WARNING: Version 6.2 of the Elastic Stack has passed its EOL date.

This documentation is no longer being maintained and may be removed. If you are running this version, we strongly advise you to upgrade. For the latest information, see the current release documentation.

« Some settings are not returned via the nodes settings API Users command fails due to extra arguments »

› › ›

Authorization exceptions

edit

Authorization exceptions

edit

Symptoms:

I configured the appropriate roles and the users, but I still get an authorization exception.
I can authenticate to LDAP, but I still get an authorization exception.

Resolution:

Verify that the role names associated with the users match the roles defined in the roles.yml file. You can use the users tool to list all the users. Any unknown roles are marked with *.
```
bin/xpack/users list
rdeniro        : admin
alpacino       : power_user
jacknich       : monitoring,unknown_role* 
```
unknown_role was not found in roles.yml

For more information about this command, see Users Command.

If you are authenticating to LDAP, a number of configuration options can cause this error.

group identification	Groups are located by either an LDAP search or by the "memberOf" attribute on the user. Also, If subtree search is turned off, it will search only one level deep. See the LDAP Settings for all the options. There are many options here and sticking to the defaults will not work for all scenarios.
group to role mapping	Either the `role_mapping.yml` file or the location for this file could be misconfigured. See Security Files for more.
role definition	The role definition might be missing or invalid.

To help track down these possibilities, add the following lines to the end of the log4j2.properties configuration file in the ES_PATH_CONF:

logger.authc.name = org.elasticsearch.xpack.security.authc
logger.authc.level = DEBUG

A successful authentication should produce debug statements that list groups and role mappings.

« Some settings are not returned via the nodes settings API Users command fails due to extra arguments »