multiple indexes role-based access control

myli12 — Sat, 05 Feb 2011 07:03:42 GMT

I want to limit some users to view and search only certain data. I used multiple indexes access control.

In the "authorize.conf" which located in "\Splunk\etc\system\local", it reads

[role_c5viewer]
importRoles = user
rtSrchJobsQuota = 0
rtsearch = enabled
srchDiskQuota = 0
srchIndexesAllowed = c5only
srchIndexesDefault = c5only
srchJobsQuota = 0

If I logged as one user assigned role "c5viewer," I can only see data indexed by c5only in the search summary page. But If I put

index="r2only"

in the search bar, I can still retrieve data indexed by r2only (a different index). The results come with all the data indexed by "r2only"

Any thoughts how to enforce access control, i.e., prevent c5viewer to see data indexed by r2only? Did I put authorize.conf in the right directory?

Re: multiple indexes role-based access control

Ron_Naken — Sat, 05 Feb 2011 07:16:42 GMT

Judging by your "importRoles=user" statement, it looks like the c5viewer role is inheriting indexes from the user role.

You should add the following to your $SPLUNK_HOME/etc/system/local/authorize.conf:

[role_user]
srchIndexesAllowed =

By not having an entry for the user role in your file, it grants default access to all non-internal indexes. Adding this stanza is a safer method than simply removing your "importRoles=user" statement.

For future reference, you can go to Manager-->Access Controls-->Roles to manage these properties in the UI, rather than build the file by hand.

topic multiple indexes role-based access control in Security

multiple indexes role-based access control

Re: multiple indexes role-based access control