Restrict specific users to view only certain panels

horsefez — Tue, 14 Feb 2017 12:47:18 GMT

Hi,

I'm currently trying to restrict specific users from viewing certain panels in search app. Sadly juggling around in /data/ui/views/ and metadata didn't do the trick.

How can I hide certain panels like Pivot, Alerts or Reports from a user via permissions?

Thanks in advance!

Regards,
pyro_wood

Re: Restrict specific users to view only certain panels

gcusello — Tue, 14 Feb 2017 13:24:01 GMT

Hi pyro_wood,
you can restrict (or permit) access to a dashboard, a field or an index, you cannot restrict access to a panel.
So you have two choices:

create two dashboard, one for each role (one with all the panels and the other without the restricted panels), is more laborious to manage (you have to manage two dashboards!) but clearer for users;
use in the restricted panel some elaboration with restrictions (e.g. fields or an eventtype), it's easier to manage (you have only one dashboard) but less beautiful to see!

I suggest the first one!

Bye.
Giuseppe

Re: Restrict specific users to view only certain panels

horsefez — Tue, 14 Feb 2017 15:14:21 GMT

Thank you cusello,
sadly this seems to be correct!

I will try the first option, thanks!

Re: Restrict specific users to view only certain panels

niketn — Mon, 20 Nov 2017 21:08:09 GMT

@pyro_wood, refer to one of my answers on similar lines. It restricts access to any Splunk Dashboard component by first pulling logged in user role through REST API call and then using Simple XML JS extension to restrict access via jQuery Selector.

https://answers.splunk.com/answers/575377/can-i-restrict-permissions-for-the-text-box-drilld.html

In your case since your requirement is to hide panel and not disable, you do not require JavaScript Extension. You should be able to achieve desired results using Simple XML. Please try out the following approach and confirm:

Call REST API to get logged in User Role. Using REST call /services/authentication/current-contex, only if the logged in user has admin role associated, set the access token, else unset the access token.
Add depends attribute with token access to the dashboard element/s to be hidden. In this example <panel depends="$access">

Following is the run anywhere Simple XML code based on REST API and Splunk's _internal index:

<form>
  <label>Hide Panels based on Role</label>
  <search base="baseUserRolesRESTSearch">
    <query>| search NOT roles="admin"
    </query>
    <done>
      <!-- No Results Found - Hence admin role is attached with logged in user enable text box-->
      <condition match="$job.resultCount$==0">
        <set token="access">enabled</set>
      </condition>
      <!-- Hence admin role is not attached with logged in user -->
      <condition>
        <unset token="access"></unset>
      </condition>
    </done>
  </search>
  <fieldset submitButton="false">
    <input id="time1" type="time" token="tokTime" searchWhenChanged="true">
      <label>Select Time Range</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>
  </fieldset>
  <row>
    <panel>
      <single>
        <title>$env:user$ Access based on role: $access$</title>
        <search id="baseUserRolesRESTSearch">
          <query>| rest splunk_server=local /services/authentication/current-context 
       | table roles
           </query>
        </search>
        <option name="underLabel">Logged in user ( $env:user$ ) roles</option>
      </single>
      <html>
        <div>
          <p style="text-align:center;font-size:150%;color:blue;font-weight:bold">Following table will be displayed only for admin and hidden for non-admin</p>
        </div>
      </html>      
    </panel>
  </row>
  <row>
    <panel depends="$access$">
      <table>
        <title>Top 5 Splunk Components with Errors</title>
        <search>
          <query>index=_internal sourcetype=splunkd log_level!="INFO"
| stats count by component
| sort - count
| head 10
| eval access="$access$"
| fields - access</query>
          <earliest>$tokTime.earliest$</earliest>
          <latest>$tokTime.latest$</latest>
        </search>
      </table>
    </panel>
  </row>
</form>

topic Re: Restrict specific users to view only certain panels in Security

Restrict specific users to view only certain panels

Re: Restrict specific users to view only certain panels

Re: Restrict specific users to view only certain panels

Re: Restrict specific users to view only certain panels