topic Re: user with multiple roles in Security

user with multiple roles

harald_leitl — Wed, 28 Nov 2012 10:17:55 GMT

Hi,
I got following behavior.

An ldap user is member of two roles. (role A = ldap groupA & role B = ldap groupB)

role A has properties set to srchIndexesAllowed = index1;index2;index3
role B has properties set to srchIndexesAllowed = index2;index4;index5

When searching for index=* the user only sees indexes from role A (index1;index2;index3).

In Splunk manager the user has both roles assigned.

What am I doing wrong?

we are currently running on 4.3.3.

thx,

harry

MuS — Wed, 28 Nov 2012 14:57:11 GMT

Hi harald_leitl

have a look at this answer, where you can find some basic ldap troubleshooting tips.

cheers,

Mus

harald_leitl — Wed, 28 Nov 2012 16:02:15 GMT

I don't think I have a problem with authentication and ldap.

In splunk manager I see that both splunk roles are assigned to the user.

However, it seems the user only gets capabilities of role 'A'.

harald_leitl — Wed, 28 Nov 2012 16:02:36 GMT

As explained above, role 'A' is allowed to search through index1;index2;index3 and role 'B' is allowed to search through index2;index4;index5.

I thought, if I assign both roles the user would be capable of searching through index1;index2;index3;index4 and index5.

my search to verify the result:

index=*

The result I got:
Only events from index1;index2;index3 were included in the result.

The result I was looking for:
events from index1;index2;index3;index4 and index5 are shown

harald_leitl — Fri, 30 Nov 2012 15:06:17 GMT

The problem was caused by a search filter set on role 'A' in authorize.conf.

thx