Versions (relevant - OpenSearch/Dashboard/Server OS/Browser): 3.6.0 / RHEL 9.7 / Chrome Describe the issue: We recently built a opensearch cluster for our test environment and we have configured our ADOM group as backend role mapping to all_access role in the cluster. I was able to login to the clu…

@Santhosh.Gollapudi Could you share output of the following command. Please hide all sensitive data. curl --insecure -u admin:<password> "https://localhost:9200/_plugins/_security/api/securityconfig?pretty"

Hello @pablo , { "config": { "dynamic": { "filtered_alias_mode": "warn", "disable_rest_auth": false, "disable_intertransport_auth": false, "respect_request_indices_options": false, "kibana": { "multitenancy_enabled": true, "private_tenant_enabled"…

@Santhosh.Gollapudi Thank you for sharing the configuration. Is your username unique for each domain? Please be aware that if you use the same username in more than one domain, the first match will be used by the security plugin. If this is a test environment, can you test your authentication/autho…

I have the same username in VDSI and ADEBP domains and I was able to login with the same configuration until last week. However, I added my id into both of these ADOM groups with all_access role and I am still getting the Missing Role error.

@Santhosh.Gollapudi At this point, you don’t know which domain authenticated your user. Since this is a test cluster, you could try to leave only one domain and check which one is failing. Alternatively, you could create a unique user in each domain and see if you get roles from each domain.

I will try this. But, I have another user with read only access to opensearch dashboards. He has only one domain for his id and he was able to login earlier but not now.

@Santhosh.Gollapudi Which domain out of the shared ones is your read-only user in? Do you see any errors in OpenSearch logs when that user logs in?

Hello, he is part of VDSI domain. It is just showing backend_roles empty: {“type”:“log”,“@timestamp”:“2026-05-05T13:46:56Z”,“tags”:[“error”,“opensearch”,“data”],“pid”:2785473,“message”:“[security_exception]: no permissions for [indices:data/write/bulk] and User [name=V658321, backend_roles=, reques…

@Santhosh.Gollapudi I’ve checked and tested your configuration. The only unknown factor for me is the binding user. Can the binding user SVC-CSG-ELK-LDAP@adebp.vzwcorp.com search for groups in the rolebase DN OU=Groups,DC=adebp,DC=vzwcorp,DC=com Could you test with the ldapsearch tool? env LDAPTLS…

Hello Pablo, This has been resolved after adding the filters in the role search as per the thread below: [image] Opensearch Tenants vs Workspaces OpenSearch Dashboards We have a workaround to make sure that a user from tenant1 is not able to see a monitor cre…

Getting Missing role error for AD user with all_access role

Security

Santhosh.Gollapudi May 16, 2026, 3:24pm 11

Hello Pablo,

This has been resolved after adding the filters in the role search as per the thread below:

Topic		Replies	Views
Map LDAP Users to Admin Role Security	13	2602	May 29, 2024
Roles from roles_mapping are ignored Security	8	226	August 27, 2024
Can't map ldap group to admin roles Security	9	373	June 5, 2024
Debugging LDAP authorization configuration Security	12	1247	December 13, 2023
Opensearch dashboards logging screen on the browser throwing "missing role" error Security	8	640	May 5, 2026

Getting Missing role error for AD user with all_access role

Related topics