https://community.splunk.com/t5/Splunk-Search/Locking-down-app-and-role-to-search-only-one-index-why-are-users/m-p/253675#M75939 <P>Yes I am sure! we had an LDAP delay.</P> Tue, 02 Feb 2016 17:00:40 GMT avalle 2016-02-02T17:00:40Z https://community.splunk.com/t5/Splunk-Search/Locking-down-app-and-role-to-search-only-one-index-why-are-users/m-p/253671#M75935 <P>Hello all,</P> <P>I have looked at documentation and a few of the questions on here and have tried it all. <BR /> I have created an app (let's call it ppl app), assigned a role (let's call it ppl role) to it, and that role is locked down to one index (lets call it the ppl index).<BR /> I have given the app access to the ppl role.<BR /> I have restricted that role to search <CODE>index=ppl</CODE> only.</P> <P>Gave it the following capabilities:<BR /> accelerate_search<BR /> change_own_password<BR /> get_typeahead<BR /> pattern_detect<BR /> search</P> <P>Why are the users assigned to this role able to search the main index?<BR /> Am I missing a step somewhere?</P> Tue, 29 Sep 2020 08:35:16 GMT https://community.splunk.com/t5/Splunk-Search/Locking-down-app-and-role-to-search-only-one-index-why-are-users/m-p/253671#M75935 avalle 2020-09-29T08:35:16Z https://community.splunk.com/t5/Splunk-Search/Locking-down-app-and-role-to-search-only-one-index-why-are-users/m-p/253672#M75936 <P>Are the users members of any other role? If a user is a member of multiple roles they will be able to search indexes that are a member of any of the roles. </P> Mon, 01 Feb 2016 19:30:42 GMT https://community.splunk.com/t5/Splunk-Search/Locking-down-app-and-role-to-search-only-one-index-why-are-users/m-p/253672#M75936 gtriSplunk 2016-02-01T19:30:42Z https://community.splunk.com/t5/Splunk-Search/Locking-down-app-and-role-to-search-only-one-index-why-are-users/m-p/253673#M75937 <P>I think I found the answer...........there is a delay in LDAP synch. I just had to wait it out and it worked. </P> Mon, 01 Feb 2016 19:36:06 GMT https://community.splunk.com/t5/Splunk-Search/Locking-down-app-and-role-to-search-only-one-index-why-are-users/m-p/253673#M75937 avalle 2016-02-01T19:36:06Z https://community.splunk.com/t5/Splunk-Search/Locking-down-app-and-role-to-search-only-one-index-why-are-users/m-p/253674#M75938 <P>1) Check if the ppl role is inheriting any other role (say user role)?<BR /> 2) There are two index related settings available while creating a role, "Indexes searched by default" and "Indexes", make sure that only your ppl index is selected in both the settings for ppl role.</P> Mon, 01 Feb 2016 19:39:49 GMT https://community.splunk.com/t5/Splunk-Search/Locking-down-app-and-role-to-search-only-one-index-why-are-users/m-p/253674#M75938 somesoni2 2016-02-01T19:39:49Z https://community.splunk.com/t5/Splunk-Search/Locking-down-app-and-role-to-search-only-one-index-why-are-users/m-p/253675#M75939 <P>Yes I am sure! we had an LDAP delay.</P> Tue, 02 Feb 2016 17:00:40 GMT https://community.splunk.com/t5/Splunk-Search/Locking-down-app-and-role-to-search-only-one-index-why-are-users/m-p/253675#M75939 avalle 2016-02-02T17:00:40Z