# With xpack security enabled i can't run a custom plugin - what should change in that plugin?
**URL:** https://discuss.elastic.co/t/with-xpack-security-enabled-i-cant-run-a-custom-plugin-what-should-change-in-that-plugin/295083
**Category:** Elasticsearch
**Tags:** elastic-stack-security
**Created:** [January 21, 2022, 3:50pm UTC](https://discuss.elastic.co/t/with-xpack-security-enabled-i-cant-run-a-custom-plugin-what-should-change-in-that-plugin/295083 "2022-01-21T15:50:01Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@LucaL](https://discuss.elastic.co/u/LucaL)
#### Post date: [January 21, 2022, 3:50pm UTC](https://discuss.elastic.co/t/with-xpack-security-enabled-i-cant-run-a-custom-plugin-what-should-change-in-that-plugin/295083/1 "2022-01-21T15:50:01Z")
Hello,
dev sent me a plugin to install on Elasticsearch installed via Elastic Stack Operator on Kubernetes with all security features enabled (authentication, https, etc.).
What happens is that plugin, previously working on Elasticsearch with no security options enabled, dumps this error:
```auto
org.elasticsearch.ElasticsearchSecurityException: action [indices:data/write/index] is unauthorized for user [_system]
```
I found out here [Missing right to write transient cluster settings in custom plugin · Issue #46127 · elastic/elasticsearch · GitHub](https://github.com/elastic/elasticsearch/issues/46127) that \_system is the user that executes plugins and has minimal privileges. But i can't find out any documentation anywhere that states how plugins should handle this security features and how to change the plugin's code to fit the security constraints.
Is there any documentation available? @TimV says there are other mechanism to do this, but are these explained somewhere?
Luca
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 18, 2022, 3:50pm UTC](https://discuss.elastic.co/t/with-xpack-security-enabled-i-cant-run-a-custom-plugin-what-should-change-in-that-plugin/295083/2 "2022-02-18T15:50:06Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.