topic DB Connect - access restrictions to database connections not working in Deployment Architecture

DB Connect - access restrictions to database connections not working

martin_mueller — Fri, 10 Jan 2014 14:33:38 GMT

I'm trying to set up db connections with role-based access restrictions. As an example, Splunk role A shall be able to run dbquery using database connection dbA and Splunk role B shall do the same with dbB. Neither can run queries on the other database.

According to http://docs.splunk.com/Documentation/DBX/1.1.1/DeployDBX/Setupuserpermissions#Set_up_user_access_to_a_specific_database the permissions for a db connection object should provide this level of access control. However, I can't get that to work. Regardless of how restricted I set the permissions for a database connection, a non-privileged user (role B) can still access that database (dbA) through dbquery - even if that database connection is set as private rather than app- or global-shared.

Is anyone able to reproduce this or am I missing something?

Re: DB Connect - access restrictions to database connections not working

sroback_splunk — Fri, 10 Jan 2014 23:25:07 GMT

Martin,

The dev team has opened a ticket on this issue and is currently investigating. Looks like it might be a bug.

Re: DB Connect - access restrictions to database connections not working

linu1988 — Sat, 11 Jan 2014 05:20:11 GMT

i had reported similar concerns..

Re: DB Connect - access restrictions to database connections not working

martin_mueller — Sat, 11 Jan 2014 09:17:26 GMT

Great, thanks!

Re: DB Connect - access restrictions to database connections not working

linu1988 — Sat, 11 Jan 2014 21:59:22 GMT

I have found something..

While doing | dboutput type=sql database=test table=minimom "update .."

Irrespective of the update success/failure it always says no modification done!!!

Is that a miss in the return statement from database query or something?

Re: DB Connect - access restrictions to database connections not working

martin_mueller — Thu, 03 Apr 2014 08:35:46 GMT

I see this has been addressed in 1.1.2, thanks!

However, I fear the fix may have added a new bug. See line 14 of dbquery.py:

ent = en.getEntity(["dbx", "databases"], entityName=dbn, namespace="dbx", owner="nobody", sessionKey=sessionKey)

That loads the REST endpoint using the namespace /servicesNS/nobody/dbx/..., which works well for app- or global-shared objects. Sadly this breaks privately held DB connection objects. In order to fix that, replace with these two lines (next comment):

Re: DB Connect - access restrictions to database connections not working

martin_mueller — Thu, 03 Apr 2014 08:35:54 GMT

...

currentUser = settings['owner']
ent = en.getEntity(["dbx", "databases"], entityName=dbn, namespace="dbx", owner=currentUser, sessionKey=sessionKey)

Re: DB Connect - access restrictions to database connections not working

araitz — Thu, 03 Apr 2014 16:39:57 GMT

Yes, the current implementation is sub-optimal, but it was too risky to try to fix that issue comprehensively.