Archive
Highlighted

Block access to Manager

Communicator

I have seen several questions about restricting access to "Manager" but all of the answers seem to require coding JavaScript.
I do not understand why this is not a "built-in" capability.

I have defined a new role that only has search capability to a specific index. Yet the users in that role have administrative ability via the "Manager" link to change configuration settings. That does not make any sense.

Is there a different way to accomplish this besides coding/modify XML?

I am running Splunk 4.0.3 build 65638.

Tags (1)
0 Karma
Highlighted

Re: Block access to Manager

Builder

I don't have a solution for you, but perhaps more of a question. Is it your intent to prevent non-admin users from being able to say, change their password? non-admin users don't get all the of the admin content from manager. In our shop, we leave that all alone as there's nothing sensitive or damaging that non-admin roles get access to.

If it really has to go away completely for non-admins, I would think that that is unusual enough that yes, you'd need to modify the XML.

View solution in original post

Highlighted

Re: Block access to Manager

Communicator

Thanks very much. I did some more testing and you are correct in that most of the actual fields are restricted when the user clicks on the manager link. However, if the user goes to "Manager --> Field Extractions", then it appears that they can change some of the values in "transforms.conf" and save the changes.

0 Karma
Highlighted

Re: Block access to Manager

Builder

I'm not certain how that works. I would guess that might create configuration within a user's own, local configuration ($SPLUNK_HOME/etc/users/) so it's not tweaking the global config.

If you don't even want that, you might want to file an enhancement request asking for field extractions to be a capability you can remove from the "user" role (I don't see it there currently as a capability).

0 Karma
Highlighted

Re: Block access to Manager

Splunk Employee
Splunk Employee

The Manager link doesn't immediately just give them admin access. Users have their own "knowledge objects" such as searches and macros. They access to these through Manager. They have access to what they create or what you give them access to. If you don't want them to have access to something, manage the permissions of it.

0 Karma
Highlighted

Re: Block access to Manager

Explorer
Highlighted

Re: Block access to Manager

Communicator

Thanks Frank. I will check into that as well.

0 Karma