# LDAP groups error with different index

**URL:** <https://forum.opensearch.org/t/ldap-groups-error-with-different-index/965>\
**Category:** Security\
**Created:** [June 25, 2019, 10:46am UTC](https://forum.opensearch.org/t/ldap-groups-error-with-different-index/965 "2019-06-25T10:46:46Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Orion](https://avatars.discourse-cdn.com/v4/letter/o/a88e4f/32.png) [@Orion](https://forum.opensearch.org/u/Orion)\
**Post date:** [June 25, 2019, 10:46am UTC](https://forum.opensearch.org/t/ldap-groups-error-with-different-index/965/1 "2019-06-25T10:46:46Z")

</div>

Hi, i’m searching a solution for different groups of LDAP that one of them see an index and other one see other index. I have followed this manual to integrate ldap groups with authorization:

> **[LDAP Integration for Open Distro for Elasticsearch | Amazon Web Services](https://aws.amazon.com/es/blogs/opensource/ldap-integration-for-open-distro-for-elasticsearch/)**
>
> 中文版 – Open Distro for Elasticsearch’s security plugin comes with authentication and access control out of the box. In prior posts we showed how you can change your admin password in Open Distro for Elasticsearch and how you can add your own SSL...

The problem is that, i can login without problems with users of LDAP and if i define a backend role with a with a wildcard (\*) at index all work properly.

But if i filter by an index (for example security\*) and then login with my user of LDAP i see a blank page on Discover and this error at Timelion:

“no permissions for [indices:data/read/search] and User [name=CN=XXX…”

Need help please…thanks a lot.

---

<div class="post-metadata">

**Author:** ![aetter](https://avatars.discourse-cdn.com/v4/letter/a/e95f7d/32.png) [@aetter](https://forum.opensearch.org/u/aetter)\
**Post date:** [June 28, 2019, 9:34pm UTC](https://forum.opensearch.org/t/ldap-groups-error-with-different-index/965/2 "2019-06-28T21:34:54Z")

</div>

Hi @Orion, permissions errors like this one typically mean you’re authenticating successfully, but that your user/backend role isn’t mapped to the right role(s), or those role(s) don’t have the right permissions. Can you try mapping the `kibanauser` role to the backend role from LDAP? Then you can map additional roles (with permissions to specific indices) to the backend role, as well, but to use Kibana without errors, you need that `kibanauser` role (or an equivalent set of permissions).

---

<div class="post-metadata">

**Author:** ![mkiran18](https://avatars.discourse-cdn.com/v4/letter/m/5daacb/32.png) [@mkiran18](https://forum.opensearch.org/u/mkiran18)\
**Post date:** [July 1, 2019, 4:35pm UTC](https://forum.opensearch.org/t/ldap-groups-error-with-different-index/965/3 "2019-07-01T16:35:56Z")

</div>

Hi @aetter , I had the same exaact issue …

Getting 403 security exception on :  
/api/saved\_objects/\_find?type=index-pattern&fields=title&search=\*&search\_fields=title&per\_page=1

```
error: "Forbidden"
message: "no permissions for [indices:data/read/search] and User [name=ldap_ads_user, roles=[PRC-USER-GROUP], requestedTenant=null]: [security_exception] no permissions for [indices:data/read/search] and User [name=ldap_ads_user, roles=[PRC-USER-GROUP], requestedTenant=null]"
statusCode: 403

```

Role for PRC-USER-GROUP:

```
{
  "cluster": [],
  "indices": {
    "index1-*": {
      "*": [
        "READ"
      ]
    }
  },
  "tenants": {}
}

```

Role Mapping :

```
 { 
      "backendroles": [
      "PRC-USER-GROUP"
      ],
     "hosts": [],
      "users": []
    }

```

LDAP login is working fine with the auth info api call populating backend roles array with the above PRC group.

is there any other additional step missing in mapping the role to appropriate indices ?  
EDIT 1:

If i replace the mapping with it works fine.

```
{
      "cluster": [],
      "indices": {
        "*": {
          "*": [
            "READ"
          ]
        }
      },
      "tenants": {}
    }

```

Even the specific Index name also , experiencing the same failure:

```
{
      "cluster": [],
      "indices": {
        "index1-2342": {
          "*": [
            "READ"
          ]
        }
      },
      "tenants": {}
    }

```

After trial runs , Found the solution :

```
{
  "cluster": [],
  "indices": {
    "index1-*": {
      "*": ["READ"]
    },
    "?kibana*": {
      "*": ["READ"]
    }
  },
  "tenants": {}
}

```

Add the second pattern as well and it gave access to the pattern of the indices that is needed to build in management. Having **kibanauser** in the backend role didnt fix the issue for my case.

