topic Re: RBAC for Splunk Apps in Splunk Dev

RBAC for Splunk Apps

pubuduhashan — Wed, 20 Mar 2024 18:52:48 GMT

Hi,

Is it possible to create custom permission structure within Splunk Apps and integrate in Splunk User roles?

Use case :

Im developing a custom Splunk App using Splunk UI Toolkit. I need to restrict some features within the app based on Splunk custom user role they have been assigned to.

Thank you.

Re: RBAC for Splunk Apps

gcusello — Thu, 21 Mar 2024 06:36:10 GMT

Hi @pubuduhashan,

if you're speaking of permit different access to a dashboard or to an index to different roles , it's possible managing the grants to the single knwledge objects (dashboards, eventtypes, etc...).

If you want to give limited access to some fields extracted from the raw data in en index, you can give different grants to the field extractions but anyway the users with that role continue to have access to the raw data in the index and it isn't possible to restrict access to a part of an index because grants are managed for the full index.

In this case, you should copy only the information for the restricted roles in a different summary index (you don't pay additional license for this) and use this data for the restricted roles, but it's long to implement.

Ciao.

Giuseppe

Re: RBAC for Splunk Apps

pubuduhashan — Sun, 24 Mar 2024 09:50:13 GMT

Thanks for the prompt response! 🙂

Re: RBAC for Splunk Apps

gcusello — Sun, 24 Mar 2024 10:18:47 GMT

Hi @pubuduhashan ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