Active Directory AuthorizationException in elastic search

Question

I am trying to use AD authentication. I am able to login successfully but i am not authorized to perform any query in marvel. Everytime i execute query in marvel, i get the following error.Below are the details

{
   "error": "AuthorizationException[action [indices:data/read/search] is unauthorized for user [shivang.Mittal]]",
   "status": 403
}

elasticsearch.yml (C:\ES\elasticsearch-1.4.4\config)

 shield:
   authc:
     realms:
       active_directory:
         type: active_directory
         domain_name: tavant.in
         url: "LDAP://DODC1.tavant.in:389"
         user_dn_templates:
          - "cn={0}, dc=tavant, dc=in"
         group_search:
          base_dn: "dc=tavant,dc=in"
         files:
           role_mapping: "C:/ES/elasticsearch-1.4.4/config/shield/role_mapping.yml"

role_mapping.yml (C:\ES\elasticsearch-1.4.4\config\shield). Copied the same file in Node(C:\ES\elasticsearch-1.4.4\data\elasticsearch\nodes\0)

admin:
  - "cn=users, dc=tavant,dc=in"

roles.yml

admin:
  cluster: all
  indices:
    '*': all

UPDATE

As per Jaymode suggestion, I added the shield.auth: debug. Below is the log (Which i thought would be useful)

    [2015-04-27 11:54:12][DEBUG][shield.authc.ldap.support] [Talisman] the roles [[]], are mapped from these [active_directory] groups [[CN=Users,CN=Builtin,DC=tavant,DC=in, CN=Domain Users,CN=Users,DC=tavant,DC=in, 
    [2015-04-27 11:54:14,935][DEBUG][shield.authc.activedirectory] [Talisman] authenticated user [shivang.Mittal], with roles [[]]
    [2015-04-27 11:54:16,447][ERROR][marvel.agent.exporter    ] [Talisman] error adding the marvel template to [[0:0:0:0:0:0:0:0]:9200] response code [401 Unauthorized]. content: [{"error":"AuthenticationException[missing authentication token for REST request [/_template/marvel]]","status":401}]
    [2015-04-27 11:54:16,447][ERROR][marvel.agent.exporter    ] [Talisman] failed to verify/upload the marvel template to [[0:0:0:0:0:0:0:0]:9200]:
    Server returned HTTP response code: 401 for URL: http://[0:0:0:0:0:0:0:0]:9200/_template/marvel
[2015-04-27 11:54:16,447][ERROR][marvel.agent.exporter    ] [Talisman] failed to verify/upload the marvel template to [[0:0:0:0:0:0:0:0]:9200]:
Server returned HTTP response code: 401 for URL: http://[0:0:0:0:0:0:0:0]:9200/_template/marvel

jaymode · Accepted Answer · 2015-04-27T10:07:01.983

EDIT 2: Based on your log message, you probably want to use the following mapping

admin:
  - "CN=Users,CN=Builtin,DC=tavant,DC=in"

EDIT: I think I see your issue. In your role_mapping.yml you have:

admin:
  - "cn=users, dc=tavant,dc=tavant"

It should most likely be:

admin:
  - "cn=users,dc=tavant,dc=in"

I wonder if the DN you are using for role mapping is correct and is being retrieved. If you set debug logging the list of groups that are found for the user will be logged. To enable debug logging, edit the C:\ES\elasticsearch-1.4.4\config\logging.yml file:

...
logger:
    # Add the line below
    shield.authc: DEBUG
...

The log line will look something like this: the roles [], are mapped from these [active_directory] groups [ list of group DNs here ] for realm [active_directory/active_directory]

In that line you will find the actual list of group DNs that are retrieved. Also, your realm configuration can be simplified to the following:

shield:
  authc:
    realms:
      active_directory:
        type: active_directory
        domain_name: tavant.in
        url: "LDAP://DODC1.tavant.in:389"

The other settings actually appear to just specify what would be the default values if they are not specified.

Thanks for the answer jay, I accidently written dc=tavant in question, in settings it is dc=in only. edited my question. — Shivang MIttal, Apr 27 '15 at 06:11
I have tried the suggestion. The error log is showing the user authenticated. Please have a look on the updated question. — Shivang MIttal, Apr 27 '15 at 06:23
@ShivangMIttal I edited the answer with something that should work now. I forgot about the _Builtin_ portion of the DN. — jaymode, Apr 27 '15 at 10:08

Active Directory AuthorizationException in elastic search

1 Answers1