---

<div class="post-metadata">

**Author:** ![aetter](https://avatars.discourse-cdn.com/v4/letter/a/e95f7d/32.png) [@aetter](https://forum.opensearch.org/u/aetter)\
**Post date:** [July 2, 2019, 8:56pm UTC](https://forum.opensearch.org/t/ldap-groups-error-with-different-index/965/4 "2019-07-02T20:56:48Z")

</div>

@mkiran18, yeah, that achieves basically the same purpose. Upon logging in, your user/backend role needs to inherit two security roles: your custom one that has permissions to your index, and `kibana_user` so that you can do basic Kibana things. If you add the Kibana permissions into your custom role, that’s fine, too, just a little harder to maintain.

---

<div class="post-metadata">

**Author:** ![mkiran18](https://avatars.discourse-cdn.com/v4/letter/m/5daacb/32.png) [@mkiran18](https://forum.opensearch.org/u/mkiran18)\
**Post date:** [July 3, 2019, 8:06pm UTC](https://forum.opensearch.org/t/ldap-groups-error-with-different-index/965/5 "2019-07-03T20:06:51Z")

</div>

Thanks @aetter, May be i didnt do it correctly, do you have sample json that i can compare the backend role assignment along with custom role for kibana user.

Tried this :

```
{ 
      "backendroles": [
      "PRC-USER-GROUP","kibanauser"
      ],
     "hosts": [],
      "users": []
    }

```

Above sample wont work as the LDAP might not have `kibanauser` assigned in the Active Directory as the user designated role for the users.

---

<div class="post-metadata">

**Author:** ![kiowajoe](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/kiowajoe/32/109_2.png) [@kiowajoe](https://forum.opensearch.org/u/kiowajoe)\
**Post date:** [August 13, 2019, 1:30pm UTC](https://forum.opensearch.org/t/ldap-groups-error-with-different-index/965/6 "2019-08-13T13:30:15Z")

</div>

I added my LDAP group (ES-readall) to the backend roles for the kibana\_user in addition to the role with the applicable index permissions, which allowed the correct permissions in kibana. Opendistro 1.1.0/Elastic 7.1.1

> ```
> roles_mapping.yml
> ---
> kibana_user:
> reserved: false
> hidden: false
> backend_roles:
> - "kibanauser"
> - "ES-readall"
> hosts: []
> users: []
> and_backend_roles: []
> description: "Maps kibanauser to kibana_user"
> _meta:
> type: "rolesmapping"
> config_version: 2
> readall:
> reserved: false
> hidden: false
> backend_roles:
> - "readall"
> - "ES-readall"
> hosts: []
> users: []
> and_backend_roles: []
> 
> ```

---

<div class="post-metadata">

**Author:** ![mkiran18](https://avatars.discourse-cdn.com/v4/letter/m/5daacb/32.png) [@mkiran18](https://forum.opensearch.org/u/mkiran18)\
**Post date:** [August 13, 2019, 5:43pm UTC](https://forum.opensearch.org/t/ldap-groups-error-with-different-index/965/7 "2019-08-13T17:43:46Z")

</div>

Thanks @kiowajoe,

is your user a LDAP user or user specific to elastic only ?

if LDAP can you check on the : /api/v1/auth/authinfo api call response for “backend\_roles” attribute, it usually has all the roles from active directory, my understanding is that unless “kibanauser” part of active directory roles, it do not match with the backend\_roles of the role\_mapping and kibana login will still fail.

Thanks

---

<div class="post-metadata">

**Author:** ![kiowajoe](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/kiowajoe/32/109_2.png) [@kiowajoe](https://forum.opensearch.org/u/kiowajoe)\
**Post date:** [August 13, 2019, 6:32pm UTC](https://forum.opensearch.org/t/ldap-groups-error-with-different-index/965/8 "2019-08-13T18:32:42Z")

</div>

This is an LDAP user, and maybe I misspoke. My understanding was that adding the appropriate retrieved ldap roles to the backend\_roles in the mapping for the kibana\_user role was all that was needed. The same permissions in the kibana\_user could be added to a custom role, but that would increase management requirements. The backend\_roles listed in the authinfo request has the backend\_role I map to kibana\_user role and readall role. There aresome others that do not map to elasticsearch roles, since I just pull what groups they are members of. But, I have no kibanauser in the backend\_roles output from authinfo. Seems to work normally for me with that config.

From [https://opendistro.github.io/for-elasticsearch-docs/docs/security-access-control/users-roles/#map-users-to-roles](https://opendistro.github.io/for-elasticsearch-docs/docs/security-access-control/users-roles/#map-users-to-roles) …Specify users, backend roles (roles from from LDAP or Active Directory), and hosts as desired.

---

<div class="post-metadata">

**Author:** ![mkiran18](https://avatars.discourse-cdn.com/v4/letter/m/5daacb/32.png) [@mkiran18](https://forum.opensearch.org/u/mkiran18)\
**Post date:** [August 13, 2019, 7:13pm UTC](https://forum.opensearch.org/t/ldap-groups-error-with-different-index/965/9 "2019-08-13T19:13:54Z")

</div>

Thanks @kiowajoe , Will try with this option as well.