# Partial /etc/wazuh-indexer/opensearch-security/roles_mapping.yml
#
# Source (structure and field meanings):
# https://documentation.wazuh.com/5.0-beta/user-manual/wazuh-indexer/security.html
# Administrator mapping example from the Entra ID and LDAP guides.
#
# FRAGMENT. Merge into the existing file.
#
# ONE identity-provider group per role. The single sign-on documentation is
# explicit: each group generated in the IdP can only be used as one backend
# role. Administrator and read-only access need two separate groups.
#
# Values are case-sensitive on both sides. The string here must match the
# assertion exactly.

# Administrators. Maps an IdP group straight onto the built-in all_access role.
# Use sparingly: all_access is the whole cluster.
all_access:
  hosts: []
  users: []
  reserved: false
  hidden: false
  backend_roles:
    - "Wazuh_role"        # Entra ID app role Value
    - "wazuh-admins"      # Okta group name / AD group CN
  and_backend_roles: []
  description: "Maps admin to all_access"

# Read-only viewers. Maps an IdP group onto a custom role created from the
# documented read-only recipe (see role-readonly.json in this folder).
wazuh_viewer:
  hosts: []
  users: []
  reserved: false
  hidden: false
  backend_roles:
    - "wazuh-readonly"
  and_backend_roles: []
  description: "Read-only access to Wazuh data"

# SOC analysts. Maps an IdP group onto a custom analyst role
# (see role-analyst.json in this folder).
wazuh_analyst:
  hosts: []
  users: []
  reserved: false
  hidden: false
  backend_roles:
    - "wazuh-analysts"
  and_backend_roles: []
  description: "Read Wazuh data plus alert and report workflow"

# Load it:
#   export JAVA_HOME=/usr/share/wazuh-indexer/jdk/ && \
#   bash /usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh \
#     -f /etc/wazuh-indexer/opensearch-security/roles_mapping.yml \
#     -icl \
#     -key /etc/wazuh-indexer/certs/admin-key.pem \
#     -cert /etc/wazuh-indexer/certs/admin.pem \
#     -cacert /etc/wazuh-indexer/certs/root-ca.pem \
#     -h localhost -nhnv
#
# A matching mapping is ALSO needed on the Wazuh side, under
# Server management > Security > Roles mapping, with:
#   User field: backend_roles, Search operation: FIND, Value: the same string.
# It has no effect unless run_as: true in
# /etc/wazuh-dashboard/opensearch_dashboards.yml.