topic Creating a role that can read every app in Security

Creating a role that can read every app

Ricapar — Mon, 29 Apr 2013 18:47:49 GMT

I'm setting up my roles like this:

== Global Roles ==

Admin Role
Manager Role
Users

== App Specific Roles ==

AppName_R
AppName_RW
AppName2_R
AppName2_RW

... etc ... You get the idea.

I have everything nicely set up for the Admin role and for the app specific roles. All of the app roles inherit from the "users" role and inherit basic permissions from there.

Admin Role is the default admin role that comes with Splunk.

Each app is configured with only three checkboxes checked on the permissions page:

Role           Read   Write
AppName_R        X  
AppName_RW       X      X

Like so.

This works great, since it makes setting permissions for new apps nice and easy, and is obvious to users who can do what.

Admins can automatically read and write to everything, even if permissions aren't explicitly given.

What I'm trying to create for the Manager Role is a user who can automatically read from everything (just like admins), but doesn't have any explicit write permissions.

Re: Creating a role that can read every app

aholzer — Mon, 29 Apr 2013 19:06:55 GMT

Unfortunately I don't think this is possible from the ROLE's perspective. You would have to create a new role, then manually go through the permissions of each app and grant "read only" permissions to the new role (you can do this from the "Manager > apps" Interface)

Re: Creating a role that can read every app

Ricapar — Mon, 29 Apr 2013 19:28:51 GMT

That's what I was hoping to avoid 😞

Re: Creating a role that can read every app

yannK — Fri, 03 May 2013 15:58:05 GMT

What about role inheritance ?

Re: Creating a role that can read every app

chris — Fri, 03 May 2013 22:18:10 GMT

You could setup, a Manager Role that inherits from every AppName_R role. aholzer's suggestion works as well but you can loop through the metadata/default.meta on the filesystem and add the additional role to the read stanza.

Re: Creating a role that can read every app

Ricapar — Mon, 13 May 2013 18:15:16 GMT

I ended up solving this using @yannK's and @chris's suggestion.

I created a role that we will manually set to inherit from every AppName_R role. We added the extra step to our (currently manual) application role setup procedure. I would've preferred something a bit more automated, but one extra step isn't a dealbreaker.