# LDAP backend roles (Authz) not working

**URL:** <https://forum.opensearch.org/t/ldap-backend-roles-authz-not-working/13982>\
**Category:** Security\
**Tags:** troubleshoot\
**Created:** [April 18, 2023, 6:58am UTC](https://forum.opensearch.org/t/ldap-backend-roles-authz-not-working/13982 "2023-04-18T06:58:55Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![denkar](https://avatars.discourse-cdn.com/v4/letter/d/ec9cab/32.png) [@denkar](https://forum.opensearch.org/u/denkar)\
**Post date:** [April 18, 2023, 6:58am UTC](https://forum.opensearch.org/t/ldap-backend-roles-authz-not-working/13982/1 "2023-04-18T06:58:55Z")

</div>

Hi,

We are not getting the OS LDAP Authorization (Authz) part with backend roles to work, although LDAP Authentication works.

All users that need to be authorized are placed in LDAP in the “ldap\_test\_group” below ou=groups,dc=xxxx,dc=xx

The env is running Opensearch v2.6.0 on RHEL 8 with OpenLDAP authentication and PosixGroups/Accounts.

Would really appreciate som help in solving this, all config sections are below.

#1#  
/usr/opensearch/config/opensearch-security/config.yml

```
authz:
  roles_from_myldap:
    description: "Authorize via LDAP or Active Directory"
    http_enabled: true
    transport_enabled: true
    authorization_backend:
      type: ldap
      config:
        pemtrustedcas_filepath: /usr/opensearch/config/cert/xxxx.pem
        enable_ssl: true
        enable_start_tls: false
        enable_ssl_client_auth: false
        verify_hostnames: true
        hosts:
        - ldap-xxxx.xxxx.xx:8443
        bind_dn: cn=ldapuser,dc=xxxx,dc=xx
        password: "xxxxx"
        userbase: 'ou=users,dc=xxxx,dc=xx'
        usersearch: '(uid={0})'
        username_attribute: "uid"
        skip_users:
         - admin
         - kibanaserver
        rolebase: 'ou=groups,dc=xxxx,dc=xx'
        rolesearch: '(memberUid={0})'
        userroleattribute: null
        userrolename: disabled
        rolename: cn
        resolve_nested_roles: false

```

#2#  
/usr/opensearch/config/opensearch-security/internal\_users.yml

#admin  
admin:  
hash: “xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx”  
reserved: true  
backend\_roles:  
- “admin”  
- “ldap\_test\_group”  
description: “admin user”

#3#  
/usr/opensearch/config/opensearch-security/roles\_mapping.yml

all\_access:  
reserved: false  
backend\_roles:  
- “admin”  
- “cn=ldap\_test\_group,ou=groups,dc=xxxx,dc=xx”  
description: “Maps admin to all\_access”

We have also tried changing the above line in roles\_mapping.yml from “cn=ldap\_test\_group,ou=groups,dc=xxxx,dc=xx” to “ldap\_test\_group” but it does not solve the issue.

When testing manually with ldapsearch and the ldap\_test\_user which is a member of the ldap\_test\_group it works.

ldapsearch -w ‘xxxxx’ -x -D “cn=ldapuser,dc=xxxx,dc=xx” -b “ou=groups,dc=xxxx,dc=xx” -H ldaps://ldap-xxxx.xxxx.xx:8443 ‘(memberUid=ldap\_test\_user)’ ‘cn’

Best Regards  
//Dennis

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [April 18, 2023, 8:22am UTC](https://forum.opensearch.org/t/ldap-backend-roles-authz-not-working/13982/2 "2023-04-18T08:22:03Z")

</div>

@denkar Would you mind sharing your LDAP authc section too?

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [April 18, 2023, 8:27am UTC](https://forum.opensearch.org/t/ldap-backend-roles-authz-not-working/13982/3 "2023-04-18T08:27:14Z")

</div>

@denkar Please run the below command with the test user and share the output.

```auto
curl --insecure -u <ldap_user> -XGET https://<OpenSearch_node>:9200/_plugins/_security/authinfo?pretty

```

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [April 18, 2023, 8:41am UTC](https://forum.opensearch.org/t/ldap-backend-roles-authz-not-working/13982/4 "2023-04-18T08:41:44Z")

</div>

@denkar Try this in authz section:

```auto
rolesearch: '(member={0})'

```

instead of:

```auto
rolesearch: '(memberUid={0})'

```

---

<div class="post-metadata">

**Author:** ![denkar](https://avatars.discourse-cdn.com/v4/letter/d/ec9cab/32.png) [@denkar](https://forum.opensearch.org/u/denkar)\
**Post date:** [April 18, 2023, 9:20am UTC](https://forum.opensearch.org/t/ldap-backend-roles-authz-not-working/13982/5 "2023-04-18T09:20:15Z")

