Mapping users and groups to roles

If you authenticate users with the native or file realms, you can manage role assignment by using the User Management APIs or the users command-line tool respectively.

For other types of realms, you must create role-mappings that define which roles should be assigned to each user based on their username, groups, or other metadata.

You can define role-mappings via an API or manage them through files. These two sources of role-mapping are combined inside of the Elasticsearch security features, so it is possible for a single user to have some roles that have been mapped through the API, and other roles that are mapped through files.

When you use role-mappings, you assign existing roles to users. The available roles should either be added using the role management APIs or defined in the roles file. Either role-mapping method can use either role management method. For example, when you use the role mapping API, you are able to map users to both API-managed roles and file-managed roles (and likewise for file-based role-mappings).

The PKI, LDAP, Kerberos and SAML realms support using authorization realms as an alternative to role mapping.

When anonymous access is enabled, the roles of the anonymous user are assigned to all the other users as well.

Users with no roles assigned will be unauthorized for any action.

Using the role mapping API

You can define role-mappings through the add role mapping API.

Using role mapping files

To use file based role-mappings, you must configure the mappings in a YAML file and copy it to each node in the cluster. Tools like Puppet or Chef can help with this.

By default, role mappings are stored in ES_PATH_CONF/role_mapping.yml, where ES_PATH_CONF is ES_HOME/config (zip/tar installations) or /etc/elasticsearch (package installations). To specify a different location, you configure the files.role_mapping setting in the Active Directory, LDAP, and PKI realm settings in elasticsearch.yml.

Within the role mapping file, the security roles are keys and groups and users are values. The mappings can have a many-to-many relationship. When you map roles to groups, the roles of a user in that group are the combination of the roles assigned to that group and the roles assigned to that user.

By default, Elasticsearch checks role mapping files for changes every 5 seconds. You can change this default behavior by changing the resource.reload.interval.high setting in the elasticsearch.yml file. Since this is a common setting in Elasticsearch, changing its value might effect other schedules in the system.

While the role mapping APIs is the preferred way to manage role mappings, using the role_mappings.yml file becomes useful in a couple of use cases:

1. If you want to define fixed role mappings that no one (besides an administrator with physical access to the Elasticsearch nodes) would be able to change.
2. If cluster administration depends on users from external realms and these users need to have their roles mapped to them even when the cluster is RED. For instance an administrator that authenticates via LDAP or PKI and gets assigned an administrator role so that they can perform corrective actions.

Please note however, that the role_mappings.yml file is provided as a minimal administrative function and is not intended to cover and be used to define roles for all use cases.

You cannot view, edit, or remove any roles that are defined in the role mapping files by using the the role mapping APIs.

Realm specific details

Active Directory and LDAP realms

To specify users and groups in the role mappings, you use their Distinguished Names (DNs). A DN is a string that uniquely identifies the user or group, for example "cn=John Doe,cn=contractors,dc=example,dc=com".

The Elasticsearch security features support only Active Directory security groups. You cannot map distribution groups to roles.

For example, the following snippet uses the file-based method to map the admins group to the monitoring role and map the John Doe user, the users group, and the admins group to the user role.

monitoring: 
  - "cn=admins,dc=example,dc=com" 
user:
  - "cn=John Doe,cn=contractors,dc=example,dc=com" 
  - "cn=users,dc=example,dc=com"
  - "cn=admins,dc=example,dc=com"

You can use the role-mapping API to define equivalent mappings as follows:

PUT /_security/role_mapping/admins
{
  "roles" : [ "monitoring", "user" ],
  "rules" : { "field" : { "groups" : "cn=admins,dc=example,dc=com" } },
  "enabled": true
}

PUT /_security/role_mapping/basic_users
{
  "roles" : [ "user" ],
  "rules" : { "any" : [
      { "field" : { "dn" : "cn=John Doe,cn=contractors,dc=example,dc=com" } },
      { "field" : { "groups" : "cn=users,dc=example,dc=com" } }
  ] },
  "enabled": true
}

PKI realms

PKI realms support mapping users to roles, but you cannot map groups as the PKI realm has no notion of a group.

This is an example using a file-based mapping:

monitoring:
  - "cn=Admin,ou=example,o=com"
user:
  - "cn=John Doe,ou=example,o=com"

The following example creates equivalent mappings using the API:

PUT /_security/role_mapping/admin_user
{
  "roles" : [ "monitoring" ],
  "rules" : { "field" : { "dn" : "cn=Admin,ou=example,o=com" } },
  "enabled": true
}

PUT /_security/role_mapping/basic_user
{
  "roles" : [ "user" ],
  "rules" : { "field" : { "dn" : "cn=John Doe,ou=example,o=com" } },
  "enabled": true
}