Authorization exceptions

Authorization exceptions

Symptoms:

  • I configured the appropriate roles and the users, but I still get an authorization exception.
  • I can authenticate to LDAP, but I still get an authorization exception.

Resolution:

  1. Verify that the role names associated with the users match the roles defined in the roles.yml file. You can use the elasticsearch-users tool to list all the users. Any unknown roles are marked with *.

    1. bin/elasticsearch-users list
    2. rdeniro        : admin
    3. alpacino       : power_user
    4. jacknich       : monitoring,unknown_role*

    unknown_role was not found in roles.yml

    For more information about this command, see the elasticsearch-users command.

  2. If you are authenticating to LDAP, a number of configuration options can cause this error.

    group identification

    Groups are located by either an LDAP search or by the “memberOf” attribute on the user. Also, If subtree search is turned off, it will search only one level deep. For all the options, see LDAP realm settings. There are many options here and sticking to the defaults will not work for all scenarios.

    group to role mapping

    Either the role_mapping.yml file or the location for this file could be misconfigured. For more information, see Security files.

    role definition

    The role definition might be missing or invalid.

    To help track down these possibilities, enable additional logging to troubleshoot further. You can enable debug logging by configuring the following persistent setting:

    1. resp = client.cluster.put_settings(
    2.     persistent={
    3.         "logger.org.elasticsearch.xpack.security.authc": "debug"
    4.     },
    5. )
    6. print(resp)
    1. response = client.cluster.put_settings(
    2.   body: {
    3.     persistent: {
    4.       'logger.org.elasticsearch.xpack.security.authc' => 'debug'
    5.     }
    6.   }
    7. )
    8. puts response
    1. const response = await client.cluster.putSettings({
    2.   persistent: {
    3.     "logger.org.elasticsearch.xpack.security.authc": "debug",
    4.   },
    5. });
    6. console.log(response);
    1. PUT /_cluster/settings
    2. {
    3.   "persistent": {
    4.     "logger.org.elasticsearch.xpack.security.authc": "debug"
    5.   }
    6. }

    Alternatively, you can add the following lines to the end of the log4j2.properties configuration file in the ES_PATH_CONF:

    1. logger.authc.name = org.elasticsearch.xpack.security.authc
    2. logger.authc.level = DEBUG

    Refer to configuring logging levels for more information.

    A successful authentication should produce debug statements that list groups and role mappings.