</div>

Hi,

When running the command we get:

```auto
curl --insecure -u ldap_test_user -XGET https://opensearch-app-test.xxxxx.xx:9200/_plugins/_security/authinfo?pretty

{
  "user" : "User [name=ldap_test_user, backend_roles=[], requestedTenant=null]",
  "user_name" : "ldap_test_user",
  "user_requested_tenant" : null,
  "remote_address" : "10.126.2.118:41830",
  "backend_roles" : [],
  "custom_attribute_names" : [
    "ldap.dn",
    "attr.ldap.hasSubordinates",
    "attr.ldap.cn",
    "attr.ldap.entryUUID",
    "attr.ldap.gidNumber",
    "attr.ldap.sshPublicKey",
    "attr.ldap.subschemaSubentry",
    "attr.ldap.createTimestamp",
    "attr.ldap.modifyTimestamp",
    "ldap.original.username",
    "attr.ldap.creatorsName",
    "attr.ldap.uidNumber",
    "attr.ldap.homeDirectory",
    "attr.ldap.structuralObjectClass",
    "attr.ldap.objectClass",
    "attr.ldap.uid",
    "attr.ldap.modifiersName"
  ],
  "roles" : [
    "own_index"
  ],
  "tenants" : {
    "ldap_test_user" : true
  },
  "principal" : null,
  "peer_certificates" : "0",
  "sso_logout_url" : null
}

```

Changing rolesearch from ‘(memberUid={0})’ to rolesearch: ‘(member={0})’ doesnt make any difference.

LDAP authc section is below:

```auto
    authc:
      basic_internal_auth_domain:
        description: "Authenticate via HTTP Basic against internal users database"
        http_enabled: true
        transport_enabled: true
        order: 1
        http_authenticator:
          type: basic
          challenge: true
        authentication_backend:
          type: intern
      ldap:
        description: "Authenticate via LDAP or Active Directory"
        http_enabled: true
        transport_enabled: true
        order: 0
        http_authenticator:
          type: basic
          challenge: true
        authentication_backend:
          # LDAP authentication backend (authenticate users against a LDAP or Active Directory)
          type: ldap
          config:
            pemtrustedcas_filepath: /usr/opensearch/config/cert/xxxx.pem
            enable_ssl: true
            enable_start_tls: false
            enable_ssl_client_auth: false
            verify_hostnames: true
            hosts:
            - ldapxxxx.xxxxxx.xx:8443
            bind_dn: cn=ldapxxx,dc=xxxxx,dc=xx
            password: "xxxxx"
            userbase: 'ou=users,dc=xxxxx,dc=xx'
            usersearch: '(uid={0})'
            username_attribute: uid

```

We want all the users in a specific ldap group to have admin access in Opensearch.  
We never speciify the user names only the group.

//Dennis

---

<div class="post-metadata">

**Author:** ![denkar](https://avatars.discourse-cdn.com/v4/letter/d/ec9cab/32.png) [@denkar](https://forum.opensearch.org/u/denkar)\
**Post date:** [April 18, 2023, 9:24am UTC](https://forum.opensearch.org/t/ldap-backend-roles-authz-not-working/13982/6 "2023-04-18T09:24:58Z")

</div>

Here is a slightly modified screenshot from our Openldap,

 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/9/95df1f4480134d5e16540f4e5d371d9eeb225313.jpeg)

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [April 18, 2023, 9:35am UTC](https://forum.opensearch.org/t/ldap-backend-roles-authz-not-working/13982/7 "2023-04-18T09:35:15Z")

</div>

@denkar Could you run authinfo curl command again after making the change in the config.yml?  
Did you apply the change to the cluster with securityadmin.sh?

---

<div class="post-metadata">

**Author:** ![denkar](https://avatars.discourse-cdn.com/v4/letter/d/ec9cab/32.png) [@denkar](https://forum.opensearch.org/u/denkar)\
**Post date:** [April 18, 2023, 9:43am UTC](https://forum.opensearch.org/t/ldap-backend-roles-authz-not-working/13982/8 "2023-04-18T09:43:16Z")

</div>

Ran the authinfo curl command again with the same results.

here is the new config.yml authz section:

```
        rolebase: 'ou=groups,dc=xxxxx,dc=xx'
        rolesearch: '(member={0})'
        userroleattribute: null
        userrolename: none
        rolename: "name"
        resolve_nested_roles: false

```

Applied the changes afterwards with securityadmin.sh , but the backend role is still missing

