Mapping Users and Groups to Roles

If you authenticate users with an esusers realm, you can assign roles when you add a user and use the roles command to add or remove roles.

For other types of realms, you configure role mappings for users and groups in a YAML file. By default, role mappings are stored in config/shield/role_mapping.yml. You can specify the name and location of the mapping file by configuring the appropriate role_mapping setting in elasticsearch.yml:

Within the role mapping file, Elasticsearch roles are keys and groups and users are values. The mapping can have a many-to-many relationship. When you map roles to groups, the roles of a user in that group are the combination of the roles assigned to that group and the roles assigned to that user.

To map users and groups to a role, you create a mapping file and copy it to each node in the cluster. Tools like Puppet or Chef can help with this.

Example LDAP Role Mapping File.

# Example LDAP group mapping configuration:
# roleA: 
#  - groupA-DN 
#  - groupB-DN
#  - user1-DN 
monitoring:
  - "cn=admins,dc=example,dc=com"
user:
  - "cn=users,dc=example,dc=com"
  - "cn=admins,dc=example,dc=com"
  - "cn=John Doe,cn=contractors,dc=example,dc=com"

Example Active Directory Role Mapping File.

# Example Active Directory group mapping configuration:
# roleA: 
#  - groupA-DN 
#  - groupB-DN
#  - user1-DN 
monitoring:
  - "cn=admins,dc=example,dc=com"
user:
  - "cn=users,dc=example,dc=com"
  - "cn=admins,dc=example,dc=com"
  - "cn=John Doe,cn=contractors,dc=example,dc=com"

Example PKI Role Mapping File.

# Example user mapping configuration:
# roleA: 
#  - user1-DN 
monitoring:
  - "cn=Admin,ou=example,o=com"
user:
  - "cn=John Doe,ou=example,o=com"