topic Re: What is capability required to avoid authorization error when trying to to access Extractions (Settings>Fields>...) that you just created and saved? in Deployment Architecture

What is capability required to avoid authorization error when trying to to access Extractions (Settings>Fields>...) that you just created and saved?

ksoucy — Tue, 29 Sep 2020 13:55:39 GMT

User receives the following authorization error when trying to access extractions that they just created and saved:
AuthorizationFailed: [HTTP 403] Client is not authorized to perform requested action; https://127.0.0.1:8089/servicesNS//search/properties/app?fillcontents=1

Admin user verifies the extractions exist, and they do work/apply when the user is searching data in Splunk Web. However the user who created and "owns" the extraction can not access the Settings>Fields> section to see them.

Users role capabilities are (paste is from authorize.conf, but roles were created in splunk web):
admin_all_objects = enabled
change_own_password = enabled
cumulativeRTSrchJobsQuota = 0
cumulativeSrchJobsQuota = 0
get_metadata = enabled
pattern_detect = enabled
schedule_search = enabled
search = enabled
search_process_config_refresh = enabled
srchIndexesAllowed = lvmv
srchIndexesDefault = lvmv
srchMaxTime = 0

Descriptions of capabilities in Splunk docs are too high level to be of real help.

Re: What is capability required to avoid authorization error when trying to to access Extractions (Settings>Fields>...) that you just created and saved?

ksoucy — Wed, 03 May 2017 14:31:35 GMT

FYI - users id was removed from the URL posted above, but it appears between the "//"

Re: What is capability required to avoid authorization error when trying to to access Extractions (Settings>Fields>...) that you just created and saved?

hhGA — Wed, 03 May 2017 15:10:14 GMT

Hi,

Have you tried the edit_sourcetypes capability?

Re: What is capability required to avoid authorization error when trying to to access Extractions (Settings>Fields>...) that you just created and saved?

ksoucy — Tue, 29 Sep 2020 13:56:03 GMT

Resolved, by adding one capability at a time and testing (eliminating those capabilities that are obviously not involved - like system-level stuff). Turns out its the "rest_properties_get" capability. I never would have guessed this from the description of the capabilty in the docs: rest_properties_get Can get information from the services/properties endpoint.