topic Re: Index Based RBAC not working in Security

Why is Index Based RBAC not working?

HaydenMc — Tue, 16 Aug 2022 13:05:02 GMT

Hey all,

Working on creating some access control based on indices and running into a weird issue. When I create a custom role and grant this role all capabilities (with no role inheritance) to the specified index, I'm not able to search data inside that index. However if I create said custom role inheriting the user role, but with the exact same capabilities it then it lets me search.

I've also cloned the user role and appended the index permissions to suit my needs but experiencing the exact same issue, the cloned role has no access to the allowed indices but the second I inherit the user role it seems to work again.

This behaviour is only found on our dedicated search heads. When I enable the web ui and replicate on indexers it works as expected with the custom role searching assigned indices.

Splunk Enterprise Version: 9.0.0.1

Any help would be appreciated!!!

Thanks guys

Re: Index Based RBAC not working

gcusello — Tue, 16 Aug 2022 07:20:46 GMT

Hi @HaydenMc,

are you sure that flagged the "Included" box option for your index in the Role definition page?

Ciao.

Giuseppe

Re: Index Based RBAC not working

HaydenMc — Tue, 16 Aug 2022 23:11:17 GMT

Hi @gcusello,

Thanks for the reply. Yes can confirm the included box has been ticked. Just for testing I've cloned the out of box user role with everything including the accessible indexes and I am experiencing the exact same issue. Any user assigned this cloned role has no access, but any user assigned the user role (the role that I cloned), it works as expected. It's almost like the out of the box user role is somehow different to the cloned role I've created.

Thanks

Re: Index Based RBAC not working

gcusello — Wed, 17 Aug 2022 07:15:57 GMT

Hi @HaydenMc,

As I said, I never experienced this behavior and I used this feature many times but never with the last Splunk Version.

I hint to open a ticket to Splunk Support, it could be a bug.

Ciao.

Giuseppe

Re: Index Based RBAC not working

isoutamo — Wed, 17 Aug 2022 20:27:17 GMT

Those access issues are quite hard to solve with GUI. I usually use some separate app which can told how splunk has expanded those roles. Here is one which you could install and test in your (test) environment https://splunkbase.splunk.com/app/4111/#/details

r. Ismo