<p>I have discovered the issue, the path to the role_mapping.yml file was incorrect in elaticsearch.yml. I had to use the full path /usr/share/elasticsearch/config/role_mapping.yml</p>

CC BY-SA 4.0
2020-12-03T14:50:05.913Z
2020-12-03T14:50:05.913Z
Joel
<p>I am trying to test LDAP in elasticsearch/kibana by running it in Docker on Windows 10.</p>
<p>I pulled the image down:</p>
<pre><code>docker pull docker.elastic.co/elasticsearch/elasticsearch:7.10.0
</code></pre>
<p>And ran it:</p>
<pre><code>docker run -p 9200:9200 -p 9300:9300 -e &quot;discovery.type=single-node&quot; docker.elastic.co/elasticsearch/elasticsearch:7.10.0
</code></pre>
<p>I did the same with Kibana and everything came up as expected.  I then upgraded the elastic licence and started the 30 day trial to get the LDAP features in X-Pack.</p>
<p>I opened a shell to the container and updated the elasticsearch.yml file with my LDAP information and set the path to the role_mapping.yml file.  I also updated role_mapping.yml file with the LDAP informaiton. I followed the instructions here: <a href="https://www.elastic.co/guide/en/elasticsearch/reference/7.10/ldap-realm.html" rel="nofollow noreferrer">https://www.elastic.co/guide/en/elasticsearch/reference/7.10/ldap-realm.html</a></p>
<p>Now when I restart the elasticsearch container I get the following error then the container halts:</p>
<pre><code>uncaught exception in thread [main]    
java.lang.IllegalStateException: security initialization failed
Likely root cause: java.security.AccessControlException: access denied (&quot;java.io.FilePermission&quot; &quot;/role_mapping.yml&quot; &quot;read&quot;)
at java.base/java.security.AccessControlContext.checkPermission(AccessControlContext.java:472)
at java.base/java.security.AccessController.checkPermission(AccessController.java:1036)
at java.base/java.lang.SecurityManager.checkPermission(SecurityManager.java:408)
at java.base/java.lang.SecurityManager.checkRead(SecurityManager.java:747)
at java.base/sun.nio.fs.UnixPath.checkRead(UnixPath.java:810)
at java.base/sun.nio.fs.UnixFileSystemProvider.exists(UnixFileSystemProvider.java:524)
at java.base/java.nio.file.Files.exists(Files.java:2514)
at org.elasticsearch.xpack.core.XPackPlugin.resolveConfigFile(XPackPlugin.java:361)
at org.elasticsearch.xpack.security.authc.support.DnRoleMapper.resolveFile(DnRoleMapper.java:86)
at org.elasticsearch.xpack.security.authc.support.RoleMappingFileBootstrapCheck.create(RoleMappingFileBootstrapCheck.java:47)
</code></pre>
<p>I overwrote the elasticsearch.yml file by copying a version with the LDAP config commented out so I could start the container.  When I did this I checked the file permissions and both elasticsearch.yml and role_mapping.yml have the same:</p>
<pre><code>-rw-rw---- 1 elasticsearch root  199 Dec  2 15:51 elasticsearch.keystore
-rwxr-xr-x 1 root          root  568 Dec  2 18:36 elasticsearch.yml
-rw-rw---- 1 elasticsearch root 2301 Nov  9 21:28 jvm.options
drwxrwxr-x 2 elasticsearch root 4096 Nov  9 21:32 jvm.options.d
-rw-rw---- 1 elasticsearch root 8451 Nov  9 21:35 log4j2.properties
-rwxr-xr-x 1 elasticsearch root  502 Dec  2 20:15 role_mapping.yml
-rw-rw---- 1 elasticsearch root  197 Dec  2 20:10 roles.yml
-rw-rw---- 1 elasticsearch root    0 Nov  9 21:32 users
-rw-rw---- 1 elasticsearch root    0 Nov  9 21:32 users_roles
</code></pre>
<p>I even tried CHMODing the role_mapping.yml file to 777 but I still get the same result.</p>
<p>I feel like I'm missing something obvious...</p>

