Filtering DATA on a per ROLE basis

[DavidHourani]

Hello,

I am trying to create a multi-tenant app:

I currently have 1 index that contains all the data. 2 databases, One that shows user permissions and the other that defines data source location. Permission is based on the location so the three data sources must be correlated in order to get the permissions working. Both these databases are exported to CSV every midnight.

So far I have a search that looks like this:

index=wifi  | lookup location.csv "APname" OUTPUTNEW site | lookup permissions.csv site

So i search the data, extract the location from the first csv then extract the permissions field from the second based on the location.

I would like to add a search restriction in the different roles I'm creating that would add to the search "permissions=role" and that way when a user logs on his/her results will be filtered based on their role.

If i use normal search restriction from the access control menu the filter gets added at the beginning of the search. I would like to add that filter at the end in order to ensure that the fields from my lookups can be used as filters.

Any suggestions ?

regards,
David

[DavidHourani · Accepted solution]

It turns out you can extract the role name of the user using the REST command:

| rest /services/authentication/current-context/context

Using the command posted above you get a lot of information about the current user context and from that you can extract the role name and filter accordingly.