Answers: <p>I have discovered the issue, the path to the role_mapping.yml file was incorrect in elaticsearch.yml. I had to use the full path /usr/share/elasticsearch/config/role_mapping.yml</p>
  
Answers: CC BY-SA 4.0
Answers: 2020-12-03T14:50:05.913Z
Answers: 2020-12-03T14:50:05.913Z
Answers: Joel
Body: <p>I am trying to test LDAP in elasticsearch/kibana by running it in Docker on Windows 10.</p>
  <p>I pulled the image down:</p>
  <pre><code>docker pull docker.elastic.co/elasticsearch/elasticsearch:7.10.0
  </code></pre>
  <p>And ran it:</p>
  <pre><code>docker run -p 9200:9200 -p 9300:9300 -e &quot;discovery.type=single-node&quot; docker.elastic.co/elasticsearch/elasticsearch:7.10.0
  </code></pre>
  <p>I did the same with Kibana and everything came up as expected.  I then upgraded the elastic licence and started the 30 day trial to get the LDAP features in X-Pack.</p>
  <p>I opened a shell to the container and updated the elasticsearch.yml file with my LDAP information and set the path to the role_mapping.yml file.  I also updated role_mapping.yml file with the LDAP informaiton. I followed the instructions here: <a href="https://www.elastic.co/guide/en/elasticsearch/reference/7.10/ldap-realm.html" rel="nofollow noreferrer">https://www.elastic.co/guide/en/elasticsearch/reference/7.10/ldap-realm.html</a></p>
  <p>Now when I restart the elasticsearch container I get the following error then the container halts:</p>
  <pre><code>uncaught exception in thread [main]    
  java.lang.IllegalStateException: security initialization failed
  Likely root cause: java.security.AccessControlException: access denied (&quot;java.io.FilePermission&quot; &quot;/role_mapping.yml&quot; &quot;read&quot;)
  at java.base/java.security.AccessControlContext.checkPermission(AccessControlContext.java:472)
  at java.base/java.security.AccessController.checkPermission(AccessController.java:1036)
  at java.base/java.lang.SecurityManager.checkPermission(SecurityManager.java:408)
  at java.base/java.lang.SecurityManager.checkRead(SecurityManager.java:747)
  at java.base/sun.nio.fs.UnixPath.checkRead(UnixPath.java:810)
  at java.base/sun.nio.fs.UnixFileSystemProvider.exists(UnixFileSystemProvider.java:524)
  at java.base/java.nio.file.Files.exists(Files.java:2514)
  at org.elasticsearch.xpack.core.XPackPlugin.resolveConfigFile(XPackPlugin.java:361)
  at org.elasticsearch.xpack.security.authc.support.DnRoleMapper.resolveFile(DnRoleMapper.java:86)
  at org.elasticsearch.xpack.security.authc.support.RoleMappingFileBootstrapCheck.create(RoleMappingFileBootstrapCheck.java:47)
  </code></pre>
  <p>I overwrote the elasticsearch.yml file by copying a version with the LDAP config commented out so I could start the container.  When I did this I checked the file permissions and both elasticsearch.yml and role_mapping.yml have the same:</p>
  <pre><code>-rw-rw---- 1 elasticsearch root  199 Dec  2 15:51 elasticsearch.keystore
  -rwxr-xr-x 1 root          root  568 Dec  2 18:36 elasticsearch.yml
  -rw-rw---- 1 elasticsearch root 2301 Nov  9 21:28 jvm.options
  drwxrwxr-x 2 elasticsearch root 4096 Nov  9 21:32 jvm.options.d
  -rw-rw---- 1 elasticsearch root 8451 Nov  9 21:35 log4j2.properties
  -rwxr-xr-x 1 elasticsearch root  502 Dec  2 20:15 role_mapping.yml
  -rw-rw---- 1 elasticsearch root  197 Dec  2 20:10 roles.yml
  -rw-rw---- 1 elasticsearch root    0 Nov  9 21:32 users
  -rw-rw---- 1 elasticsearch root    0 Nov  9 21:32 users_roles
  </code></pre>
  <p>I even tried CHMODing the role_mapping.yml file to 777 but I still get the same result.</p>
  <p>I feel like I'm missing something obvious...</p>
  
Tags: <docker><windows><elasticsearch>
Title: Elasticsearch on Docker - file permission issues
UserDisplayName: Joel
ThreadText: # Elasticsearch on Docker - file permission issues
  
  (Asked by: username_0 on 2020-12-03)
  
  I am trying to test LDAP in elasticsearch/kibana by running it in Docker on Windows 10.
  