<docker><windows><elasticsearch>
Elasticsearch on Docker - file permission issues
Joel
# Elasticsearch on Docker - file permission issues

(Asked by: username_0 on 2020-12-03)

I am trying to test LDAP in elasticsearch/kibana by running it in Docker on Windows 10.
I pulled the image down:
docker pull docker.elastic.co/elasticsearch/elasticsearch:7.10.0

And ran it:
docker run -p 9200:9200 -p 9300:9300 -e "discovery.type=single-node" docker.elastic.co/elasticsearch/elasticsearch:7.10.0

I did the same with Kibana and everything came up as expected.  I then upgraded the elastic licence and started the 30 day trial to get the LDAP features in X-Pack.
I opened a shell to the container and updated the elasticsearch.yml file with my LDAP information and set the path to the role_mapping.yml file.  I also updated role_mapping.yml file with the LDAP informaiton. I followed the instructions here: https://www.elastic.co/guide/en/elasticsearch/reference/7.10/ldap-realm.html
Now when I restart the elasticsearch container I get the following error then the container halts:
uncaught exception in thread [main]    
java.lang.IllegalStateException: security initialization failed
Likely root cause: java.security.AccessControlException: access denied ("java.io.FilePermission" "/role_mapping.yml" "read")
at java.base/java.security.AccessControlContext.checkPermission(AccessControlContext.java:472)
at java.base/java.security.AccessController.checkPermission(AccessController.java:1036)
at java.base/java.lang.SecurityManager.checkPermission(SecurityManager.java:408)
at java.base/java.lang.SecurityManager.checkRead(SecurityManager.java:747)
at java.base/sun.nio.fs.UnixPath.checkRead(UnixPath.java:810)
at java.base/sun.nio.fs.UnixFileSystemProvider.exists(UnixFileSystemProvider.java:524)
at java.base/java.nio.file.Files.exists(Files.java:2514)
at org.elasticsearch.xpack.core.XPackPlugin.resolveConfigFile(XPackPlugin.java:361)
at org.elasticsearch.xpack.security.authc.support.DnRoleMapper.resolveFile(DnRoleMapper.java:86)
at org.elasticsearch.xpack.security.authc.support.RoleMappingFileBootstrapCheck.create(RoleMappingFileBootstrapCheck.java:47)

I overwrote the elasticsearch.yml file by copying a version with the LDAP config commented out so I could start the container.  When I did this I checked the file permissions and both elasticsearch.yml and role_mapping.yml have the same:
-rw-rw---- 1 elasticsearch root  199 Dec  2 15:51 elasticsearch.keystore
-rwxr-xr-x 1 root          root  568 Dec  2 18:36 elasticsearch.yml
-rw-rw---- 1 elasticsearch root 2301 Nov  9 21:28 jvm.options
drwxrwxr-x 2 elasticsearch root 4096 Nov  9 21:32 jvm.options.d
-rw-rw---- 1 elasticsearch root 8451 Nov  9 21:35 log4j2.properties
-rwxr-xr-x 1 elasticsearch root  502 Dec  2 20:15 role_mapping.yml
-rw-rw---- 1 elasticsearch root  197 Dec  2 20:10 roles.yml
-rw-rw---- 1 elasticsearch root    0 Nov  9 21:32 users
-rw-rw---- 1 elasticsearch root    0 Nov  9 21:32 users_roles

I even tried CHMODing the role_mapping.yml file to 777 but I still get the same result.
I feel like I'm missing something obvious...

**Tags:** docker, windows, elasticsearch


---

## 1 answers

### Answer by username_0 on 2020-12-03. Score: 1 | Accepted answer

I have discovered the issue, the path to the role\_mapping.yml file was incorrect in elaticsearch.yml. I had to use the full path /usr/share/elasticsearch/config/role\_mapping.yml


---