Best Regards  
//Dennis

---

<div class="post-metadata">

**Author:** ![denkar](https://avatars.discourse-cdn.com/v4/letter/d/ec9cab/32.png) [@denkar](https://forum.opensearch.org/u/denkar)\
**Post date:** [April 18, 2023, 10:27am UTC](https://forum.opensearch.org/t/ldap-backend-roles-authz-not-working/13982/9 "2023-04-18T10:27:44Z")

</div>

Hi again,

Here comes some more command output.

authinfo against admin shows:

```auto
curl --insecure -u admin -XGET https://opensearch_xxxx.xxxxx.xx:9200/_plugins/_security/authinfo?pretty
Enter host password for user 'admin':
{
  "user" : "User [name=admin, backend_roles=[admin], requestedTenant=null]",
  "user_name" : "admin",
  "user_requested_tenant" : null,
  "remote_address" : "10.126.2.118:34280",
  "backend_roles" : [
    "admin"
  ],
  "custom_attribute_names" : [],
  "roles" : [
    "own_index",
    "all_access"
  ],
  "tenants" : {
    "global_tenant" : true,
    "admin_tenant" : true,
    "admin" : true
  },
  "principal" : null,
  "peer_certificates" : "0",
  "sso_logout_url" : null
}

```

authinfo against ldap\_test\_user shows:

```auto
curl --insecure -u ldap_test_user -XGET https://opensearch_xxxx.xxxxx.xx:9200/_plugins/_security/authinfo?pretty
Enter host password for user 'ldap_test_user':
{
  "user" : "User [name=ldap_test_user, backend_roles=[], requestedTenant=null]",
  "user_name" : "ldap_test_user",
  "user_requested_tenant" : null,
  "remote_address" : "10.126.2.118:47090",
  "backend_roles" : [],
  "custom_attribute_names" : [
    "ldap.dn",
    "attr.ldap.hasSubordinates",
    "attr.ldap.cn",
    "attr.ldap.entryUUID",
    "attr.ldap.gidNumber",
    "attr.ldap.sshPublicKey",
    "attr.ldap.subschemaSubentry",
    "attr.ldap.createTimestamp",
    "attr.ldap.modifyTimestamp",
    "ldap.original.username",
    "attr.ldap.creatorsName",
    "attr.ldap.uidNumber",
    "attr.ldap.homeDirectory",
    "attr.ldap.structuralObjectClass",
    "attr.ldap.objectClass",
    "attr.ldap.uid",
    "attr.ldap.modifiersName"
  ],
  "roles" : [
    "own_index"
  ],
  "tenants" : {
    "ldap_test_user" : true
  },
  "principal" : null,
  "peer_certificates" : "0",
  "sso_logout_url" : null
}

```

---

<div class="post-metadata">

**Author:** ![pablo](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/pablo/32/10363_2.png) [@pablo](https://forum.opensearch.org/u/pablo)\
**Post date:** [April 18, 2023, 3:51pm UTC](https://forum.opensearch.org/t/ldap-backend-roles-authz-not-working/13982/10 "2023-04-18T15:51:36Z")

</div>

@denkar In your outputs you’ll notice that `backend_roles` array is empty. This should contain all the groups assigned to the user in the IdP (OpenLdap).

When you look at the OpenLdap logs you’ll find the similar line

```auto
conn=1234 op=2 SRCH base="ou=groups,dc=example,dc=org" scope=2 deref=3 filter="(member=cn=user1,ou=users,dc=example,dc=org)"

```

This is how OpenLdap searches for a user in each group. I’m not sure if this is configurable.

Looking at your screenshot I assume that you’ve set memberUid as I did the first time.  
Instead of typing the full user’s DN you’ve just typed the user’s CN.  
Since the filter is using full DN to search the members in the group the result will be empty.

I’ve fixed that by adding the user’s DN as memberUid.

![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/5/59aaed103b79a7374e4a7f5f01b0c464b3223a98.png)

![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/7/74f1a9f15bb4fcc5d2983eb66f8b13e1479bd557.png)

![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/d/d8a96e476a07625e1349931f8409b6673efced56.png)

 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/4/42f3bb92a96a0b6b8eb7c8c43bac78facedfa0cd.png)

![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/f/f2986d38c2ee747eb5990a6ff1571eab35952fa5.png)

I hope this will help.

---

<div class="post-metadata">

**Author:** ![denkar](https://avatars.discourse-cdn.com/v4/letter/d/ec9cab/32.png) [@denkar](https://forum.opensearch.org/u/denkar)\
**Post date:** [April 18, 2023, 6:55pm UTC](https://forum.opensearch.org/t/ldap-backend-roles-authz-not-working/13982/11 "2023-04-18T18:55:05Z")

</div>

Thanks a lot for helping us pablo, now it works!

Best Regards  
//Dennis