topic Re: Access Control for Splunk DB Connect in Splunk Search

Access Control for Splunk DB Connect

dabbank — Thu, 06 Dec 2012 13:59:02 GMT

Do I get it right that after the successful setup of the Splunk DB Connect every Splunk user can access the configured databases?
This is not acceptable for almost every environment. I wonder how to implement access control at least per external database on a role basis. It would be nice, if Splunk would implement this feature. You should be able to choose the Roles which are allowed to use an external database, don't you think?

Re: Access Control for Splunk DB Connect

jpass — Thu, 06 Dec 2012 20:15:25 GMT

Can't you just set the permissions for the DB Connect application itself to only allow certain roles to access it? That's what I do and only the admin role can access the Splunk DB Connect interface, views, commands.

I haven't set up lookups yet but I have set up multiple monitoring inputs that push data to different indexes. Indexes have their own permissions settings.

These seem like obvious settings so I'm concerned that I'm missing something on my end and users can access the databases. Can you tell me specifically how all users access the configured db?

Thanks,J

Re: Access Control for Splunk DB Connect

dabbank — Fri, 07 Dec 2012 07:23:18 GMT

To limit the access for the whole application to certain roles is of course no solution. The entitlement for a specific database is user dependent. I can not name a role with access to all databases. Application wide permissions render the DB Connect useless.
I would like to grant the users e.g. R/O access to "their" databases so they can use "dbquery" and "lookup" within searches.

Re: Access Control for Splunk DB Connect

Drainy — Fri, 07 Dec 2012 08:56:51 GMT

How many databases do you access? Another solution could be to have multiple versions of the db connect app installed but renamed for their different purposes. Of course this is a bit of a hack, plus it would break any automatic updates.

Re: Access Control for Splunk DB Connect

dabbank — Fri, 07 Dec 2012 12:03:20 GMT

Not only do we run numerous database but I also want to implement separate entries using different users for the same database. Hereby I could use the database restrictions to adjust the capabilities for my Splunk users. I consider a separate instance for every access profile not even as workaround -- who knows about side effects and the waste of resources caused by this approach.
The DB Connect application is from 2005 and does not support a proper rights management. Do we really talk about an enterprise solution?

Re: Access Control for Splunk DB Connect

Ayn — Fri, 07 Dec 2012 12:44:09 GMT

Uh, the DB connect is not from 2005, it was just released.

Re: Access Control for Splunk DB Connect

dabbank — Fri, 07 Dec 2012 15:04:34 GMT

All files of the app state
Copyright (C) 2005-2012 Splunk Inc. All Rights Reserved.

Re: Access Control for Splunk DB Connect

Drainy — Fri, 07 Dec 2012 15:44:31 GMT

Thats the generic Splunk copyright, have a scroll to the bottom of the page. I believe thats probably the year it came into existence

Re: Access Control for Splunk DB Connect

dabbank — Fri, 07 Dec 2012 16:13:15 GMT

I played with the app and found some interesting results:

The permissions defined in etc/apps/dbx/metadata/default.meta overule the settings in etc/apps/dbx/metadata/local.meta. Therefore you can not use the WebGUI to adjust the access rights. E.g. only the role admin can use the dbquery command per default.
I changed all role settings within the default file to "*" and now it works as expected.

Re: Access Control for Splunk DB Connect

dabbank — Fri, 07 Dec 2012 16:13:49 GMT

The settings in apps/search/metadata/local.meta are respected half way. You can add an access-line within the stanza for an external database connection

[database/MyDB] access = read : [ admin, db_admin ]

At least Splunk respects the read permissions while you edit the settings. E.g. if a user has no read access, he does not see the configured connection underneath External Databases
A lack of read permissions does not stop the user from using the external database within dbquery, though.

Re: Access Control for Splunk DB Connect

dabbank — Mon, 28 Sep 2020 12:55:40 GMT

If a user should be able to configure database connections himself, he needs the admin_all_objects capability in his role 😞

Re: Access Control for Splunk DB Connect

Dan — Fri, 07 Dec 2012 17:30:17 GMT

We will look into this and consider per-database entitlements a feature for an upcoming release. Thanks for raising the issue.

Re: Access Control for Splunk DB Connect

batcave — Wed, 06 Feb 2013 06:11:55 GMT

any updates on this Dan?

Re: Access Control for Splunk DB Connect

Dan — Tue, 12 Feb 2013 22:38:49 GMT

This is high on the docket but I can't provide a timeframe yet