Creates and updates role mappings.
Role mappings define which roles are assigned to each user. Each mapping has rules that identify users and a list of roles that are granted to those users.
This API does not create roles. Rather, it maps users to existing roles. Roles can be created by using Role Management APIs or roles files.
For more information, see Mapping users and groups to roles.
name
The following parameters can be specified in the body of a PUT or POST request and pertain to adding a role mapping:
enabled
(required)
enabled
set to false
are ignored when role
mapping is performed.
metadata
metadata
object, keys beginning with _
are reserved for
system usage.
roles
(required)
rules
(required)
The following example assigns the "user" role to all users:
POST /_security/role_mapping/mapping1 { "roles": [ "user"], "enabled": true, "rules": { "field" : { "username" : "*" } }, "metadata" : { "version" : 1 } }
Mappings that have | |
Metadata is optional. |
A successful call returns a JSON structure that shows whether the mapping has been created or updated.
The following example assigns the "user" and "admin" roles to specific users:
POST /_security/role_mapping/mapping2 { "roles": [ "user", "admin" ], "enabled": true, "rules": { "field" : { "username" : [ "esadmin01", "esadmin02" ] } } }
The following example matches any user where either the username is esadmin
or the user is in the cn=admin,dc=example,dc=com
group:
POST /_security/role_mapping/mapping3 { "roles": [ "superuser" ], "enabled": true, "rules": { "any": [ { "field": { "username": "esadmin" } }, { "field": { "groups": "cn=admins,dc=example,dc=com" } } ] } }
The following example matches users who authenticated against a specific realm:
POST /_security/role_mapping/mapping4 { "roles": [ "ldap-user" ], "enabled": true, "rules": { "field" : { "realm.name" : "ldap1" } } }
The following example matches users within a specific LDAP sub-tree:
POST /_security/role_mapping/mapping5 { "roles": [ "example-user" ], "enabled": true, "rules": { "field" : { "dn" : "*,ou=subtree,dc=example,dc=com" } } }
The following example matches users within a particular LDAP sub-tree in a specific realm:
POST /_security/role_mapping/mapping6 { "roles": [ "ldap-example-user" ], "enabled": true, "rules": { "all": [ { "field" : { "dn" : "*,ou=subtree,dc=example,dc=com" } }, { "field" : { "realm.name" : "ldap1" } } ] } }
The rules can be more complex and include wildcard matching. For example, the following mapping matches any user where all of these conditions are met:
*,ou=admin,dc=example,dc=com
,
or the username is es-admin
, or the username is es-system
cn=people,dc=example,dc=com
group
terminated_date
POST /_security/role_mapping/mapping7 { "roles": [ "superuser" ], "enabled": true, "rules": { "all": [ { "any": [ { "field": { "dn": "*,ou=admin,dc=example,dc=com" } }, { "field": { "username": [ "es-admin", "es-system" ] } } ] }, { "field": { "groups": "cn=people,dc=example,dc=com" } }, { "except": { "field": { "metadata.terminated_date": null } } } ] } }