  I pulled the image down:
  
  ```
  docker pull docker.elastic.co/elasticsearch/elasticsearch:7.10.0
  
  ```
  
  And ran it:
  
  ```
  docker run -p 9200:9200 -p 9300:9300 -e "discovery.type=single-node" docker.elastic.co/elasticsearch/elasticsearch:7.10.0
  
  ```
  
  I did the same with Kibana and everything came up as expected. I then upgraded the elastic licence and started the 30 day trial to get the LDAP features in X-Pack.
  
  I opened a shell to the container and updated the elasticsearch.yml file with my LDAP information and set the path to the role\_mapping.yml file. I also updated role\_mapping.yml file with the LDAP informaiton. I followed the instructions here: <https://www.elastic.co/guide/en/elasticsearch/reference/7.10/ldap-realm.html>
  
  Now when I restart the elasticsearch container I get the following error then the container halts:
  
  ```
  uncaught exception in thread [main]    
  java.lang.IllegalStateException: security initialization failed
  Likely root cause: java.security.AccessControlException: access denied ("java.io.FilePermission" "/role_mapping.yml" "read")
  at java.base/java.security.AccessControlContext.checkPermission(AccessControlContext.java:472)
  at java.base/java.security.AccessController.checkPermission(AccessController.java:1036)
  at java.base/java.lang.SecurityManager.checkPermission(SecurityManager.java:408)
  at java.base/java.lang.SecurityManager.checkRead(SecurityManager.java:747)
  at java.base/sun.nio.fs.UnixPath.checkRead(UnixPath.java:810)
  at java.base/sun.nio.fs.UnixFileSystemProvider.exists(UnixFileSystemProvider.java:524)
  at java.base/java.nio.file.Files.exists(Files.java:2514)
  at org.elasticsearch.xpack.core.XPackPlugin.resolveConfigFile(XPackPlugin.java:361)
  at org.elasticsearch.xpack.security.authc.support.DnRoleMapper.resolveFile(DnRoleMapper.java:86)
  at org.elasticsearch.xpack.security.authc.support.RoleMappingFileBootstrapCheck.create(RoleMappingFileBootstrapCheck.java:47)
  
  ```
  
  I overwrote the elasticsearch.yml file by copying a version with the LDAP config commented out so I could start the container. When I did this I checked the file permissions and both elasticsearch.yml and role\_mapping.yml have the same:
  
  ```
  -rw-rw---- 1 elasticsearch root  199 Dec  2 15:51 elasticsearch.keystore
  -rwxr-xr-x 1 root          root  568 Dec  2 18:36 elasticsearch.yml
  -rw-rw---- 1 elasticsearch root 2301 Nov  9 21:28 jvm.options
  drwxrwxr-x 2 elasticsearch root 4096 Nov  9 21:32 jvm.options.d
  -rw-rw---- 1 elasticsearch root 8451 Nov  9 21:35 log4j2.properties
  -rwxr-xr-x 1 elasticsearch root  502 Dec  2 20:15 role_mapping.yml
  -rw-rw---- 1 elasticsearch root  197 Dec  2 20:10 roles.yml
  -rw-rw---- 1 elasticsearch root    0 Nov  9 21:32 users
  -rw-rw---- 1 elasticsearch root    0 Nov  9 21:32 users_roles
  
  ```
  
  I even tried CHMODing the role\_mapping.yml file to 777 but I still get the same result.
  
  I feel like I'm missing something obvious...
  
  **Tags:** docker, windows, elasticsearch
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2020-12-03. Score: 1 | Accepted answer
  
  I have discovered the issue, the path to the role\_mapping.yml file was incorrect in elaticsearch.yml. I had to use the full path /usr/share/elasticsearch/config/role\_mapping.yml
  
  
  ---
  
  