Create or update role mappings Added in 5.5.0

PUT /_security/role_mapping/{name}

Role mappings define which roles are assigned to each user. Each mapping has rules that identify users and a list of roles that are granted to those users. The role mapping APIs are generally the preferred way to manage role mappings rather than using role mapping files. The create or update role mappings API cannot update role mappings that are defined in role mapping files.

NOTE: This API does not create roles. Rather, it maps users to existing roles. Roles can be created by using the create or update roles API or roles files.

Role templates

The most common use for role mappings is to create a mapping from a known value on the user to a fixed role name. For example, all users in the cn=admin,dc=example,dc=com LDAP group should be given the superuser role in Elasticsearch. The roles field is used for this purpose.

For more complex needs, it is possible to use Mustache templates to dynamically determine the names of the roles that should be granted to the user. The role_templates field is used for this purpose.

NOTE: To use role templates successfully, the relevant scripting feature must be enabled. Otherwise, all attempts to create a role mapping with role templates fail.

All of the user fields that are available in the role mapping rules are also available in the role templates. Thus it is possible to assign a user to a role that reflects their username, their groups, or the name of the realm to which they authenticated.

By default a template is evaluated to produce a single string that is the name of the role which should be assigned to the user. If the format of the template is set to "json" then the template is expected to produce a JSON string or an array of JSON strings for the role names.

Path parameters

  • name string Required

    The distinct name that identifies the role mapping. The name is used solely as an identifier to facilitate interaction via the API; it does not affect the behavior of the mapping in any way.

Query parameters

  • refresh string

    If true (the default) then refresh the affected shards to make this operation visible to search, if wait_for then wait for a refresh to make this operation visible to search, if false then do nothing with refreshes.

    Values are true, false, or wait_for.

application/json

Body Required

  • enabled boolean

    Mappings that have enabled set to false are ignored when role mapping is performed.

  • metadata object
    Hide metadata attribute Show metadata attribute object
    • * object Additional properties

      Additional properties are allowed.

  • roles array[string]

    A list of role names that are granted to the users that match the role mapping rules. Exactly one of roles or role_templates must be specified.

  • role_templates array[object]

    A list of Mustache templates that will be evaluated to determine the roles names that should granted to the users that match the role mapping rules. Exactly one of roles or role_templates must be specified.

    Hide role_templates attributes Show role_templates attributes object
    • format string

      Values are string or json.

    • template object Required

      Additional properties are allowed.

      Hide template attributes Show template attributes object
      • source string

        The script source.

      • id string
      • params object

        Specifies any named parameters that are passed into the script as variables. Use parameters instead of hard-coded values to decrease compile time.

        Hide params attribute Show params attribute object
        • * object Additional properties

          Additional properties are allowed.

      • lang string

        Any of:

        Values are painless, expression, mustache, or java.

      • options object
        Hide options attribute Show options attribute object
        • * string Additional properties
  • rules object

    Additional properties are allowed.

    Hide rules attributes Show rules attributes object
    • any array[object]

      Additional properties are allowed.

    • all array[object]

      Additional properties are allowed.

    • field object

      Additional properties are allowed.

      Hide field attributes Show field attributes object
    • except object

      Additional properties are allowed.

  • run_as array[string]

Responses

  • 200 application/json
    Hide response attributes Show response attributes object
    • created boolean
    • role_mapping object Required

      Additional properties are allowed.

      Hide role_mapping attribute Show role_mapping attribute object
PUT /_security/role_mapping/{name}
curl \
 --request PUT http://api.example.com/_security/role_mapping/{name} \
 --header "Content-Type: application/json" \
 --data '{"enabled":true,"metadata":{"additionalProperty1":{},"additionalProperty2":{}},"roles":["string"],"role_templates":[{"format":"string","template":{"source":"string","id":"string","params":{"additionalProperty1":{},"additionalProperty2":{}},"":"painless","options":{"additionalProperty1":"string","additionalProperty2":"string"}}}],"rules":{"any":[{}],"all":[{}],"field":{"username":"string","dn":"string","groups":"string"},"except":{}},"run_as":["string"]}'
Request examples
{
  "enabled": true,
  "metadata": {
    "additionalProperty1": {},
    "additionalProperty2": {}
  },
  "roles": [
    "string"
  ],
  "role_templates": [
    {
      "format": "string",
      "template": {
        "source": "string",
        "id": "string",
        "params": {
          "additionalProperty1": {},
          "additionalProperty2": {}
        },
        "": "painless",
        "options": {
          "additionalProperty1": "string",
          "additionalProperty2": "string"
        }
      }
    }
  ],
  "rules": {
    "any": [
      {}
    ],
    "all": [
      {}
    ],
    "field": {
      "username": "string",
      "dn": "string",
      "groups": "string"
    },
    "except": {}
  },
  "run_as": [
    "string"
  ]
}
Response examples (200)
{
  "created": true,
  "role_mapping": {
    "created": true
  }
}