topic Re: Role Capability to Query Lookup in Security

Role Capability to Query Lookup

dglass0215 — Fri, 19 Mar 2021 15:48:23 GMT

Hello,

I am trying to figure out which Role Capability controls being able to use a lookup in a query. If I select all the capabilities then the role certainly can query a lookup. However if I select only the capabilities that I want the role to have, they lose the ability to query the lookup. Looking at the documentation (https://docs.splunk.com/Documentation/Splunk/8.1.2/Security/Rolesandcapabilities) it does not specify which capability allows for the querying of a lookup.

Thanks!

David

Re: Role Capability to Query Lookup

Vardhan — Fri, 19 Mar 2021 15:53:03 GMT

HI @dglass0215 ,

It depends on what permission you will give to the lookup file. If you give only admin and power user roles to read and write the lookup. Then the user needs a power user role to access the lookup files.

But if you give read access for everyone. Then user role will be sufficient to access the lookup in the query.

Re: Role Capability to Query Lookup

dglass0215 — Fri, 19 Mar 2021 16:07:58 GMT

The lookup has Read permission for Everyone (including the custom Role I am having issues with).

Thanks!

David

Re: Role Capability to Query Lookup

dglass0215 — Fri, 19 Mar 2021 16:22:05 GMT

I think I found the problem but I do not know the solution. While I have given read permission to the lookup specifically for the custom Role, the role does not have permission to the app that created the lookup. Not sure what I can do. I definitely DO NOT want the role to have access to the app but I need the role to be able to query the lookup.

Thanks!

David

Re: Role Capability to Query Lookup

Vardhan — Fri, 19 Mar 2021 17:15:15 GMT

Hi @dglass0215 ,

Ask someone who has access to that app to provide read permission to your custom role.

Re: Role Capability to Query Lookup

dglass0215 — Fri, 19 Mar 2021 17:19:32 GMT

I am the admin who has access to that app. The issue is that we do NOT want to give read access to the app for new custom role, but we want them to be able to query the Lookup.

Re: Role Capability to Query Lookup

scelikok — Fri, 19 Mar 2021 20:14:57 GMT

So, you should move the lookup to an app that both users have access. Your lookup level permissions will prevent unwanted access.