# LDAP add user to group does not change backend\_roles

**URL:** <https://forum.opensearch.org/t/ldap-add-user-to-group-does-not-change-backend-roles/2911>\
**Category:** Security\
**Created:** [May 27, 2020, 9:49am UTC](https://forum.opensearch.org/t/ldap-add-user-to-group-does-not-change-backend-roles/2911 "2020-05-27T09:49:44Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![haibt](https://avatars.discourse-cdn.com/v4/letter/h/a587f6/32.png) [@haibt](https://forum.opensearch.org/u/haibt)\
**Post date:** [May 27, 2020, 9:49am UTC](https://forum.opensearch.org/t/ldap-add-user-to-group-does-not-change-backend-roles/2911/1 "2020-05-27T09:49:44Z")

</div>

Hi,  
I configured LDAP authentication and everythings work fine.  
But after first time autentication,i add user to another group and infomation about role\_backends of user dont change.

Example:  
I create user esuser5 and check authinfo :  
curl --insecure https://\*\*\*\*\*\*\*\*\*\*:9200/\_opendistro/\_security/authinfo?pretty -u esuser5  
Enter host password for user ‘esuser5’:  
{  
“user” : “User [name=esuser5, backend\_roles=[ipausers], requestedTenant=null]”,  
“user\_name” : “esuser5”,  
“user\_requested\_tenant” : null,  
“remote\_address” : “\*\*\*\*\*\*\*\*\*\*\*\*\*\*”,  
“backend\_roles” : [  
“ipausers”  
],  
“custom\_attribute\_names” : [  
“ldap.dn”,  
“[attr.ldap.cn](http://attr.ldap.cn)”,  
“attr.ldap.gidNumber”,  
“attr.ldap.krbCanonicalName”,  
“attr.ldap.initials”,  
“attr.ldap.createTimestamp”,  
“attr.ldap.modifyTimestamp”,  
“ldap.original.username”,  
“attr.ldap.uidNumber”,  
“attr.ldap.gecos”,  
“attr.ldap.displayName”,  
“attr.ldap.ipaUniqueID”,  
“attr.ldap.sn”,  
“attr.ldap.krbPrincipalName”,  
“attr.ldap.entryusn”,  
“attr.ldap.homeDirectory”,  
“attr.ldap.krbLastPwdChange”,  
“attr.ldap.loginShell”,  
“attr.ldap.objectClass”,  
“attr.ldap.parentid”,  
“attr.ldap.uid”,  
“attr.ldap.mail”,  
“attr.ldap.givenName”  
],  
“roles” : [  
“own\_index”  
],  
“tenants” : {  
“esuser5” : true  
},  
“principal” : null,  
“peer\_certificates” : “0”,  
“sso\_logout\_url” : null  
}

After that,i add esuser5 to group admins and check authinfo again and get same result.  
backend\_roles still ipausers,no admins.

Any idea ?

---

<div class="post-metadata">

**Author:** ![Anthony](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/anthony/32/9939_2.png) [@Anthony](https://forum.opensearch.org/u/Anthony)\
**Post date:** [April 26, 2021, 2:15pm UTC](https://forum.opensearch.org/t/ldap-add-user-to-group-does-not-change-backend-roles/2911/2 "2021-04-26T14:15:28Z")

</div>

@haibt Did you manage to get this working?

If not, did you try to run ldapsearch to see if the new role is provided from ldap?