Security

Filtering DATA on a per ROLE basis

DavidHourani
Super Champion

Hello,

I am trying to create a multi-tenant app:

I currently have 1 index that contains all the data. 2 databases, One that shows user permissions and the other that defines data source location. Permission is based on the location so the three data sources must be correlated in order to get the permissions working. Both these databases are exported to CSV every midnight.

So far I have a search that looks like this:

index=wifi  | lookup location.csv "APname" OUTPUTNEW site | lookup permissions.csv site

So i search the data, extract the location from the first csv then extract the permissions field from the second based on the location.

I would like to add a search restriction in the different roles I'm creating that would add to the search "permissions=role" and that way when a user logs on his/her results will be filtered based on their role.

If i use normal search restriction from the access control menu the filter gets added at the beginning of the search. I would like to add that filter at the end in order to ensure that the fields from my lookups can be used as filters.

Any suggestions ?

regards,
David

0 Karma
1 Solution

DavidHourani
Super Champion

It turns out you can extract the role name of the user using the REST command:

| rest /services/authentication/current-context/context

Using the command posted above you get a lot of information about the current user context and from that you can extract the role name and filter accordingly.

View solution in original post

0 Karma

DavidHourani
Super Champion

It turns out you can extract the role name of the user using the REST command:

| rest /services/authentication/current-context/context

Using the command posted above you get a lot of information about the current user context and from that you can extract the role name and filter accordingly.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...