DB Connect - access restrictions to database connections not working

[martin_mueller]

I'm trying to set up db connections with role-based access restrictions. As an example, Splunk role A shall be able to run dbquery using database connection dbA and Splunk role B shall do the same with dbB. Neither can run queries on the other database.

According to http://docs.splunk.com/Documentation/DBX/1.1.1/DeployDBX/Setupuserpermissions#Set_up_user_access_to_... the permissions for a db connection object should provide this level of access control. However, I can't get that to work. Regardless of how restricted I set the permissions for a database connection, a non-privileged user (role B) can still access that database (dbA) through dbquery - even if that database connection is set as private rather than app- or global-shared.

Is anyone able to reproduce this or am I missing something?

[linu1988]

i had reported similar concerns..

[sroback_splunk]

Martin,

The dev team has opened a ticket on this issue and is currently investigating. Looks like it might be a bug.

[araitz]

Yes, the current implementation is sub-optimal, but it was too risky to try to fix that issue comprehensively.

[martin_mueller]

...

currentUser = settings['owner']
ent = en.getEntity(["dbx", "databases"], entityName=dbn, namespace="dbx", owner=currentUser, sessionKey=sessionKey)

[martin_mueller]

I see this has been addressed in 1.1.2, thanks!

However, I fear the fix may have added a new bug. See line 14 of dbquery.py:

ent = en.getEntity(["dbx", "databases"], entityName=dbn, namespace="dbx", owner="nobody", sessionKey=sessionKey)

That loads the REST endpoint using the namespace /servicesNS/nobody/dbx/..., which works well for app- or global-shared objects. Sadly this breaks privately held DB connection objects. In order to fix that, replace with these two lines (next comment):

[linu1988]

I have found something..

While doing | dboutput type=sql database=test table=minimom "update .."

Irrespective of the update success/failure it always says no modification done!!!

Is that a miss in the return statement from database query or something?

[martin_mueller]

Great, thanks!