Getting Data In

Rest API get users assigned to a role

ebythomaspanick
Explorer

Hi,

I'm trying to make a REST call to get the list of users assigned to a particular role. Is there any such call that can get me this information? I found
https://:8089/servicesNS/admin/UserRoleChecker/authentication/users which is more of a form
1User -> nRoles,
But I was looking for
1Role -> nUsers kind of a data.

Is there any such api call?

0 Karma

niketn
Legend

@ebythomaspanicker it is not 1 --> N it is N --> N so you can use the same REST API and pass specific role/s as per your need and display N User/s returned.

alt text

Try the following run anywhere dashboard examples which uses | rest /services/authorization/roles/ | fields title REST API to get the available Roles. Then on selection of Role/s it displays available roles.

<form>
  <label>Users Belonging to Particular Role</label>
  <fieldset submitButton="false"></fieldset>
  <row>
    <panel>
      <title>Select Roles and combination type to find Users belonging to the Roles</title>
      <input type="radio" token="tokConjuction" searchWhenChanged="true">
        <label>Combine Roles by</label>
        <choice value="AND">AND</choice>
        <choice value="OR">OR</choice>
        <default>AND</default>
        <change>
          <unset token="form.tokRoles"></unset>
        </change>
      </input>
      <input type="multiselect" token="tokRoles" searchWhenChanged="true">
        <label>Available Roles</label>
        <valuePrefix>roles=\"</valuePrefix>
        <valueSuffix>\"</valueSuffix>
        <delimiter> $tokConjuction$ </delimiter>
        <fieldForLabel>title</fieldForLabel>
        <fieldForValue>title</fieldForValue>
        <search>
          <query>| rest /services/authorization/roles/
| fields title</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
      </input>
      <table>
        <search>
          <query>| rest /services/authentication/users search="$tokRoles$"
| fields title
| rename title as "User/s (for selected Roles)"</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Deprecation of Splunk Observability Kubernetes “Classic Navigator” UI starting ...

Access to Splunk Observability Kubernetes “Classic Navigator” UI will no longer be available starting January ...

Now Available: Cisco Talos Threat Intelligence Integrations for Splunk Security Cloud ...

At .conf24, we shared that we were in the process of integrating Cisco Talos threat intelligence into Splunk ...