# LDAP Authz for Group Membership

**URL:** <https://forum.opensearch.org/t/ldap-authz-for-group-membership/8128>\
**Category:** Security\
**Created:** [December 24, 2021, 5:44pm UTC](https://forum.opensearch.org/t/ldap-authz-for-group-membership/8128 "2021-12-24T17:44:58Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jecanne](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/jecanne/32/2586_2.png) [@jecanne](https://forum.opensearch.org/u/jecanne)\
**Post date:** [December 24, 2021, 5:44pm UTC](https://forum.opensearch.org/t/ldap-authz-for-group-membership/8128/1 "2021-12-24T17:44:58Z")

</div>

Hi again community! Hope everyone is doing well during the holidays.

I appreciate all the help I’ve had thus far in this forum. Hoping you all might be able to help me out one more time.

**Goal** : Map security role to users in an Active Directory Group.

The DN for this group is:

```auto
cn=Dev-Users,ou=SRS,ou=AppManaged,ou=Groups,ou=IDM,dc=home,dc=test,dc=com

```

My username (`jcannel`) is a member of this roup. I honestly find the settings here a bit overwhelming. Rather than spend countless hours with trial and error, I was hoping I might get advice from someone who has done this before.

Here is a (truncated and redacted) `securityconfig/config.yml` file I’m using:

```auto
config:
  dynamic:
    ...
    ...
    authc:
      ...
      ...
      ldap:
        description: "Authenticate via LDAP or Active Directory"
        http_enabled: true
        transport_enabled: true
        order: 1
        http_authenticator:
          type: basic
          challenge: false
        authentication_backend:
          type: ldap
          config:
            enable_ssl: true
            enable_start_tls: false
            enable_ssl_client_auth: false
            verify_hostnames: true
            hosts:
              - <redacted>
            bind_dn: <redacted>
            password: <redacted>
            userbase: 'dc=home,dc=test,dc=com'
            usersearch: '(sAMAccountName={0})'
            username_attribute: sAMAccountName
            pemtrustedcas_filepath: /usr/share/opensearch/config/ca-certs.pem
    authz:
      ldap:
        description: "Authorize via LDAP or Active Directory"
        http_enabled: true
        transport_enabled: true
        authorization_backend:
          type: ldap
          config:
            enable_ssl: true
            enable_start_tls: false
            enable_ssl_client_auth: false
            verify_hostnames: true
            hosts:
              - <redacted>
            bind_dn: <redacted>
            password: <redacted>
            rolebase: 'dc=home,dc=test,dc=com'
            rolesearch: '(member={0})'
            userroleattribute: null
            userrolename: disabled
            rolename: cn
            resolve_nested_roles: true
            userbase: 'dc=home,dc=test,dc=com'
            usersearch: '(sAMAccountName={0})'
            username_attribute: sAMAccountName
            skip_users:
              - admin
              - dashboards

```

It seems I have this working with authenticating a user, but can’t seem to figure out authz. When I authenticate with my user `jcannel` I get:

```auto
{
  "error": {
    "root_cause": [
      {
        "type": "security_exception",
        "reason": "no permissions for [cluster:monitor/main] and User [name=jcannel, backend_roles=[], requestedTenant=null]"
      }
    ],
    "type": "security_exception",
    "reason": "no permissions for [cluster:monitor/main] and User [name=jcannel, backend_roles=[], requestedTenant=null]"
  },
  "status": 403
}

```

Would love to have input from someone with more experience on this.

---

<div class="post-metadata">

**Author:** ![jecanne](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/jecanne/32/2586_2.png) [@jecanne](https://forum.opensearch.org/u/jecanne)\
**Post date:** [December 26, 2021, 4:38am UTC](https://forum.opensearch.org/t/ldap-authz-for-group-membership/8128/2 "2021-12-26T04:38:14Z")

</div>

Never mind on this. I figured it out.

Great resource here:

> **[LDAP Integration for Open Distro for Elasticsearch | Amazon Web Services](https://aws.amazon.com/blogs/opensource/ldap-integration-for-open-distro-for-elasticsearch/)**
>
> 中文版 – Open Distro for Elasticsearch’s security plugin comes with authentication and access control out of the box. In prior posts we showed how you can change your admin password in Open Distro for Elasticsearch and how you can add your own SSL...

Wish that was part of the documentation, it provides a nice clean example.