Issue with SAML configuration

Hi all, my issue is not properly related to SAML configuration. We have a search head cluster where we are trying to enable SAML authentication instead of LDAP simple authentication. I'm using a different user of admin, but with more power. When i try to enable SAML, i receive a "User xxxx must have change_authentication capability" and then i can't access splunk anymore!!!! Strange thing is that user has change_authentication capability. Any idea? Thank you in advance