# Error securityadmin.sh execution

**URL:** <https://forum.opensearch.org/t/error-securityadmin-sh-execution/20461>\
**Category:** Security\
**Created:** [July 22, 2024, 9:02pm UTC](https://forum.opensearch.org/t/error-securityadmin-sh-execution/20461 "2024-07-22T21:02:42Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![panta](https://avatars.discourse-cdn.com/v4/letter/p/94ad74/32.png) [@panta](https://forum.opensearch.org/u/panta)\
**Post date:** [July 22, 2024, 9:02pm UTC](https://forum.opensearch.org/t/error-securityadmin-sh-execution/20461/1 "2024-07-22T21:02:42Z")

</div>

**Versions** (relevant - OpenSearch/Dashboard/Server OS/Browser):  
2.14.0

**Describe the issue** :

```auto
plugins/opensearch-security/tools/securityadmin.sh -cd config/opensearch-security/ -cacert config/certificates/ca.pem -key config/certificates/hostkey.pem -cert config/certificates/hostcert.pem -h vulcan.jlab.org
**************************************************************************
 **This tool will be deprecated in the next major release of OpenSearch**
 **https://github.com/opensearch-project/security/issues/1755**
 **************************************************************************
Security Admin v7
Will connect to vulcan.jlab.org:9200 ... done
Connected as "CN=vulcan.jlab.org,O=Thomas Jefferson National Accelerator Facility,ST=Virginia,C=US,DC=incommon,DC=org"
ERR: "CN=vulcan.jlab.org,O=Thomas Jefferson National Accelerator Facility,ST=Virginia,C=US,DC=incommon,DC=org" is not an admin user
Seems you use a client certificate but this one is not registered as admin_dn
Make sure opensearch.yml on all nodes contains:
plugins.security.authcz.admin_dn:
  - ""CN=vulcan.jlab.org,O=Thomas Jefferson National Accelerator Facility,ST=Virginia,C=US,DC=incommon,DC=org""

```

**Configuration** :  
opensearch.yml

```auto
cluster.name: "opensearch-cluster"
node.name: "opensearch-node1"
network.host: 0.0.0.0
http.port: 9200
discovery.seed_hosts: ["opensearch-node1"] #, "opensearch-node2"]
cluster.initial_master_nodes: ["opensearch-node1"] #, "opensearch-node2"]

# Security settings
plugins.security.ssl.transport.pemcert_filepath: certificates/hostcert.pem
plugins.security.ssl.transport.pemkey_filepath: certificates/hostkey.pem
plugins.security.ssl.transport.pemtrustedcas_filepath: certificates/ca.pem
plugins.security.ssl.http.enabled: true
plugins.security.ssl.http.pemcert_filepath: certificates/hostcert.pem
plugins.security.ssl.http.pemkey_filepath: certificates/hostkey.pem
plugins.security.ssl.http.pemtrustedcas_filepath: certificates/ca.pem

plugins.security.allow_default_init_securityindex: true
plugins.security.authcz.admin_dn:
  - DC=org,DC=incommon,C=US,ST=Virginia,O=Thomas Jefferson National Accelerator Facility,CN=vulcan.jlab.org

plugins.security.nodes_dn:
  - 'DC = org, DC = incommon, C = US, ST = Virginia, O = Thomas Jefferson National Accelerator Facility, CN = vulcan.jlab.org'

plugins.security.audit.type: internal_opensearch
plugins.security.enable_snapshot_restore_privilege: true
plugins.security.check_snapshot_restore_write_privileges: true
plugins.security.restapi.roles_enabled: ["all_access", "security_rest_api_access"]
cluster.routing.allocation.disk.threshold_enabled: false
opendistro_security.audit.config.disabled_rest_categories: NONE
opendistro_security.audit.config.disabled_transport_categories: NONE

```

**Relevant Logs or Screenshots** :

---

<div class="post-metadata">

**Author:** ![Eugene7](https://avatars.discourse-cdn.com/v4/letter/e/bbce88/32.png) [@Eugene7](https://forum.opensearch.org/u/Eugene7)\
**Post date:** [July 23, 2024, 9:00am UTC](https://forum.opensearch.org/t/error-securityadmin-sh-execution/20461/2 "2024-07-23T09:00:33Z")

</div>

Hi @panta ,

Have you restarted your cluster after making changes to `opensearch.yml` ? How many OpenSearch nodes do you have?

---

<div class="post-metadata">

**Author:** ![panta](https://avatars.discourse-cdn.com/v4/letter/p/94ad74/32.png) [@panta](https://forum.opensearch.org/u/panta)\
**Post date:** [July 23, 2024, 1:30pm UTC](https://forum.opensearch.org/t/error-securityadmin-sh-execution/20461/3 "2024-07-23T13:30:37Z")

</div>

Hi Eugene,  
Its seems the admin\_dn has to be written in exact order the securityadmin.sh shows.  
So I made the changes as:

```auto
plugins.security.authcz.admin_dn:
  - CN=vulcan.jlab.org,O=Thomas Jefferson National Accelerator Facility,ST=Virginia,C=US,DC=incommon,DC=org

```

It is working now.