topic Re: Minimal user capabilities for generating PDF email report? in Security

Minimal user capabilities for generating PDF email report?

gljiva — Wed, 01 Sep 2010 16:33:47 GMT

Hi, I've noticed that I have to add admin_all_object to be able to receive PDF report. If i remove that capability I get

"An error occurred while generating a PDF of this report: Failed to contact appserver at https://server:8000/en-US/report/: HTTP Error 500: Internal Server Error"

Problem is that I would like to give users as little privileges as possible, and when I enable all capabilities that I managed to isolate for proper PDF reporting, users can change apps and some other stuff. Is there a way to check what are minimal capabilities necessary for some action to work (like PDF reporting)? Is there some other workaround for enabling users to add PDF reports but minimize their capabilities?

thx

Re: Minimal user capabilities for generating PDF email report?

Genti — Sun, 03 Oct 2010 00:25:43 GMT

currently PDF sent through emails can only be done by the admin user. This should change in the next few releases.

Re: Minimal user capabilities for generating PDF email report?

rtclark — Tue, 01 Mar 2011 08:51:18 GMT

This was fixed in 4.1.6:

"PDF printing is limited to only the admin user. (SPL-33953)"

http://www.splunk.com/base/Documentation/latest/ReleaseNotes/4.1.6

I just got back to troubleshooting this issue in my environment, and to my surprise the 500 error was no longer reproducible. I found this question and went searching to make sure that this was indeed the magic that had fixed the issue.

-rtc