# Securityadmin.sh fails to update cluster config when using kirk certificates

**URL:** <https://forum.opensearch.org/t/securityadmin-sh-fails-to-update-cluster-config-when-using-kirk-certificates/784>\
**Category:** Security\
**Created:** [May 30, 2019, 12:21am UTC](https://forum.opensearch.org/t/securityadmin-sh-fails-to-update-cluster-config-when-using-kirk-certificates/784 "2019-05-30T00:21:29Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![mud5150](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.opensearch.org/mud5150/32/409_2.png) [@mud5150](https://forum.opensearch.org/u/mud5150)\
**Post date:** [October 17, 2019, 3:42pm UTC](https://forum.opensearch.org/t/securityadmin-sh-fails-to-update-cluster-config-when-using-kirk-certificates/784/4 "2019-10-17T15:42:07Z")

</div>

I found the issue. It was the lack of setting `opendistro_security.restapi.roles_enabled` which sets which roles can access the security api. Same as [here](https://forum.opensearch.org/t/resolved-security-page-is-not-showing-right/768/7).

I set it to the _default_ for now as indicated in the [sample config](https://opendistro.github.io/for-elasticsearch-docs/docs/elasticsearch/configuration/#sample-configuration-file). Detailed info about the security api can be found [here](https://opendistro.github.io/for-elasticsearch-docs/docs/security-access-control/api/#access-control-for-the-api).

---

_[View the full topic](https://forum.opensearch.org/t/securityadmin-sh-fails-to-update-cluster-config-when-using-kirk-certificates/784)._