Security

Create saved search via javascript, for user that does not have saved search create rights

BernardEAI
Communicator

 

 

Our app has a functionality where users can create alerts for specific events. Unfortunately the users do not have the rights to create saved searches (we are on a multi-tenant platform, so we cannot change user rights). 

The code for this is:

 

var service = mvc.createService(); 
var mySavedSearches = service.savedSearches();
mySavedSearches.init(admin_service, {app:"APP", sharing:"app"});

// Create a saved search/report as an alert.
// service.savedSearches().create(alertOptions, function (err, alert) {

mySavedSearches.create(alertOptions, function (err, alert) {
  console.log("ALERT");
  // Error checking.
 if (err && err.status === 409) {
  console.error("ERROR: A saved alert with the name '" + alertOptions.name + 
  "' already exists");
  error(alertOptions.name);
  return;
  } else if (err) {
  console.error("There was an error creating the alert:", err);
  return;
  }

  // Confirmation message.
  console.log("Created alert: " + alert.name);
});

 

When logged in as an admin user, the saved searches are created. However, when logged in as a normal user, the following error appears:

 

User 'user' with roles { db_connect_user, user } cannot write: /nobody/APP/savedsearches/test_saved_search { read : [ admin, user ], write : [ admin ] }, export: app, removable: no, modtime: 1559130962.504602000

 

Would it be possible to create these saved searches as admin, by for instance creating a service with the admin user? How could I do this? I have tried:

 

var service = mvc.createService({ owner: "admin" })

 

but this did not work.

Labels (1)
0 Karma

somesoni2
Revered Legend

Splunk JDK is taking credentials of currently logged in user so, since your regular "user" do not have sufficient permissions, they will not be able to create saved searches and can't create a saved search as some other user (admin in your case). 

Splunk has created different roles so that people with right knowledge get right access. For users who should create an alert, why not give them "power" user access with which they should be able to create alerts. See more details on Splunk user roles here: https://docs.splunk.com/Documentation/Splunk/8.2.2/Security/Aboutusersandroles

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...