-08-26T07:28:30Z")
@psripathi glad you got it working, regarding a bug, yes, it would appear to be a bug, however I can confirm that UI reflects the new user using odfe, therefore the issue is with AWS ES service offering and I would recommend raising a AWS support ticket as this forum is for odfe and opensearch. Regarding the documentation, I think its already updated, see docs [here](https://opendistro.github.io/for-elasticsearch-docs/docs/security/access-control/api/#create-user) Hope this helps ---
**Author:** ![psripathi](https://avatars.discourse-cdn.com/v4/letter/p/ce73a5/32.png) [@psripathi](https://forum.opensearch.org/u/psripathi)\ **Post date:** [August 26, 2021, 2:34pm UTC](https://forum.opensearch.org/t/create-users-using-api-unable-to-attach-roles-while-create/6848/5 "2021-08-26T14:34:04Z")
@Anthony Yep, thank you for checking this for me, looking back at the documentation link I referenced, it seems to be an old version of ODFE. JFYI, this issue I am seeing with user mapping in UI is only for users created through api call, if I create a user from the front-end directly, this doesnā€™t seem to occur. I am assuming we are on the same page here. So I will check with AWS support why this issue is occurring. I will try and update this post when I receive an update. Thank you again!