topic Re: Help with Add-on permissions in Security

Help with Add-on permissions

irsysintegratio — Fri, 22 Sep 2017 13:57:34 GMT

Our customer installed our Addon using an admin account. Now the admin wants to give a power user permission to modify/use this addon. How can this be done please? The admin already granted Read/Write permission of this Addon to everyone. But still for a power user, this Addon is not shown in the available Trigger Actions selections of an Alert.

Everything works fine with the admin account. But customer wants to use the power user account to control it.

Thanks!

Re: Help with Add-on permissions

maciep — Fri, 22 Sep 2017 15:57:14 GMT

If they go to Settings -> Alert Actions, is the alert action listed there? If so, are the permissions set correctly?

Re: Help with Add-on permissions

irsysintegratio — Fri, 22 Sep 2017 16:57:37 GMT

Settings -> Alert Actions only appears for admin user, right? No such thing for power user somehow.

Re: Help with Add-on permissions

irsysintegratio — Fri, 22 Sep 2017 17:39:32 GMT

From Settings->All configurations, the power user can't find the Alert Actions.
The admin can find it from Settings->Alert Actions and Settings->All configurations, and the permission is set to Read/Write for everyone.

Re: Help with Add-on permissions

irsysintegratio — Tue, 29 Sep 2020 15:51:34 GMT

If I move the alert_actions.conf from $SPLUNK_HOME/etc/apps/OUR_ADDON/default to $SPLUNK_HOME/etc/system/local, then the power user can see it. Even though he still have trouble to edit it.

Re: Help with Add-on permissions

maciep — Fri, 22 Sep 2017 18:07:32 GMT

hmm, what is it set to global as well? honestly, i'm not sure exactly which permissions will it available but assume if it's global and read/write for everyone, then everyone should see it from anywhere.

side note, you can respond with comments instead of answers. answers are typically set aside as for when somebody thinks they have an answer to the question.

Re: Help with Add-on permissions

irsysintegratio — Tue, 29 Sep 2020 15:54:54 GMT

Seems to be related to the role setting of power user. If I grant admin_all_objects capability to the power user, then it works. Not sure if our customer likes it though. So still looking for alternatives.

Re: Help with Add-on permissions

lfedak_splunk — Mon, 25 Sep 2017 18:02:56 GMT

Hey @irsyintegration, which add-on are you referring to?