# Security roles mapping question

**URL:** <https://forum.opensearch.org/t/security-roles-mapping-question/18174>\
**Category:** Security\
**Tags:** discuss\
**Created:** [February 29, 2024, 11:14am UTC](https://forum.opensearch.org/t/security-roles-mapping-question/18174 "2024-02-29T11:14:43Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![nerx322](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/nerx322/32/6993_2.png) [@nerx322](https://forum.opensearch.org/u/nerx322)\
**Post date:** [February 29, 2024, 11:14am UTC](https://forum.opensearch.org/t/security-roles-mapping-question/18174/1 "2024-02-29T11:14:43Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser):

Opensearch 2.11

**Describe the issue** :  
Hi!  
I’m learning opensearch security and i have one question  
When i receive JWT token and when AuthCredentials fill, where in code security maps backend roles to internal roles? I’m quite stuck with this question

---

<div class="post-metadata">

**Author:** ![Eugene7](https://avatars.discourse-cdn.com/v4/letter/e/bbce88/32.png) [@Eugene7](https://forum.opensearch.org/u/Eugene7)\
**Post date:** [February 29, 2024, 12:13pm UTC](https://forum.opensearch.org/t/security-roles-mapping-question/18174/2 "2024-02-29T12:13:47Z")

</div>

Hi @nerx322

You can add a backend role to an internal role in the `Roles` section in the OpenSearch Dashboards.  
To do that, you need to open the OpenSearch Dashboard Menu, and click on `Security`. After that, please click on `Roles` and find your internal role:

 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/9/9152e3ec9c60a52816bec98ded2fd403dfeb5976.png)

Click on the role name and open the tab `Mapped users`:

 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/b/b9656b7ed7497688d9fc8993672d2d6b154188f2.png)

On the page that you have just opened, you can map a user or a backend role to the internal role. Click on the `Manage mapping` button and type your backend role:

 ![image](https://us1.discourse-cdn.com/flex019/uploads/mauve_hedgehog/original/2X/b/bb382e4845173eb5687977b1ed59376455f65877.png)

After that, please click on the `Map` button.

---

<div class="post-metadata">

**Author:** ![nerx322](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/nerx322/32/6993_2.png) [@nerx322](https://forum.opensearch.org/u/nerx322)\
**Post date:** [February 29, 2024, 12:17pm UTC](https://forum.opensearch.org/t/security-roles-mapping-question/18174/3 "2024-02-29T12:17:24Z")

</div>

Thanks!  
But my question was rather addressed to the code/server side of opensearch, like where in the java code does it map the internal roles to the received backend roles

---

<div class="post-metadata">

**Author:** ![Eugene7](https://avatars.discourse-cdn.com/v4/letter/e/bbce88/32.png) [@Eugene7](https://forum.opensearch.org/u/Eugene7)\
**Post date:** [February 29, 2024, 12:33pm UTC](https://forum.opensearch.org/t/security-roles-mapping-question/18174/4 "2024-02-29T12:33:25Z")

</div>

You can add changes to the `roles_mapping.yml` file or you can use REST API. At the following documentation, you can find an example how to add a backend role to the internal role:

> **[Users and roles](https://opensearch.org/docs/latest/security/access-control/users-roles/#map-users-to-roles)**
>
> Users and roles

If you decide to make changes to the `roles_mapping.yml` file, please find out how to apply changes and make backup:

> **[Applying changes to configuration files](https://opensearch.org/docs/latest/security/configuration/security-admin/)**
>
> Applying changes to configuration files