# How do you define a role for x-pack security in tribe node?

**URL:** <https://discuss.elastic.co/t/how-do-you-define-a-role-for-x-pack-security-in-tribe-node/88658>\
**Category:** Elasticsearch\
**Created:** [June 8, 2017, 5:58am UTC](https://discuss.elastic.co/t/how-do-you-define-a-role-for-x-pack-security-in-tribe-node/88658 "2017-06-08T05:58:55Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![YuWatanabe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuwatanabe/32/13259_2.png) [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)\
**Post date:** [June 8, 2017, 5:58am UTC](https://discuss.elastic.co/t/how-do-you-define-a-role-for-x-pack-security-in-tribe-node/88658/1 "2017-06-08T05:58:56Z")

</div>

As the [document](https://www.elastic.co/guide/en/x-pack/current/tribe-node-configuring.html) suggests, I am setting roles which are same as other clusters.

> When using tribe nodes with secured clusters, all clusters must have X-Pack security enabled and share the same security configuration (users, roles, user-role mappings, SSL/TLS CA). The tribe node itself also must be configured to grant access to actions and indices on all of the connected clusters, as security checks on incoming requests are primarily done on the tribe node itself.

However, Role Management API returns an error.

```
curl -u elastic:changeme -XPUT localhost:9200/_xpack/security/role/read_only -d '{
{
  "indices" : [{
    "names" : ["*-dc1-*", "*-dc2-*", "*-dcyk-*"],
    "privileges" : ["read", "view_index_metadata"]
  }]
}'

```

`{"error" : [ "root_cause" : [["type" : "unsupported_operation_exception", "reason" : "roles may not be created or modified using a tribe node"....`

I believe this is returned tribe node does not have cluster level operation . Do you need to set with [files](https://www.elastic.co/guide/en/x-pack/current/defining-roles.html#roles-management-file) instead for **tribe node**?

---

<div class="post-metadata">

**Author:** ![jetnet](https://avatars.discourse-cdn.com/v4/letter/j/a87d85/32.png) [@jetnet](https://discuss.elastic.co/u/jetnet)\
**Post date:** [June 9, 2017, 6:24am UTC](https://discuss.elastic.co/t/how-do-you-define-a-role-for-x-pack-security-in-tribe-node/88658/2 "2017-06-09T06:24:27Z")

</div>

yes, `roles.yml` works very well. Note: we use the file based roles on all clusters as well.

---

<div class="post-metadata">

**Author:** ![YuWatanabe](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yuwatanabe/32/13259_2.png) [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)\
**Post date:** [June 10, 2017, 8:34am UTC](https://discuss.elastic.co/t/how-do-you-define-a-role-for-x-pack-security-in-tribe-node/88658/3 "2017-06-10T08:34:45Z")

</div>

@jetnet

Okay. Thanks for sharing. I am glad to hear that there are people using tribe node out there!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 8, 2017, 8:35am UTC](https://discuss.elastic.co/t/how-do-you-define-a-role-for-x-pack-security-in-tribe-node/88658/4 "2017-07-08T08:35:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.