# Kibana not starting after making service account changes for upgrade to 8
**URL:** https://discuss.elastic.co/t/kibana-not-starting-after-making-service-account-changes-for-upgrade-to-8/297406
**Category:** Kibana
**Tags:** elastic-stack-security
**Created:** [February 16, 2022, 6:49pm UTC](https://discuss.elastic.co/t/kibana-not-starting-after-making-service-account-changes-for-upgrade-to-8/297406 "2022-02-16T18:49:20Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@gentle\_ghost](https://discuss.elastic.co/u/gentle_ghost)
#### Post date: [February 16, 2022, 6:49pm UTC](https://discuss.elastic.co/t/kibana-not-starting-after-making-service-account-changes-for-upgrade-to-8/297406/1 "2022-02-16T18:49:20Z")
Hello,
Running into an issue upgrading to elasticsearch/kibana 8. The upgrade assistant had me switch from username/password authentication to service accounts via: [https://www.elastic.co/guide/en/elasticsearch//reference/current/service-accounts.html](https://www.elastic.co/guide/en/elasticsearch//reference/current/service-accounts.html)
I've gone through the process of setting up my service token for elastic/kibana on the node (server\_1) that also has kibana and added to my kibana.yml. I'm running into this error:
> [server\_2] Authentication of [elastic] was terminated by realm [reserved] - failed to authenticate user [elastic]
As well as this one which suggests a conflict with the default authentication and this new service account:
> FATAL Error: [config validation of [elasticsearch].serviceAccountToken]: serviceAccountToken cannot be specified when "username" is also set.
do I need to create a service token on elasticsearch node then add that entry to the kibana.yml file. Something like this:
```auto
elasticsearch.serviceAccountToken: token_for_server_1
elasticsearch.serviceAccountToken: token_for_server_2
elasticsearch.serviceAccountToken: token_for_server_3
```
Any help is appreciated.
---
### Author:  [@Justin\_Cranford](https://discuss.elastic.co/u/Justin_Cranford)
#### Post date: [February 16, 2022, 8:29pm UTC](https://discuss.elastic.co/t/kibana-not-starting-after-making-service-account-changes-for-upgrade-to-8/297406/2 "2022-02-16T20:29:56Z")
Hello,
I looked at the Kibana 8.0 configuration doc page. It seems like Kibana has only one elasticsearch.serviceAccountToken setting. Also, it seems like that setting can't be mixed with elasticsearch.username and elasticsearch.password. Is it possible your configuration has both types of settings?
In general, I think your Kibana node expects to use one service token to connect to all Elasticsearch nodes in a cluster. Is the same service token configured in both Elasticsearch nodes?
Here is the link where I found that information, in case it helps.
> **[Configure Kibana | Kibana Guide \[8.11\] | Elastic](https://www.elastic.co/guide/en/kibana/current/settings.html)**
Here is the specific excerpt I read.
> If your Elasticsearch is protected with basic authentication, this token provides the credentials that the Kibana server uses to perform maintenance on the Kibana index at startup. This setting is an alternative to `elasticsearch.username` and `elasticsearch.password` .
---
### Author:  [@gentle\_ghost](https://discuss.elastic.co/u/gentle_ghost)
#### Post date: [February 16, 2022, 9:34pm UTC](https://discuss.elastic.co/t/kibana-not-starting-after-making-service-account-changes-for-upgrade-to-8/297406/3 "2022-02-16T21:34:52Z")
That would probably the reason for the error. The other node is not setup with the service account. But how do you set the same token key across the cluster? Its a randomly generated key when you run the `elasticsearch-service-tokens` cli utility. I don't see a way to copy that token across other nodes: [Service accounts | Elasticsearch Guide [8.0] | Elastic](https://www.elastic.co/guide/en/elasticsearch//reference/current/service-accounts.html)
Thanks
---
### Author:  [@Justin\_Cranford](https://discuss.elastic.co/u/Justin_Cranford)
#### Post date: [February 16, 2022, 10:05pm UTC](https://discuss.elastic.co/t/kibana-not-starting-after-making-service-account-changes-for-upgrade-to-8/297406/4 "2022-02-16T22:05:00Z")
The CLI creates a service token in a file, which is not replicated.
The API creates a service token in an index, which is replicated.
The URL method and path are of the form:
`POST /_security/service///credential/token/`
Perhaps one of these curl examples would work:
`$ curl -s -X POST -u elastic:PASSWORD "ADDRESS:9200/_security/service/elastic/kibana/credential/token/token1"`
`$ curl -s -X POST -H 'Authorization: Bearer TOKEN' "ADDRESS:9200/_security/service/elastic/kibana/credential/token/token1"`
Here is a link to the doc page if that is helpful.
- [Create service account token API | Elasticsearch Guide [8.0] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/security-api-create-service-token.html)
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [February 17, 2022, 1:14am UTC](https://discuss.elastic.co/t/kibana-not-starting-after-making-service-account-changes-for-upgrade-to-8/297406/5 "2022-02-17T01:14:02Z")
Unfortunately, the Kibana UI incorrectly recommends using the CLI to setup service tokens.
That has been fixed in an upcoming release
- [[7.17] Change deprecation warning for elasticsearch.username by jportner · Pull Request #124717 · elastic/kibana · GitHub](https://github.com/elastic/kibana/pull/124717)
---
### Author:  [@TimV](https://discuss.elastic.co/u/TimV)
#### Post date: [February 17, 2022, 1:14am UTC](https://discuss.elastic.co/t/kibana-not-starting-after-making-service-account-changes-for-upgrade-to-8/297406/6 "2022-02-17T01:14:58Z")
We're also working on improving the Elasticsearch docs around this
- [Clarify the intended usage of service-tokens CLI · Issue #83491 · elastic/elasticsearch · GitHub](https://github.com/elastic/elasticsearch/issues/83491)
---
### Author:  [@gentle\_ghost](https://discuss.elastic.co/u/gentle_ghost)
#### Post date: [February 21, 2022, 3:49pm UTC](https://discuss.elastic.co/t/kibana-not-starting-after-making-service-account-changes-for-upgrade-to-8/297406/7 "2022-02-21T15:49:20Z")
Thanks that solved the issue!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 21, 2022, 3:49pm UTC](https://discuss.elastic.co/t/kibana-not-starting-after-making-service-account-changes-for-upgrade-to-8/297406/8 "2022-03-21T15:49:34Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.